COPYING | 2 Xext/geext.c | 2 Xext/security.c | 2 Xext/sync.c | 172 Xext/xf86bigfont.c | 91 Xext/xselinux_ext.c | 6 Xi/exevents.c | 3 Xi/extinit.c | 1 Xi/xigrabdev.c | 2 Xi/xipassivegrab.c | 2 Xi/xiproperty.c | 2 Xi/xiquerypointer.c | 2 Xi/xiselectev.c | 15 Xi/xiwarppointer.c | 2 composite/compalloc.c | 40 composite/compext.c | 2 composite/compinit.c | 64 composite/compint.h | 7 composite/compoverlay.c | 2 composite/compwindow.c | 36 config/hal.c | 13 config/udev.c | 33 configure.ac | 40 cpprules.in | 49 dix/Xserver-dtrace.h.in | 2 dix/Xserver.d | 2 dix/deprecated.c | 30 dix/devices.c | 17 dix/dispatch.c | 2 dix/dixfonts.c | 6 dix/events.c | 137 dix/getevents.c | 60 dix/inpututils.c | 8 dix/property.c | 3 dix/resource.c | 44 dix/window.c | 4 doc/man/Makefile.am | 16 doc/xml/Xserver-spec.xml | 7 exa/exa.c | 3 exa/exa_accel.c | 2 exa/exa_driver.c | 2 exa/exa_migration_mixed.c | 17 exa/exa_mixed.c | 2 exa/exa_unaccel.c | 7 fb/Makefile.am | 4 fb/fbcmap_mi.c | 2 glx/glxcmds.c | 188 glx/glxcmdsswap.c | 171 glx/glxdri2.c | 2 glx/unpack.h | 2 glx/xfont.c | 2 hw/dmx/Makefile.am | 32 hw/dmx/Xdmx.man | 741 - hw/dmx/config/Makefile.am | 21 hw/dmx/config/dmxtodmx.man | 41 hw/dmx/config/man/Makefile.am | 2 hw/dmx/config/man/dmxtodmx.man | 41 hw/dmx/config/man/vdltodmx.man | 95 hw/dmx/config/man/xdmxconfig.man | 63 hw/dmx/config/vdltodmx.man | 95 hw/dmx/config/xdmxconfig.c | 2 hw/dmx/config/xdmxconfig.man | 63 hw/dmx/dmx.c | 10 hw/dmx/dmxextension.c | 32 hw/dmx/dmxgc.c | 7 hw/dmx/dmxgcops.c | 10 hw/dmx/dmxpict.c | 54 hw/dmx/dmxwindow.c | 10 hw/dmx/doc/Makefile.am | 2 hw/dmx/glxProxy/glxcmds.c | 182 hw/dmx/glxProxy/glxext.c | 6 hw/dmx/glxProxy/unpack.h | 2 hw/dmx/input/dmxinputinit.c | 40 hw/dmx/man/Makefile.am | 2 hw/dmx/man/Xdmx.man | 741 + hw/kdrive/ephyr/.gitignore | 2 hw/kdrive/ephyr/Makefile.am | 18 hw/kdrive/ephyr/Xephyr.man.pre | 89 hw/kdrive/ephyr/man/Makefile.am | 2 hw/kdrive/ephyr/man/Xephyr.man | 87 hw/vfb/.gitignore | 2 hw/vfb/Makefile.am | 21 hw/vfb/Xvfb.man.pre | 125 hw/vfb/man/Makefile.am | 2 hw/vfb/man/Xvfb.man | 125 hw/xfree86/.gitignore | 3 hw/xfree86/Makefile.am | 18 hw/xfree86/common/Makefile.am | 5 hw/xfree86/common/compiler.h | 13 hw/xfree86/common/scoasm.h | 142 hw/xfree86/common/xf86.h | 2 hw/xfree86/common/xf86AutoConfig.c | 6 hw/xfree86/common/xf86Bus.c | 35 hw/xfree86/common/xf86Config.c | 13 hw/xfree86/common/xf86Configure.c | 54 hw/xfree86/common/xf86Cursor.c | 6 hw/xfree86/common/xf86DGA.c | 51 hw/xfree86/common/xf86Events.c | 13 hw/xfree86/common/xf86Globals.c | 1 hw/xfree86/common/xf86Helper.c | 15 hw/xfree86/common/xf86Init.c | 30 hw/xfree86/common/xf86Module.h | 2 hw/xfree86/common/xf86Option.c | 7 hw/xfree86/common/xf86PM.c | 23 hw/xfree86/common/xf86Priv.h | 1 hw/xfree86/common/xf86ShowOpts.c | 10 hw/xfree86/common/xf86VGAarbiter.c | 5 hw/xfree86/common/xf86VGAarbiterPriv.h | 2 hw/xfree86/common/xf86VidMode.c | 2 hw/xfree86/common/xf86Xinput.c | 52 hw/xfree86/common/xf86pciBus.c | 4 hw/xfree86/common/xf86sbusBus.c | 6 hw/xfree86/common/xf86str.h | 7 hw/xfree86/common/xf86xv.c | 210 hw/xfree86/common/xf86xv.h | 3 hw/xfree86/common/xf86xvpriv.h | 6 hw/xfree86/ddc/ddc.c | 11 hw/xfree86/dixmods/extmod/dgaproc.h | 1 hw/xfree86/dixmods/extmod/modinit.c | 5 hw/xfree86/dixmods/extmod/modinit.h | 4 hw/xfree86/doc/Makefile.am | 4 hw/xfree86/doc/man/.gitignore | 4 hw/xfree86/doc/man/Makefile.am | 27 hw/xfree86/doc/man/Xorg.man | 689 hw/xfree86/doc/man/Xorg.man.pre | 689 hw/xfree86/doc/man/xorg.conf.d.man | 1 hw/xfree86/doc/man/xorg.conf.man | 2478 +++ hw/xfree86/doc/man/xorg.conf.man.pre | 2478 --- hw/xfree86/dri/dri.c | 9 hw/xfree86/dri2/dri2.c | 13 hw/xfree86/exa/.gitignore | 2 hw/xfree86/exa/Makefile.am | 14 hw/xfree86/exa/exa.man.pre | 42 hw/xfree86/exa/man/Makefile.am | 2 hw/xfree86/exa/man/exa.man | 42 hw/xfree86/fbdevhw/.gitignore | 2 hw/xfree86/fbdevhw/Makefile.am | 14 hw/xfree86/fbdevhw/fbdevhw.c | 56 hw/xfree86/fbdevhw/fbdevhw.man.pre | 22 hw/xfree86/fbdevhw/man/Makefile.am | 2 hw/xfree86/fbdevhw/man/fbdevhw.man | 22 hw/xfree86/int10/helper_exec.c | 7 hw/xfree86/loader/loader.c | 20 hw/xfree86/loader/loadmod.c | 20 hw/xfree86/loader/os.c | 2 hw/xfree86/loader/sdksyms.sh | 7 hw/xfree86/modes/xf86Crtc.c | 11 hw/xfree86/modes/xf86EdidModes.c | 7 hw/xfree86/modes/xf86Modes.c | 37 