Module Name:    xsrc
Committed By:   mrg
Date:           Fri Jul 15 09:10:38 UTC 2022

Modified Files:
        xsrc/external/mit/xorg-server/dist: configure configure.ac
        xsrc/external/mit/xorg-server/dist/dix: events.c
        xsrc/external/mit/xorg-server/dist/os: connection.c utils.c
        xsrc/external/mit/xorg-server/dist/xkb: xkb.c
Removed Files:
        xsrc/external/mit/xorg-server/dist/hw/xquartz/bundle: Xquartz.plist

Log Message:
merge xorg-server 21.1.4.


To generate a diff of this commit:
cvs rdiff -u -r1.12 -r1.13 xsrc/external/mit/xorg-server/dist/configure
cvs rdiff -u -r1.14 -r1.15 xsrc/external/mit/xorg-server/dist/configure.ac
cvs rdiff -u -r1.6 -r1.7 xsrc/external/mit/xorg-server/dist/dix/events.c
cvs rdiff -u -r1.1.1.1 -r0 \
    xsrc/external/mit/xorg-server/dist/hw/xquartz/bundle/Xquartz.plist
cvs rdiff -u -r1.6 -r1.7 xsrc/external/mit/xorg-server/dist/os/connection.c
cvs rdiff -u -r1.11 -r1.12 xsrc/external/mit/xorg-server/dist/os/utils.c
cvs rdiff -u -r1.7 -r1.8 xsrc/external/mit/xorg-server/dist/xkb/xkb.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: xsrc/external/mit/xorg-server/dist/configure
diff -u xsrc/external/mit/xorg-server/dist/configure:1.12 xsrc/external/mit/xorg-server/dist/configure:1.13
--- xsrc/external/mit/xorg-server/dist/configure:1.12	Fri Jul 15 02:18:56 2022
+++ xsrc/external/mit/xorg-server/dist/configure	Fri Jul 15 09:10:38 2022
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for xorg-server 21.1.3.
+# Generated by GNU Autoconf 2.69 for xorg-server 21.1.4.
 #
 # Report bugs to <https://gitlab.freedesktop.org/xorg/xserver/issues>.
 #
@@ -651,8 +651,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='xorg-server'
 PACKAGE_TARNAME='xorg-server'
-PACKAGE_VERSION='21.1.3'
-PACKAGE_STRING='xorg-server 21.1.3'
+PACKAGE_VERSION='21.1.4'
+PACKAGE_STRING='xorg-server 21.1.4'
 PACKAGE_BUGREPORT='https://gitlab.freedesktop.org/xorg/xserver/issues'
 PACKAGE_URL=''
 
@@ -1971,7 +1971,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures xorg-server 21.1.3 to adapt to many kinds of systems.
+\`configure' configures xorg-server 21.1.4 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -2042,7 +2042,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of xorg-server 21.1.3:";;
+     short | recursive ) echo "Configuration of xorg-server 21.1.4:";;
    esac
   cat <<\_ACEOF
 
@@ -2227,10 +2227,10 @@ Optional Packages:
                           org.x)
   --with-bundle-version=VERSION
                           Version to use for X11.app's CFBundleVersion
-                          (default: 21.1.3)
+                          (default: 21.1.4)
   --with-bundle-version-string=VERSION
                           Version to use for X11.app's
-                          CFBundleShortVersionString (default: 21.1.3)
+                          CFBundleShortVersionString (default: 21.1.4)
   --with-sparkle-feed-url=URL
                           URL for the Sparkle feed (default:
                           https://www.xquartz.org/releases/sparkle/release.xml)
@@ -2443,7 +2443,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-xorg-server configure 21.1.3
+xorg-server configure 21.1.4
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -3152,7 +3152,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by xorg-server $as_me 21.1.3, which was
+It was created by xorg-server $as_me 21.1.4, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
@@ -3500,7 +3500,7 @@ ac_link='$CC -o conftest$ac_exeext $CFLA
 ac_compiler_gnu=$ac_cv_c_compiler_gnu
 