hw/xfree86/modes/xf86cvt.c | 10 hw/xfree86/os-support/Makefile.am | 2 hw/xfree86/os-support/linux/lnx_agp.c | 2 hw/xfree86/os-support/linux/lnx_video.c | 2 hw/xfree86/os-support/sco/Makefile.am | 5 hw/xfree86/os-support/sco/VTsw_sco.c | 127 hw/xfree86/os-support/sco/sco_init.c | 294 hw/xfree86/os-support/sco/sco_iop.c | 90 hw/xfree86/os-support/sco/sco_video.c | 290 hw/xfree86/os-support/solaris/solaris-amd64.S | 2 hw/xfree86/os-support/solaris/solaris-ia32.S | 2 hw/xfree86/os-support/solaris/solaris-sparcv8plus.S | 2 hw/xfree86/os-support/solaris/sun_VTsw.c | 2 hw/xfree86/os-support/solaris/sun_agp.c | 2 hw/xfree86/os-support/solaris/sun_apm.c | 2 hw/xfree86/os-support/solaris/sun_bell.c | 2 hw/xfree86/os-support/solaris/sun_vid.c | 2 hw/xfree86/os-support/xf86_OSlib.h | 31 hw/xfree86/parser/Flags.c | 13 hw/xfree86/parser/Makefile.am | 8 hw/xfree86/parser/Pointer.c | 16 hw/xfree86/ramdac/Makefile.am | 4 hw/xfree86/utils/Makefile.am | 3 hw/xfree86/utils/cvt/.gitignore | 2 hw/xfree86/utils/cvt/Makefile.am | 15 hw/xfree86/utils/cvt/cvt.c | 18 hw/xfree86/utils/cvt/cvt.man.pre | 42 hw/xfree86/utils/gtf/.gitignore | 2 hw/xfree86/utils/gtf/Makefile.am | 19 hw/xfree86/utils/gtf/gtf.man.pre | 45 hw/xfree86/utils/man/Makefile.am | 2 hw/xfree86/utils/man/cvt.man | 42 hw/xfree86/utils/man/gtf.man | 45 hw/xfree86/vbe/vbeModes.c | 4 hw/xfree86/x86emu/ops.c | 63 hw/xfree86/xaa/Makefile.am | 52 hw/xfree86/xaa/xaaBitBlt.c | 6 hw/xfree86/xorgconf.cpp | 610 hw/xnest/.gitignore | 2 hw/xnest/Makefile.am | 26 hw/xnest/Xnest.man.pre | 428 hw/xnest/man/Makefile.am | 2 hw/xnest/man/Xnest.man | 428 hw/xquartz/GL/Makefile.am | 2 hw/xquartz/Makefile.am | 6 hw/xquartz/X11Application.h | 1 hw/xquartz/X11Application.m | 2 hw/xquartz/X11Controller.h | 1 hw/xquartz/X11Controller.m | 4 hw/xquartz/bundle/Info.plist.cpp | 8 hw/xquartz/bundle/Resources/Dutch.lproj/locversion.plist | 4 hw/xquartz/bundle/Resources/Dutch.lproj/main.nib/designable.nib | 440 hw/xquartz/bundle/Resources/Dutch.lproj/main.nib/keyedobjects.nib |binary hw/xquartz/bundle/Resources/English.lproj/main.nib/designable.nib | 320 hw/xquartz/bundle/Resources/English.lproj/main.nib/keyedobjects.nib |binary hw/xquartz/bundle/Resources/German.lproj/locversion.plist | 4 hw/xquartz/bundle/Resources/German.lproj/main.nib/designable.nib | 208 hw/xquartz/bundle/Resources/German.lproj/main.nib/keyedobjects.nib |binary hw/xquartz/bundle/Resources/Italian.lproj/locversion.plist | 4 hw/xquartz/bundle/Resources/Italian.lproj/main.nib/designable.nib | 434 hw/xquartz/bundle/Resources/Italian.lproj/main.nib/keyedobjects.nib |binary hw/xquartz/bundle/Resources/Japanese.lproj/locversion.plist | 4 hw/xquartz/bundle/Resources/Japanese.lproj/main.nib/designable.nib | 229 hw/xquartz/bundle/Resources/Japanese.lproj/main.nib/keyedobjects.nib |binary hw/xquartz/bundle/Resources/Spanish.lproj/locversion.plist | 4 hw/xquartz/bundle/Resources/Spanish.lproj/main.nib/designable.nib | 441 hw/xquartz/bundle/Resources/Spanish.lproj/main.nib/keyedobjects.nib |binary hw/xquartz/bundle/Resources/ar.lproj/locversion.plist | 4 hw/xquartz/bundle/Resources/ar.lproj/main.nib/designable.nib | 441 hw/xquartz/bundle/Resources/ar.lproj/main.nib/keyedobjects.nib |binary hw/xquartz/bundle/Resources/da.lproj/locversion.plist | 4 hw/xquartz/bundle/Resources/da.lproj/main.nib/designable.nib | 402 hw/xquartz/bundle/Resources/da.lproj/main.nib/keyedobjects.nib |binary hw/xquartz/bundle/Resources/fi.lproj/locversion.plist | 4 hw/xquartz/bundle/Resources/fi.lproj/main.nib/designable.nib | 209 hw/xquartz/bundle/Resources/fi.lproj/main.nib/keyedobjects.nib |binary hw/xquartz/bundle/Resources/ko.lproj/locversion.plist | 4 hw/xquartz/bundle/Resources/ko.lproj/main.nib/designable.nib | 411 hw/xquartz/bundle/Resources/ko.lproj/main.nib/keyedobjects.nib |binary hw/xquartz/bundle/Resources/no.lproj/locversion.plist | 4 hw/xquartz/bundle/Resources/no.lproj/main.nib/designable.nib | 448 hw/xquartz/bundle/Resources/no.lproj/main.nib/keyedobjects.nib |binary hw/xquartz/bundle/Resources/pl.lproj/locversion.plist | 4 hw/xquartz/bundle/Resources/pl.lproj/main.nib/designable.nib | 418 hw/xquartz/bundle/Resources/pl.lproj/main.nib/keyedobjects.nib |binary hw/xquartz/bundle/Resources/pt.lproj/locversion.plist | 4 hw/xquartz/bundle/Resources/pt.lproj/main.nib/designable.nib | 459 hw/xquartz/bundle/Resources/pt.lproj/main.nib/keyedobjects.nib |binary hw/xquartz/bundle/Resources/pt_PT.lproj/locversion.plist | 4 hw/xquartz/bundle/Resources/pt_PT.lproj/main.nib/designable.nib | 198 hw/xquartz/bundle/Resources/pt_PT.lproj/main.nib/keyedobjects.nib |binary hw/xquartz/bundle/Resources/ru.lproj/locversion.plist | 4 hw/xquartz/bundle/Resources/ru.lproj/main.nib/designable.nib | 424 hw/xquartz/bundle/Resources/ru.lproj/main.nib/keyedobjects.nib |binary hw/xquartz/bundle/Resources/sv.lproj/locversion.plist | 4 hw/xquartz/bundle/Resources/sv.lproj/main.nib/designable.nib | 421 hw/xquartz/bundle/Resources/sv.lproj/main.nib/keyedobjects.nib |binary hw/xquartz/bundle/Resources/zh_CN.lproj/Localizable.strings |binary hw/xquartz/bundle/Resources/zh_CN.lproj/locversion.plist | 4 hw/xquartz/bundle/Resources/zh_CN.lproj/main.nib/designable.nib | 7106 ++++------ hw/xquartz/bundle/Resources/zh_CN.lproj/main.nib/keyedobjects.nib |binary hw/xquartz/bundle/Resources/zh_TW.lproj/locversion.plist | 4 hw/xquartz/bundle/Resources/zh_TW.lproj/main.nib/designable.nib | 447 hw/xquartz/bundle/Resources/zh_TW.lproj/main.nib/keyedobjects.nib |binary hw/xquartz/bundle/cpprules.in | 22 hw/xquartz/darwinEvents.c | 3 hw/xquartz/doc/Makefile.am | 16 hw/xquartz/doc/Xquartz.man.pre | 162 hw/xquartz/man/Makefile.am | 2 hw/xquartz/man/Xquartz.man | 162 hw/xquartz/quartz.c | 35 hw/xquartz/quartz.h | 1 hw/xquartz/quartzAudio.c | 329 hw/xquartz/quartzAudio.h | 37 hw/xquartz/quartzKeyboard.c | 1 hw/xquartz/quartzStartup.c | 4 hw/xwin/.gitignore | 3 hw/xwin/InitOutput.c | 13 hw/xwin/Makefile.am | 28 hw/xwin/XWin.man.pre | 346 hw/xwin/XWinrc.man.pre | 253 hw/xwin/man/Makefile.am | 3 hw/xwin/man/XWin.man | 397 hw/xwin/man/XWinrc.man | 253 hw/xwin/win.h | 63 hw/xwin/winclipboardxevents.c | 3 hw/xwin/winconfig.c | 77 hw/xwin/wincreatewnd.c | 48 hw/xwin/windialogs.c | 18 hw/xwin/winerror.c | 24 hw/xwin/winkeybd.c | 8 hw/xwin/winkeybd.h | 16 hw/xwin/winkeyhook.c | 4 hw/xwin/winkeynames.h | 13 hw/xwin/winlayouts.h | 8 hw/xwin/winmonitors.c | 92 hw/xwin/winmonitors.h | 14 hw/xwin/winnativegdi.c | 37 hw/xwin/winpfbdd.c | 108 hw/xwin/winprocarg.c | 131 hw/xwin/winrandr.c | 302 hw/xwin/winscrinit.c | 66 hw/xwin/winshaddd.c | 164 hw/xwin/winshadddnl.c | 152 hw/xwin/winshadgdi.c | 124 hw/xwin/winvalargs.c | 8 hw/xwin/winwindow.c | 1 hw/xwin/winwndproc.c | 307 include/Makefile.am | 1 include/Xprintf.h | 69 include/dix-config.h.in | 3 include/dix.h | 7 include/eventstr.h | 2 include/exevents.h | 4 include/input.h | 26 include/inputstr.h | 82 include/inpututils.h | 8 include/os.h | 13 include/resource.h | 2 include/scrnintstr.h | 7 include/windowstr.h | 3 m4/ax_tls.m4 | 74 manpages.am | 37 mi/micmap.c | 2 mi/micopy.c | 6 mi/miinitext.c | 2 mi/misprite.c | 122 miext/damage/Makefile.am | 2 miext/damage/damage.c | 20 miext/rootless/Makefile.am | 1 miext/rootless/rootlessScreen.c | 5 miext/shadow/Makefile.am | 2 miext/sync/misync.c | 1 os/WaitFor.c | 12 os/access.c | 36 os/connection.c | 1 os/log.c | 12 os/osdep.h | 4 os/osinit.c | 5 os/utils.c | 16 os/xprintf.c | 172 randr/rrdispatch.c | 2 randr/rrmode.c | 2 randr/rrscreen.c | 12 render/animcur.c | 26 render/mipict.c | 3 render/render.c | 14 test/input.c | 32 test/xi2/protocol-eventconvert.c | 12 test/xi2/protocol-xiselectevents.c | 18 xfixes/cursor.c | 4 xfixes/xfixes.c | 2 xfixes/xfixesint.h | 2 xkb/XKBMisc.c | 15 xkb/ddxList.c | 43 xkb/ddxLoad.c | 99 xkb/xkb.c | 23 xkb/xkbUtils.c | 9 347 files changed, 17051 insertions(+), 15788 deletions(-)
New commits: commit 443d75446bcbe7d97a23860a1e2d46c0b7e7cb26 Author: Keith Packard <kei...@keithp.com> Date: Fri Feb 18 14:46:33 2011 -0800 Version bumped to 1.9.99.902 (1.10 RC2) Signed-off-by: Keith Packard <kei...@keithp.com> diff --git a/configure.ac b/configure.ac index 9b3e2be..ac4bf8c 100644 --- a/configure.ac +++ b/configure.ac @@ -26,8 +26,8 @@ dnl dnl Process this file with autoconf to create configure. AC_PREREQ(2.57) -AC_INIT([xorg-server], 1.9.99.901, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server) -RELEASE_DATE="2010-12-06" +AC_INIT([xorg-server], 1.9.99.902, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server) +RELEASE_DATE="2011-2-18" AC_CONFIG_SRCDIR([Makefile.am]) AM_INIT_AUTOMAKE([foreign dist-bzip2]) AM_MAINTAINER_MODE commit a73c28f0bdafb1c5cb8129179188a99c0ca052e2 Author: Justin Dou <justin....