 
-RELEASE_DATE="2022-01-02"
+RELEASE_DATE="2022-07-12"
 RELEASE_NAME="Caramel Ice Cream"
 
 
@@ -3709,12 +3709,7 @@ program_transform_name=`$as_echo "$progr
 am_aux_dir=`cd "$ac_aux_dir" && pwd`
 
 if test x"${MISSING+set}" != xset; then
-  case $am_aux_dir in
-  *\ * | *\	*)
-    MISSING="\${SHELL} \"$am_aux_dir/missing\"" ;;
-  *)
-    MISSING="\${SHELL} $am_aux_dir/missing" ;;
-  esac
+  MISSING="\${SHELL} '$am_aux_dir/missing'"
 fi
 # Use eval to expand $SHELL
 if eval "$MISSING --is-lightweight"; then
@@ -4019,7 +4014,7 @@ fi
 
 # Define the identity of the package.
  PACKAGE='xorg-server'
- VERSION='21.1.3'
+ VERSION='21.1.4'
 
 
 cat >>confdefs.h <<_ACEOF
@@ -16337,11 +16332,11 @@ $as_echo "$lt_cv_ld_force_load" >&6; }
       # to the OS version, if on x86, and 10.4, the deployment
       # target defaults to 10.4. Don't you love it?
       case ${MACOSX_DEPLOYMENT_TARGET-10.0},$host in
-	10.0,*86*-darwin8*|10.0,*-darwin[91]*)
+	10.0,*86*-darwin8*|10.0,*-darwin[912]*)
 	  _lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;;
 	10.[012][,.]*)
 	  _lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;;
-	10.*)
+	10.*|11.*)
 	  _lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;;
       esac
     ;;
@@ -23526,7 +23521,7 @@ _ACEOF
 if test "${with_bundle_version+set}" = set; then :
   withval=$with_bundle_version;  BUNDLE_VERSION="${withval}"
 else
-   BUNDLE_VERSION="21.1.3"
+   BUNDLE_VERSION="21.1.4"
 fi
 
 
@@ -32078,7 +32073,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_wri
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by xorg-server $as_me 21.1.3, which was
+This file was extended by xorg-server $as_me 21.1.4, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -32144,7 +32139,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-xorg-server config.status 21.1.3
+xorg-server config.status 21.1.4
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 
@@ -33339,7 +33334,9 @@ $as_echo X/"$am_mf" |
     { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
 as_fn_error $? "Something went wrong bootstrapping makefile fragments
-    for automatic dependency tracking.  Try re-running configure with the
+    for automatic dependency tracking.  If GNU make was not used, consider
+    re-running the configure script with MAKE=\"gmake\" (or whatever is
+    necessary).  You can also try re-running configure with the
     '--disable-dependency-tracking' option to at least be able to build
     the package (albeit without support for automatic dependency tracking).
 See \`config.log' for more details" "$LINENO" 5; }

Index: xsrc/external/mit/xorg-server/dist/configure.ac
diff -u xsrc/external/mit/xorg-server/dist/configure.ac:1.14 xsrc/external/mit/xorg-server/dist/configure.ac:1.15
--- xsrc/external/mit/xorg-server/dist/configure.ac:1.14	Fri Jul 15 02:18:56 2022
+++ xsrc/external/mit/xorg-server/dist/configure.ac	Fri Jul 15 09:10:38 2022
@@ -26,8 +26,8 @@ dnl
 dnl Process this file with autoconf to create configure.
 