@intel.com> Date: Thu Feb 10 16:27:29 2011 -0500 Replace malloc with calloc to initialize the buffers[] as NULL in do_get_buffers function The calling for allocate_or_reuse_buffer may fail due to some reason, e.g. out of memory. If the buffers[] were not initialized to be NULL, the following err_out may try to access an illegal memory, which will cause X crash afterward. Reviewed-by: Kristian Høgsberg <k...@bitplanet.net> Signed-off-by: Justin Dou <justin....@intel.com> Signed-off-by: Keith Packard <kei...@keithp.com> diff --git a/hw/xfree86/dri2/dri2.c b/hw/xfree86/dri2/dri2.c index 39996f9..9ca378f 100644 --- a/hw/xfree86/dri2/dri2.c +++ b/hw/xfree86/dri2/dri2.c @@ -403,7 +403,7 @@ do_get_buffers(DrawablePtr pDraw, int *width, int *height, && (pDraw->height == pPriv->height) && (pPriv->serialNumber == DRI2DrawableSerial(pDraw)); - buffers = malloc((count + 1) * sizeof(buffers[0])); + buffers = calloc((count + 1), sizeof(buffers[0])); for (i = 0; i < count; i++) { const unsigned attachment = *(attachments++); commit 3bbb70a1a7b24d3d1375b20a13db7011cf961c86 Author: Peter Hutterer <peter.hutte...@who-t.net> Date: Wed Feb 16 07:56:58 2011 +1000 xfree86: fix up an out-of-date comment. InitInput simply initialises all input devices now. Signed-off-by: Peter Hutterer <peter.hutte...@who-t.net> Reviewed-by: Keith Packard <kei...@keithp.com> diff --git a/hw/xfree86/common/xf86Init.c b/hw/xfree86/common/xf86Init.c index a1fda54..e664ce4 100644 --- a/hw/xfree86/common/xf86Init.c +++ b/hw/xfree86/common/xf86Init.c @@ -808,7 +808,7 @@ InitInput(int argc, char **argv) GetEventList(&xf86Events); - /* Call the PreInit function for each input device instance. */ + /* Initialize all configured input devices */ for (pDev = xf86ConfigLayout.inputs; pDev && *pDev; pDev++) { /* Replace obsolete keyboard driver with kbd */ if (!xf86NameCmp((*pDev)->driver, "keyboard")) { commit 402b329c3aa8ddbebaa1f593306a02d4cd6fed26 Author: Julien Cristau <jcris...@debian.org> Date: Sun Jan 23 13:35:54 2011 +0100 glx: Work around wrong request lengths sent by mesa mesa used to send too long requests for GLXDestroyPixmap, GLXDestroyWindow, GLXChangeDrawableAttributes, GLXGetDrawableAttributes and GLXGetFBConfigsSGIX. Fixes a regression introduced in ec9c97c6bf70b523bc500bd3adf62176f1bb33a4 X.Org bug#33324 <https://bugs.freedesktop.org/show_bug.cgi?id=33324> Reported-by: xunx.f...@intel.com Signed-off-by: Julien Cristau <jcris...@debian.org> Reviewed-by: Adam Jackson <a...@redhat.com> diff --git a/glx/glxcmds.c b/glx/glxcmds.c index 5d633df..9b4bc9e 100644 --- a/glx/glxcmds.c +++ b/glx/glxcmds.c @@ -1132,7 +1132,8 @@ int __glXDisp_GetFBConfigsSGIX(__GLXclientState *cl, GLbyte *pc) { ClientPtr client = cl->client; xGLXGetFBConfigsSGIXReq *req = (xGLXGetFBConfigsSGIXReq *) pc; - REQUEST_SIZE_MATCH(xGLXGetFBConfigsSGIXReq); + /* work around mesa bug, don't use REQUEST_SIZE_MATCH */ + REQUEST_AT_LEAST_SIZE(xGLXGetFBConfigsSGIXReq); return DoGetFBConfigs(cl, req->screen); } @@ -1356,7 +1357,9 @@ int __glXDisp_DestroyPixmap(__GLXclientState *cl, GLbyte *pc) ClientPtr client = cl->client; xGLXDestroyPixmapReq *req = (xGLXDestroyPixmapReq *) pc; - REQUEST_SIZE_MATCH(xGLXDestroyPixmapReq); + /* should be REQUEST_SIZE_MATCH, but mesa's glXDestroyPixmap used to set + * length to 3 instead of 2 */ + REQUEST_AT_LEAST_SIZE(xGLXDestroyPixmapReq); return DoDestroyDrawable(cl, req->glxpixmap, GLX_DRAWABLE_PIXMAP); } @@ -1498,7 +1501,13 @@ int __glXDisp_ChangeDrawableAttributes(__GLXclientState *cl, GLbyte *pc) client->errorValue = req->numAttribs; return BadValue; } +#if 0 + /* mesa sends an additional 8 bytes */ REQUEST_FIXED_SIZE(xGLXChangeDrawableAttributesReq, req->numAttribs << 3); +#else + if (((sizeof(xGLXChangeDrawableAttributesReq) + (req->numAttribs << 3)) >> 2) < client->req_len) + return BadLength; +#endif return DoChangeDrawableAttributes(cl->client, req->drawable, req->numAttribs, (CARD32 *) (req + 1)); @@ -1563,7 +1572,8 @@ int __glXDisp_DestroyWindow(__GLXclientState *cl, GLbyte *pc) ClientPtr client = cl->client; xGLXDestroyWindowReq *req = (xGLXDestroyWindowReq *) pc; - REQUEST_SIZE_MATCH(xGLXDestroyWindowReq); + /* mesa's glXDestroyWindow used to set length to 3 instead of 2 */ + REQUEST_AT_LEAST_SIZE(xGLXDestroyWindowReq); return DoDestroyDrawable(cl, req->glxwindow, GLX_DRAWABLE_WINDOW); } @@ -1872,7 +1882,8 @@ int __glXDisp_GetDrawableAttributes(__GLXclientState *cl, GLbyte *pc) ClientPtr client = cl->client; xGLXGetDrawableAttributesReq *req = (xGLXGetDrawableAttributesReq *)pc; - REQUEST_SIZE_MATCH(xGLXGetDrawableAttributesReq); + /* this should be REQUEST_SIZE_MATCH, but mesa sends an additional 4 bytes */ + REQUEST_AT_LEAST_SIZE(xGLXGetDrawableAttributesReq); return DoGetDrawableAttributes(cl, req->drawable); } diff --git a/glx/glxcmdsswap.c b/glx/glxcmdsswap.c index d58de62..76e6fb6 100644 --- a/glx/glxcmdsswap.c +++ b/glx/glxcmdsswap.c @@ -279,7 +279,7 @@ int __glXDispSwap_GetFBConfigsSGIX(__GLXclientState *cl, GLbyte *pc) xGLXGetFBConfigsSGIXReq *req = (xGLXGetFBConfigsSGIXReq *) pc; __GLX_DECLARE_SWAP_VARIABLES; - REQUEST_SIZE_MATCH(xGLXGetFBConfigsSGIXReq); + REQUEST_AT_LEAST_SIZE(xGLXGetFBConfigsSGIXReq); __GLX_SWAP_INT(&req->screen); return __glXDisp_GetFBConfigsSGIX(cl, pc); @@ -368,7 +368,7 @@ int __glXDispSwap_DestroyPixmap(__GLXclientState *cl, GLbyte *pc) xGLXDestroyGLXPixmapReq *req = (xGLXDestroyGLXPixmapReq *) pc; __GLX_DECLARE_SWAP_VARIABLES; - REQUEST_SIZE_MATCH(xGLXDestroyGLXPixmapReq); + REQUEST_AT_LEAST_SIZE(xGLXDestroyGLXPixmapReq); __GLX_SWAP_SHORT(&req->length); __GLX_SWAP_INT(&req->glxpixmap); @@ -476,7 +476,9 @@ int __glXDispSwap_ChangeDrawableAttributes(__GLXclientState *cl, GLbyte *pc) client->errorValue = req->numAttribs; return BadValue; } - REQUEST_FIXED_SIZE(xGLXChangeDrawableAttributesReq, req->numAttribs << 3); + if (((sizeof(xGLXChangeDrawableAttributesReq) + (req->numAttribs << 3)) >> 2) < client->req_len) + return BadLength; + attribs = (CARD32*)(req + 1); __GLX_SWAP_INT_ARRAY(attribs, req->numAttribs << 1); @@ -542,7 +544,7 @@ int __glXDispSwap_DestroyWindow(__GLXclientState *cl, GLbyte *pc) xGLXDestroyWindowReq *req = (xGLXDestroyWindowReq *) pc; __GLX_DECLARE_SWAP_VARIABLES; - REQUEST_SIZE_MATCH(xGLXDestroyWindowReq); + REQUEST_AT_LEAST_SIZE(xGLXDestroyWindowReq); __GLX_SWAP_INT(&req->glxwindow); @@ -742,7 +744,7 @@ int __glXDispSwap_GetDrawableAttributes(__GLXclientState *cl, GLbyte *pc) xGLXGetDrawableAttributesReq *req = (xGLXGetDrawableAttributesReq *)pc; __GLX_DECLARE_SWAP_VARIABLES; - REQUEST_SIZE_MATCH(xGLXGetDrawableAttributesReq); + REQUEST_AT_LEAST_SIZE(xGLXGetDrawableAttributesReq); __GLX_SWAP_SHORT(&req->length); __GLX_SWAP_INT(&req->drawable); commit 1137c11be0f82049d28024eaf963c6f76e0d4334 Author: Julien Cristau <jcris...@debian.org> Date: Wed Jan 26 13:06:53 2011 +0100 glx: fix BindTexImageEXT length check The request is followed by a list of attributes. X.Org bug#33449 Reported-and-tested-by: meng <mengmeng.m...@intel.com> Signed-off-by: Julien Cristau <jcris...@debian.org> Reviewed-by: Adam Jackson <a...@redhat.com> diff --git a/glx/glxcmds.c b/glx/glxcmds.c index 0b375c3..5d633df 100644 --- a/glx/glxcmds.c +++ b/glx/glxcmds.c @@ -1697,13 +1697,21 @@ int __glXDisp_BindTexImageEXT(__GLXclientState *cl, GLbyte *pc) GLXDrawable drawId; int buffer; int error; + CARD32 num_attribs; - REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 8); + if ((sizeof(xGLXVendorPrivateReq) + 12) >> 2 > client->req_len) + return BadLength; pc += __GLX_VENDPRIV_HDR_SIZE; drawId = *((CARD32 *) (pc)); buffer = *((INT32 *) (pc + 4)); + num_attribs = *((CARD32 *) (pc + 8)); + if (num_attribs > (UINT32_MAX >> 3)) { + client->errorValue = num_attribs; + return BadValue; + } + REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 12 + (num_attribs << 3)); if (buffer != GLX_FRONT_LEFT_EXT) return __glXError(GLXBadPixmap); diff --git a/glx/glxcmdsswap.c b/glx/glxcmdsswap.c index 9d96c9d..d58de62 100644 --- a/glx/glxcmdsswap.c +++ b/glx/glxcmdsswap.c @@ -648,19 +648,23 @@ int __glXDispSwap_BindTexImageEXT(__GLXclientState *cl, GLbyte *pc) xGLXVendorPrivateReq *req = (xGLXVendorPrivateReq *) pc; GLXDrawable *drawId; int *buffer; + CARD32 *num_attribs; __GLX_DECLARE_SWAP_VARIABLES; - REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 8); + if ((sizeof(xGLXVendorPrivateReq) + 12) >> 2 > client->req_len) + return BadLength; pc += __GLX_VENDPRIV_HDR_SIZE; drawId = ((GLXDrawable *) (pc)); buffer = ((int *) (pc + 4)); + num_attribs = ((CARD32 *) (pc + 8)); __GLX_SWAP_SHORT(&req->length); __GLX_SWAP_INT(&req->contextTag); __GLX_SWAP_INT(drawId); __GLX_SWAP_INT(buffer); + __GLX_SWAP_INT(num_attribs); return __glXDisp_BindTexImageEXT(cl, (GLbyte *)pc); } commit a883cf1545abd89bb2cadfa659718884b56fd234 Author: Julien Cristau <jcris...