 AC_PREREQ(2.60)
-AC_INIT([xorg-server], 21.1.3, [https://gitlab.freedesktop.org/xorg/xserver/issues], xorg-server)
-RELEASE_DATE="2022-01-02"
+AC_INIT([xorg-server], 21.1.4, [https://gitlab.freedesktop.org/xorg/xserver/issues], xorg-server)
+RELEASE_DATE="2022-07-12"
 RELEASE_NAME="Caramel Ice Cream"
 AC_CONFIG_SRCDIR([Makefile.am])
 AC_CONFIG_MACRO_DIR([m4])

Index: xsrc/external/mit/xorg-server/dist/dix/events.c
diff -u xsrc/external/mit/xorg-server/dist/dix/events.c:1.6 xsrc/external/mit/xorg-server/dist/dix/events.c:1.7
--- xsrc/external/mit/xorg-server/dist/dix/events.c:1.6	Fri Jul 15 02:18:57 2022
+++ xsrc/external/mit/xorg-server/dist/dix/events.c	Fri Jul 15 09:10:38 2022
@@ -467,6 +467,20 @@ WindowXI2MaskIsset(DeviceIntPtr dev, Win
     return xi2mask_isset(inputMasks->xi2mask, dev, evtype);
 }
 
+/**
+ * When processing events we operate on InternalEvent pointers. They may actually refer to a
+ * an instance of DeviceEvent, GestureEvent or any other event that comprises the InternalEvent
+ * union. This works well in practice because we always look into event type before doing anything,
+ * except in the case of copying the event. Any copying of InternalEvent should use this function
+ * instead of doing *dst_event = *src_event whenever it's not clear whether source event actually
+ * points to full InternalEvent instance.
+ */
+void
+CopyPartialInternalEvent(InternalEvent* dst_event, const InternalEvent* src_event)
+{
+    memcpy(dst_event, src_event, src_event->any.length);
+}
+
 Mask
 GetEventMask(DeviceIntPtr dev, xEvent *event, InputClients * other)
 {
@@ -1491,16 +1505,13 @@ UpdateTouchesForGrab(DeviceIntPtr mouse)
             CLIENT_BITS(listener->listener) == grab->resource) {
             if (grab->grabtype == CORE || grab->grabtype == XI ||
                 !xi2mask_isset(grab->xi2mask, mouse, XI_TouchBegin)) {
+                /*  Note that the grab will override any current listeners and if these listeners
+                    already received touch events then this is the place to send touch end event
+                    to complete the touch sequence.
 
-                if (listener->type == TOUCH_LISTENER_REGULAR &&
-                    listener->state != TOUCH_LISTENER_AWAITING_BEGIN &&
-                    listener->state != TOUCH_LISTENER_HAS_END) {
-                    /* if the listener already got any events relating to the touch, we must send
-                       a touch end because the grab overrides the previous listener and won't
-                       itself send any touch events.
-                    */
-                    TouchEmitTouchEnd(mouse, ti, 0, listener->listener);
-                }
+                    Unfortunately GTK3 menu widget implementation relies on not getting touch end
+                    event, so we can't fix the current behavior.
+                */
                 listener->type = TOUCH_LISTENER_POINTER_GRAB;
             } else {
                 listener->type = TOUCH_LISTENER_GRAB;
@@ -3873,7 +3884,7 @@ void ActivateGrabNoDelivery(DeviceIntPtr
 
     if (grabinfo->sync.state == FROZEN_NO_EVENT)
         grabinfo->sync.state = FROZEN_WITH_EVENT;
-    *grabinfo->sync.event = *real_event;
+    CopyPartialInternalEvent(grabinfo->sync.event, real_event);
 }
 
 static BOOL
@@ -4455,7 +4466,7 @@ FreezeThisEventIfNeededForSyncGrab(Devic
     case FREEZE_NEXT_EVENT:
         grabinfo->sync.state = FROZEN_WITH_EVENT;
         FreezeThaw(thisDev, TRUE);
-        *grabinfo->sync.event = *event;
+        CopyPartialInternalEvent(grabinfo->sync.event, event);
         break;
     }
 }

Index: xsrc/external/mit/xorg-server/dist/os/connection.c
diff -u xsrc/external/mit/xorg-server/dist/os/connection.c:1.6 xsrc/external/mit/xorg-server/dist/os/connection.c:1.7
--- xsrc/external/mit/xorg-server/dist/os/connection.c:1.6	Fri Jul 15 02:19:01 2022
+++ xsrc/external/mit/xorg-server/dist/os/connection.c	Fri Jul 15 09:10:38 2022
@@ -81,6 +81,8 @@ SOFTWARE.
 #include <stdio.h>
 #include <stdlib.h>
 