@debian.org> Date: Sun Jan 23 17:05:26 2011 +0100 glx: fix request length check for CreateGLXPbufferSGIX The request is followed by an attribute list. Signed-off-by: Julien Cristau <jcris...@debian.org> Reviewed-by: Adam Jackson <a...@redhat.com> diff --git a/glx/glxcmds.c b/glx/glxcmds.c index 3ef567d..0b375c3 100644 --- a/glx/glxcmds.c +++ b/glx/glxcmds.c @@ -1436,7 +1436,7 @@ int __glXDisp_CreateGLXPbufferSGIX(__GLXclientState *cl, GLbyte *pc) ClientPtr client = cl->client; xGLXCreateGLXPbufferSGIXReq *req = (xGLXCreateGLXPbufferSGIXReq *) pc; - REQUEST_SIZE_MATCH(xGLXCreateGLXPbufferSGIXReq); + REQUEST_AT_LEAST_SIZE(xGLXCreateGLXPbufferSGIXReq); return DoCreatePbuffer(cl->client, req->screen, req->fbconfig, req->width, req->height, req->pbuffer); diff --git a/glx/glxcmdsswap.c b/glx/glxcmdsswap.c index 3bb4cad..9d96c9d 100644 --- a/glx/glxcmdsswap.c +++ b/glx/glxcmdsswap.c @@ -421,7 +421,7 @@ int __glXDispSwap_CreateGLXPbufferSGIX(__GLXclientState *cl, GLbyte *pc) xGLXCreateGLXPbufferSGIXReq *req = (xGLXCreateGLXPbufferSGIXReq *) pc; __GLX_DECLARE_SWAP_VARIABLES; - REQUEST_SIZE_MATCH(xGLXCreateGLXPbufferSGIXReq); + REQUEST_AT_LEAST_SIZE(xGLXCreateGLXPbufferSGIXReq); __GLX_SWAP_INT(&req->screen); __GLX_SWAP_INT(&req->fbconfig); commit c9f7b303a36ca501c6ecf1196c266ee8e8f49d2d Author: Peter Hutterer <peter.hutte...@who-t.net> Date: Fri Feb 11 13:50:10 2011 +1000 xfixes: calloc, not malloc the cursorScreenRec Debugging NULL pointers is significantly easier than random memory. Plus, if new fields (such as pointer barriers) are added they may just be properly initialised. Signed-off-by: Peter Hutterer <peter.hutte...@who-t.net> Reviewed-by: Keith Packard <kei...@keithp.com> diff --git a/xfixes/cursor.c b/xfixes/cursor.c index 54e5d75..fb608f6 100644 --- a/xfixes/cursor.c +++ b/xfixes/cursor.c @@ -1045,7 +1045,7 @@ XFixesCursorInit (void) ScreenPtr pScreen = screenInfo.screens[i]; CursorScreenPtr cs; - cs = (CursorScreenPtr) malloc(sizeof (CursorScreenRec)); + cs = (CursorScreenPtr) calloc(1, sizeof (CursorScreenRec)); if (!cs) return FALSE; Wrap (cs, pScreen, CloseScreen, CursorCloseScreen); commit d3499556d8d83396fa2585bd00371a81e086be36 Author: Peter Hutterer <peter.hutte...@who-t.net> Date: Thu Feb 10 15:12:14 2011 +1000 xkb: if the keymap failed to compile, load the default keymap instead. We really need symbols, compat, keynames, vmods and types for a sensible keymap. Try this in your xorg.conf.d snippets for all keyboards: Option "XkbLayout" "us" Option "XkbVariant" "nodeadkeys" us(nodeadkeys) doesn't exist so xkbcomp provides everything but the symbols map. We say we want everything but don't _need_ anything, the server happily gives us a keymap with every key mapped to NoSymbol. This in turn isn't what we want after all. So instead, require symbols, compat, keynames, vmods and types from the keymap and if that fails, load the default keymap instead. If that fails too, all bets are off. Signed-off-by: Peter Hutterer <peter.hutte...@who-t.net> Reviewed-by: Dan Nicholson <dbn.li...@gmail.com> diff --git a/xkb/ddxLoad.c b/xkb/ddxLoad.c index b968c43..ac587fc 100644 --- a/xkb/ddxLoad.c +++ b/xkb/ddxLoad.c @@ -470,13 +470,34 @@ XkbDescPtr XkbCompileKeymap(DeviceIntPtr dev, XkbRMLVOSet *rmlvo) { XkbDescPtr xkb; + unsigned int need; if (!dev || !rmlvo) { LogMessage(X_ERROR, "XKB: No device or RMLVO specified\n"); return NULL; } - xkb = XkbCompileKeymapForDevice(dev, rmlvo, 0); + /* These are the components we really really need */ + need = XkmSymbolsMask | XkmCompatMapMask | XkmTypesMask | + XkmKeyNamesMask | XkmVirtualModsMask; + + + xkb = XkbCompileKeymapForDevice(dev, rmlvo, need); + + if (!xkb) { + XkbRMLVOSet dflts; + + /* we didn't get what we really needed. And that will likely leave + * us with a keyboard that doesn't work. Use the defaults instead */ + LogMessage(X_ERROR, "XKB: Failed to load keymap. Loading default " + "keymap instead.