+#include <sys/stat.h>
+
 #ifndef WIN32
 #include <sys/socket.h>
 
@@ -991,15 +993,34 @@ MakeClientGrabPervious(ClientPtr client)
 void
 ListenOnOpenFD(int fd, int noxauth)
 {
-    char port[256];
+    char port[PATH_MAX];
     XtransConnInfo ciptr;
     const char *display_env = getenv("DISPLAY");
 
-    if (display_env && (strncmp(display_env, "/tmp/launch", 11) == 0)) {
-        /* Make the path the launchd socket if our DISPLAY is set right */
-        strcpy(port, display_env);
+    /* First check if display_env matches a <absolute path to unix socket>[.<screen number>] scheme (eg: launchd) */
+    if (display_env && display_env[0] == '/') {
+        struct stat sbuf;
+
+        strlcpy(port, display_env, sizeof(port));
+
+        /* If the path exists, we don't have do do anything else.
+         * If it doesn't, we need to check for a .<screen number> to strip off and recheck.
+         */
+        if (0 != stat(port, &sbuf)) {
+            char *dot = strrchr(port, '.');
+            if (dot) {
+                *dot = '\0';
+
+                if (0 != stat(port, &sbuf)) {
+                    display_env = NULL;
+                }
+            } else {
+                display_env = NULL;
+            }
+        }
     }
-    else {
+
+    if (!display_env) {
         /* Just some default so things don't break and die. */
         snprintf(port, sizeof(port), ":%d", atoi(display));
     }

Index: xsrc/external/mit/xorg-server/dist/os/utils.c
diff -u xsrc/external/mit/xorg-server/dist/os/utils.c:1.11 xsrc/external/mit/xorg-server/dist/os/utils.c:1.12
--- xsrc/external/mit/xorg-server/dist/os/utils.c:1.11	Fri Jul 15 02:19:01 2022
+++ xsrc/external/mit/xorg-server/dist/os/utils.c	Fri Jul 15 09:10:38 2022
@@ -682,7 +682,6 @@ ProcessCommandLine(int argc, char *argv[
                     ErrorF("Failed to disable listen for %s transport",
                            defaultNoListenList[i]);
     }
-    SeatId = getenv("XDG_SEAT");
 
     for (i = 1; i < argc; i++) {
         /* call ddx first, so it can peek/override if it wants */

Index: xsrc/external/mit/xorg-server/dist/xkb/xkb.c
diff -u xsrc/external/mit/xorg-server/dist/xkb/xkb.c:1.7 xsrc/external/mit/xorg-server/dist/xkb/xkb.c:1.8
--- xsrc/external/mit/xorg-server/dist/xkb/xkb.c:1.7	Fri Jul 15 02:19:02 2022
+++ xsrc/external/mit/xorg-server/dist/xkb/xkb.c	Fri Jul 15 09:10:38 2022
@@ -2511,16 +2511,15 @@ _XkbSetMapChecks(ClientPtr client, Devic
         }
     }
 
-    if (!(req->present & XkbKeyTypesMask)) {
-        nTypes = xkb->map->num_types;
-    }
-    else if (!CheckKeyTypes(client, xkb, req, (xkbKeyTypeWireDesc **) &values,
-			       &nTypes, mapWidths, doswap)) {
+    /* nTypes/mapWidths/symsPerKey must be filled for further tests below,
+     * regardless of client-side flags */
+
+    if (!CheckKeyTypes(client, xkb, req, (xkbKeyTypeWireDesc **) &values,
+		       &nTypes, mapWidths, doswap)) {
 	    client->errorValue = nTypes;
 	    return BadValue;
     }
 