\n"); + + XkbGetRulesDflts(&dflts); + + xkb = XkbCompileKeymapForDevice(dev, &dflts, 0); + + XkbFreeRMLVOSet(&dflts, FALSE); + } return xkb; } commit 47d1d2fed656c3a3b2600491078da90962c46934 Author: Peter Hutterer <peter.hutte...@who-t.net> Date: Thu Feb 10 15:11:34 2011 +1000 xkb: split out keymap compilation. Refactoring for simpler double-use in the next patch. No functional changes. Signed-off-by: Peter Hutterer <peter.hutte...@who-t.net> Reviewed-by: Dan Nicholson <dbn.li...@gmail.com> diff --git a/xkb/ddxLoad.c b/xkb/ddxLoad.c index 51b5777..b968c43 100644 --- a/xkb/ddxLoad.c +++ b/xkb/ddxLoad.c @@ -425,35 +425,58 @@ XkbRF_RulesPtr rules; return complete; } -XkbDescPtr -XkbCompileKeymap(DeviceIntPtr dev, XkbRMLVOSet *rmlvo) +static Bool +XkbRMLVOtoKcCGST(DeviceIntPtr dev, XkbRMLVOSet *rmlvo, XkbComponentNamesPtr kccgst) { - XkbComponentNamesRec kccgst; XkbRF_VarDefsRec mlvo; - XkbDescPtr xkb; - char name[PATH_MAX]; - - if (!dev || !rmlvo) { - LogMessage(X_ERROR, "XKB: No device or RMLVO specified\n"); - return NULL; - } mlvo.model = rmlvo->model; mlvo.layout = rmlvo->layout; mlvo.variant = rmlvo->variant; mlvo.options = rmlvo->options; - /* XDNFR already logs for us. */ - if (!XkbDDXNamesFromRules(dev, rmlvo->rules, &mlvo, &kccgst)) + return XkbDDXNamesFromRules(dev, rmlvo->rules, &mlvo, kccgst); +} + +/** + * Compile the given RMLVO keymap and return it. Returns the XkbDescPtr on + * success or NULL on failure. If the components compiled are not a superset + * or equal to need, the compiliation is treated as failure. + */ +static XkbDescPtr +XkbCompileKeymapForDevice(DeviceIntPtr dev, XkbRMLVOSet *rmlvo, int need) +{ + XkbDescPtr xkb; + unsigned int provided; + XkbComponentNamesRec kccgst; + char name[PATH_MAX]; + + if (!XkbRMLVOtoKcCGST(dev, rmlvo, &kccgst)) return NULL; - /* XDLKBN too, but it might return 0 as well as allocating. */ - if (!XkbDDXLoadKeymapByNames(dev, &kccgst, XkmAllIndicesMask, 0, &xkb, name, - PATH_MAX)) { - if (xkb) + provided = XkbDDXLoadKeymapByNames(dev, &kccgst, XkmAllIndicesMask, need, + &xkb, name, PATH_MAX); + if ((need & provided) != need) { + if (xkb) { XkbFreeKeyboard(xkb, 0, TRUE); + xkb = NULL; + } + } + + return xkb; +} + +XkbDescPtr +XkbCompileKeymap(DeviceIntPtr dev, XkbRMLVOSet *rmlvo) +{ + XkbDescPtr xkb; + + if (!dev || !rmlvo) { + LogMessage(X_ERROR, "XKB: No device or RMLVO specified\n"); return NULL; } + xkb = XkbCompileKeymapForDevice(dev, rmlvo, 0); + return xkb; } commit 787ba25a8a3af52b38448a1a6f8c9704ea8b7905 Author: Carlos Garnacho <carl...@gnome.org> Date: Mon Feb 7 18:21:31 2011 +0100 Xi: make XIQueryPointer return the current modifiers/group as documented. The previous XKB info was being returned instead of the current one, producing inconsistent results between the latest events and the modifiers/group returned by this call. Signed-off-by: Carlos Garnacho <carl...@gnome.org> Reviewed-by: Daniel Stone <dan...@fooishbar.org> Reviewed-by: Peter Hutterer <peter.hutte...@who-t.net>` Signed-off-by: Peter Hutterer <peter.hutte...@who-t.net> diff --git a/Xi/xiquerypointer.c b/Xi/xiquerypointer.c index b521c48..8df958e 100644 --- a/Xi/xiquerypointer.c +++ b/Xi/xiquerypointer.c @@ -129,7 +129,7 @@ ProcXIQueryPointer(ClientPtr client) if (kbd) { - state = &kbd->key->xkbInfo->prev_state; + state = &kbd->key->xkbInfo->state; rep.mods.base_mods = state->base_mods; rep.mods.latched_mods = state->latched_mods; rep.mods.locked_mods = state->locked_mods; commit 85f9017393c9bb19553e9afcf554673a44a09993 Author: Ander Conselvan de Oliveira <ander.conselvan-de-olive...@nokia.com> Date: Tue Feb 8 11:10:10 2011 +0200 ProcXkbGetXkbByName: fix use of uninitialised bytes valgrind error. ==9999== Syscall param writev(vector[...]) points to uninitialised byte(s) ==9999== at 0x4AB5154: writev (writev.c:51) ==9999== by 0x7C7C3: _XSERVTransWritev (Xtrans.c:912) ==9999== by 0x61C8B: FlushClient (io.c:924) ==9999== by 0x62423: WriteToClient (io.c:846) ==9999== by 0xCE39B: XkbSendMap (xkb.c:1408) ==9999== by 0xD247B: ProcXkbGetKbdByName (xkb.c:5814) ==9999== by 0x4AB53: Dispatch (dispatch.c:432) ==9999== by 0x205BF: main (main.c:291) ==9999== Address 0x557eb68 is 40 bytes inside a block of size 4,096 alloc'd ==9999== at 0x48334A4: calloc (vg_replace_malloc.c:467) ==9999== by 0x62567: WriteToClient (io.c:1065) ==9999== by 0x452EB: ProcEstablishConnection (dispatch.c:3685) ==9999== by 0x4AB53: Dispatch (dispatch.c:432) ==9999== by 0x205BF: main (main.c:291) ==9999== Uninitialised value was created by a stack allocation ==9999== at 0xD1910: ProcXkbGetKbdByName (xkb.c:5559) Signed-off-by: Peter Hutterer <peter.hutte...