-    /* symsPerKey/mapWidths must be filled regardless of client-side flags */
     map = &xkb->map->key_sym_map[xkb->min_key_code];
     for (i = xkb->min_key_code; i < xkb->max_key_code; i++, map++) {
         register int g, ng, w;
@@ -5157,7 +5156,7 @@ _GetCountedString(char **wire_inout, Cli
 }
 
 static Status
-_CheckSetDoodad(char **wire_inout,
+_CheckSetDoodad(char **wire_inout, xkbSetGeometryReq *req,
                 XkbGeometryPtr geom, XkbSectionPtr section, ClientPtr client)
 {
     char *wire;
@@ -5168,6 +5167,9 @@ _CheckSetDoodad(char **wire_inout,
     Status status;
 
     dWire = (xkbDoodadWireDesc *) (*wire_inout);
+    if (!_XkbCheckRequestBounds(client, req, dWire, dWire + 1))
+        return BadLength;
+
     any = dWire->any;
     wire = (char *) &dWire[1];
     if (client->swapped) {
@@ -5270,7 +5272,7 @@ _CheckSetDoodad(char **wire_inout,
 }
 
 static Status
-_CheckSetOverlay(char **wire_inout,
+_CheckSetOverlay(char **wire_inout, xkbSetGeometryReq *req,
                  XkbGeometryPtr geom, XkbSectionPtr section, ClientPtr client)
 {
     register int r;
@@ -5281,6 +5283,9 @@ _CheckSetOverlay(char **wire_inout,
 
     wire = *wire_inout;
     olWire = (xkbOverlayWireDesc *) wire;
+    if (!_XkbCheckRequestBounds(client, req, olWire, olWire + 1))
+        return BadLength;
+
     if (client->swapped) {
         swapl(&olWire->name);
     }
@@ -5292,6 +5297,9 @@ _CheckSetOverlay(char **wire_inout,
         xkbOverlayKeyWireDesc *kWire;
         XkbOverlayRowPtr row;
 
+        if (!_XkbCheckRequestBounds(client, req, rWire, rWire + 1))
+            return BadLength;
+
         if (rWire->rowUnder > section->num_rows) {
             client->errorValue = _XkbErrCode4(0x20, r, section->num_rows,
                                               rWire->rowUnder);
@@ -5300,6 +5308,9 @@ _CheckSetOverlay(char **wire_inout,
         row = XkbAddGeomOverlayRow(ol, rWire->rowUnder, rWire->nKeys);
         kWire = (xkbOverlayKeyWireDesc *) &rWire[1];
         for (k = 0; k < rWire->nKeys; k++, kWire++) {
+            if (!_XkbCheckRequestBounds(client, req, kWire, kWire + 1))
+                return BadLength;
+
             if (XkbAddGeomOverlayKey(ol, row,
                                      (char *) kWire->over,
                                      (char *) kWire->under) == NULL) {
@@ -5333,6 +5344,9 @@ _CheckSetSections(XkbGeometryPtr geom,
         register int r;
         xkbRowWireDesc *rWire;
 
+        if (!_XkbCheckRequestBounds(client, req, sWire, sWire + 1))
+            return BadLength;
+
         if (client->swapped) {
             swapl(&sWire->name);
             swaps(&sWire->top);
@@ -5358,6 +5372,9 @@ _CheckSetSections(XkbGeometryPtr geom,
             XkbRowPtr row;
             xkbKeyWireDesc *kWire;
 
+            if (!_XkbCheckRequestBounds(client, req, rWire, rWire + 1))
+                return BadLength;
+
             if (client->swapped) {
                 swaps(&rWire->top);
                 swaps(&rWire->left);
@@ -5369,16 +5386,19 @@ _CheckSetSections(XkbGeometryPtr geom,
             row->left = rWire->left;
             row->vertical = rWire->vertical;
             kWire = (xkbKeyWireDesc *) &rWire[1];
-            for (k = 0; k < rWire->nKeys; k++) {
+            for (k = 0; k < rWire->nKeys; k++, kWire++) {
                 XkbKeyPtr key;
 
+                if (!_XkbCheckRequestBounds(client, req, kWire, kWire + 1))
+                    return BadLength;
+
                 key = XkbAddGeomKey(row);
                 if (!key)
                     return BadAlloc;
-                memcpy(key->name.name, kWire[k].name, XkbKeyNameLength);
-                key->gap = kWire[k].gap;
-                key->shape_ndx = kWire[k].shapeNdx;
-                key->color_ndx = kWire[k].colorNdx;
+                memcpy(key->name.name, kWire->name, XkbKeyNameLength);
+                key->gap = kWire->gap;
+                key->shape_ndx = kWire->shapeNdx;
+                key->color_ndx = kWire->colorNdx;
                 if (key->shape_ndx >= geom->num_shapes) {
                     client->errorValue = _XkbErrCode3(0x10, key->shape_ndx,
                                                       geom->num_shapes);
@@ -5390,14 +5410,14 @@ _CheckSetSections(XkbGeometryPtr geom,
                     return BadMatch;
                 }
             }
-            rWire = (xkbRowWireDesc *) &kWire[rWire->nKeys];
+            rWire = (xkbRowWireDesc *)kWire;
         }
         wire = (char *) rWire;
         if (sWire->nDoodads > 0) {
             register int d;
 
             for (d = 0; d < sWire->nDoodads; d++) {
-                status = _CheckSetDoodad(&wire, geom, section, client);
+                status = _CheckSetDoodad(&wire, req, geom, section, client);
                 if (status != Success)
                     return status;
             }
@@ -5406,7 +5426,7 @@ _CheckSetSections(XkbGeometryPtr geom,
             register int o;
 
             for (o = 0; o < sWire->nOverlays; o++) {
-                status = _CheckSetOverlay(&wire, geom, section, client);
+                status = _CheckSetOverlay(&wire, req, geom, section, client);
                 if (status != Success)
                     return status;
             }
@@ -5440,6 +5460,9 @@ _CheckSetShapes(XkbGeometryPtr geom,
             xkbOutlineWireDesc *olWire;
             XkbOutlinePtr ol;
 
+            if (!_XkbCheckRequestBounds(client, req, shapeWire, shapeWire + 1))
+                return BadLength;
+
             shape =
                 XkbAddGeomShape(geom, shapeWire->name, shapeWire->nOutlines);
             if (!shape)
@@ -5450,21 +5473,27 @@ _CheckSetShapes(XkbGeometryPtr geom,
                 XkbPointPtr pt;
                 xkbPointWireDesc *ptWire;
 
+                if (!_XkbCheckRequestBounds(client, req, olWire, olWire + 1))
+                    return BadLength;
+
                 ol = XkbAddGeomOutline(shape, olWire->nPoints);
                 if (!ol)
                     return BadAlloc;
                 ol->corner_radius = olWire->cornerRadius;
                 ptWire = (xkbPointWireDesc *) &olWire[1];
-                for (p = 0, pt = ol->points; p < olWire->nPoints; p++, pt++) {
-                    pt->x = ptWire[p].x;
-                    pt->y = ptWire[p].y;
+                for (p = 0, pt = ol->points; p < olWire->nPoints; p++, pt++, ptWire++) {
+                    if (!_XkbCheckRequestBounds(client, req, ptWire, ptWire + 1))
+                        return BadLength;
+
+                    pt->x = ptWire->x;
+                    pt->y = ptWire->y;
                     if (client->swapped) {
                         swaps(&pt->x);
                         swaps(&pt->y);
                     }
                 }
                 ol->num_points = olWire->nPoints;
-                olWire = (xkbOutlineWireDesc *) (&ptWire[olWire->nPoints]);
+                olWire = (xkbOutlineWireDesc *)ptWire;
             }
             if (shapeWire->primaryNdx != XkbNoShape)
                 shape->primary = &shape->outlines[shapeWire->primaryNdx];
@@ -5561,12 +5590,15 @@ _CheckSetGeom(XkbGeometryPtr geom, xkbSe
         return status;
 
     for (i = 0; i < req->nDoodads; i++) {
-        status = _CheckSetDoodad(&wire, geom, NULL, client);
+        status = _CheckSetDoodad(&wire, req, geom, NULL, client);
         if (status != Success)
             return status;
     }
 