@who-t.net> Reviewed-by: Oliver McFadden <oliver.mcfad...@nokia.com> Signed-off-by: Ander Conselvan de Oliveira <ander.conselvan-de-olive...@nokia.com> diff --git a/xkb/xkb.c b/xkb/xkb.c index a2cbbf3..a57139f 100644 --- a/xkb/xkb.c +++ b/xkb/xkb.c @@ -5569,13 +5569,13 @@ ProcXkbGetKbdByName(ClientPtr client) { DeviceIntPtr dev; DeviceIntPtr tmpd; - xkbGetKbdByNameReply rep; - xkbGetMapReply mrep; - xkbGetCompatMapReply crep; - xkbGetIndicatorMapReply irep; - xkbGetNamesReply nrep; - xkbGetGeometryReply grep; - XkbComponentNamesRec names; + xkbGetKbdByNameReply rep = {0}; + xkbGetMapReply mrep = {0}; + xkbGetCompatMapReply crep = {0}; + xkbGetIndicatorMapReply irep = {0}; + xkbGetNamesReply nrep = {0}; + xkbGetGeometryReply grep = {0}; + XkbComponentNamesRec names = {0}; XkbDescPtr xkb, new; unsigned char * str; char mapFile[PATH_MAX]; commit 8a34d7a8532c7ca013e67307f3baf200167abb92 Author: Ander Conselvan de Oliveira <ander.conselvan-de-olive...@nokia.com> Date: Tue Feb 8 11:10:11 2011 +0200 XkbSendNames: fix use of uninitialised bytes valgrind error. ==537== Syscall param writev(vector[...]) points to uninitialised byte(s) ==537== at 0x4AB7154: writev (writev.c:51) ==537== by 0x8935B: _XSERVTransWritev (Xtrans.c:912) ==537== by 0x6C55F: FlushClient (io.c:924) ==537== by 0x6CCF3: WriteToClient (io.c:846) ==537== by 0xD51D3: XkbSendNames (xkb.c:3765) ==537== by 0xD8183: ProcXkbGetKbdByName (xkb.c:5825) ==537== by 0x27B7B: Dispatch (dispatch.c:432) ==537== by 0x205B7: main (main.c:291) ==537== Address 0x55899f2 is 154 bytes inside a block of size 1,896 alloc'd ==537== at 0x4834C48: malloc (vg_replace_malloc.c:236) ==537== by 0xD47AF: XkbSendNames (xkb.c:3642) ==537== by 0xD8183: ProcXkbGetKbdByName (xkb.c:5825) ==537== by 0x27B7B: Dispatch (dispatch.c:432) ==537== by 0x205B7: main (main.c:291) ==537== Uninitialised value was created by a heap allocation ==537== at 0x4834C48: malloc (vg_replace_malloc.c:236) ==537== by 0xD47AF: XkbSendNames (xkb.c:3642) ==537== by 0xD8183: ProcXkbGetKbdByName (xkb.c:5825) ==537== by 0x27B7B: Dispatch (dispatch.c:432) ==537== by 0x205B7: main (main.c:291) Signed-off-by: Peter Hutterer <peter.hutte...@who-t.net> Reviewed-by: Oliver McFadden <oliver.mcfad...@nokia.com> Signed-off-by: Ander Conselvan de Oliveira <ander.conselvan-de-olive...@nokia.com> diff --git a/xkb/xkb.c b/xkb/xkb.c index 6fd66c5..a2cbbf3 100644 --- a/xkb/xkb.c +++ b/xkb/xkb.c @@ -3644,7 +3644,7 @@ register int n; swapl(&rep->indicators,n); } - start = desc = malloc(length); + start = desc = calloc(1, length); if ( !start ) return BadAlloc; if (xkb->names) { commit 87fbef9157a6f1e1318382e368d27942d7ad72ab Author: Ander Conselvan de Oliveira <ander.conselvan-de-olive...@nokia.com> Date: Tue Feb 8 11:10:09 2011 +0200 ProcRRCreateMode: fix use of uninitialised bytes valgrind error. ==543== Syscall param writev(vector[...]) points to uninitialised byte(s) ==543== at 0x4AB7154: writev (writev.c:51) ==543== by 0x8935B: _XSERVTransWritev (Xtrans.c:912) ==543== by 0x6C55F: FlushClient (io.c:924) ==543== by 0x6D013: FlushAllOutput (io.c:668) ==543== by 0x27A83: Dispatch (dispatch.c:453) ==543== by 0x205B7: main (main.c:291) ==543== Address 0x556dc8c is 12 bytes inside a block of size 4,096 alloc'd ==543== at 0x48334A4: calloc (vg_replace_malloc.c:467) ==543== by 0x6CE37: WriteToClient (io.c:1065) ==543== by 0x223A7: ProcEstablishConnection (dispatch.c:3685) ==543== by 0x27B7B: Dispatch (dispatch.c:432) ==543== by 0x205B7: main (main.c:291) ==543== Uninitialised value was created by a stack allocation ==543== at 0xA3350: ProcRRCreateMode (rrmode.c:289) Signed-off-by: Peter Hutterer <peter.hutte...@who-t.net> Reviewed-by: Oliver McFadden <oliver.mcfad...@nokia.com> Signed-off-by: Ander Conselvan de Oliveira <ander.conselvan-de-olive...@nokia.com> -- To UNSUBSCRIBE, email to debian-x-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/e1pqoh4-00068e...@alioth.debian.org