     for (i = 0; i < req->nKeyAliases; i++) {
+        if (!_XkbCheckRequestBounds(client, req, wire, wire + XkbKeyNameLength))
+                return BadLength;
+
         if (XkbAddGeomKeyAlias(geom, &wire[XkbKeyNameLength], wire) == NULL)
             return BadAlloc;
         wire += 2 * XkbKeyNameLength;
@@ -6551,7 +6583,8 @@ ProcXkbGetDeviceInfo(ClientPtr client)
 static char *
 CheckSetDeviceIndicators(char *wire,
                          DeviceIntPtr dev,
-                         int num, int *status_rtrn, ClientPtr client)
+                         int num, int *status_rtrn, ClientPtr client,
+                         xkbSetDeviceInfoReq * stuff)
 {
     xkbDeviceLedsWireDesc *ledWire;
     int i;
@@ -6559,6 +6592,11 @@ CheckSetDeviceIndicators(char *wire,
 
     ledWire = (xkbDeviceLedsWireDesc *) wire;
     for (i = 0; i < num; i++) {
+        if (!_XkbCheckRequestBounds(client, stuff, ledWire, ledWire + 1)) {
+            *status_rtrn = BadLength;
+            return (char *) ledWire;
+        }
+
         if (client->swapped) {
             swaps(&ledWire->ledClass);
             swaps(&ledWire->ledID);
@@ -6586,6 +6624,11 @@ CheckSetDeviceIndicators(char *wire,
             atomWire = (CARD32 *) &ledWire[1];
             if (nNames > 0) {
                 for (n = 0; n < nNames; n++) {
+                    if (!_XkbCheckRequestBounds(client, stuff, atomWire, atomWire + 1)) {
+                        *status_rtrn = BadLength;
+                        return (char *) atomWire;
+                    }
+
                     if (client->swapped) {
                         swapl(atomWire);
                     }
@@ -6597,6 +6640,10 @@ CheckSetDeviceIndicators(char *wire,
             mapWire = (xkbIndicatorMapWireDesc *) atomWire;
             if (nMaps > 0) {
                 for (n = 0; n < nMaps; n++) {
+                    if (!_XkbCheckRequestBounds(client, stuff, mapWire, mapWire + 1)) {
+                        *status_rtrn = BadLength;
+                        return (char *) mapWire;
+                    }
                     if (client->swapped) {
                         swaps(&mapWire->virtualMods);
                         swapl(&mapWire->ctrls);
@@ -6648,11 +6695,6 @@ SetDeviceIndicators(char *wire,
         xkbIndicatorMapWireDesc *mapWire;
         XkbSrvLedInfoPtr sli;
 
-        if (!_XkbCheckRequestBounds(client, stuff, ledWire, ledWire + 1)) {
-            *status_rtrn = BadLength;
-            return (char *) ledWire;
-        }
-
         namec = mapc = statec = 0;
         sli = XkbFindSrvLedInfo(dev, ledWire->ledClass, ledWire->ledID,
                                 XkbXI_IndicatorMapsMask);
@@ -6671,10 +6713,6 @@ SetDeviceIndicators(char *wire,
             memset((char *) sli->names, 0, XkbNumIndicators * sizeof(Atom));
             for (n = 0, bit = 1; n < XkbNumIndicators; n++, bit <<= 1) {
                 if (ledWire->namesPresent & bit) {
-                    if (!_XkbCheckRequestBounds(client, stuff, atomWire, atomWire + 1)) {
-                        *status_rtrn = BadLength;
-                        return (char *) atomWire;
-                    }
                     sli->names[n] = (Atom) *atomWire;
                     if (sli->names[n] == None)
                         ledWire->namesPresent &= ~bit;
@@ -6692,10 +6730,6 @@ SetDeviceIndicators(char *wire,
         if (ledWire->mapsPresent) {
             for (n = 0, bit = 1; n < XkbNumIndicators; n++, bit <<= 1) {
                 if (ledWire->mapsPresent & bit) {
-                    if (!_XkbCheckRequestBounds(client, stuff, mapWire, mapWire + 1)) {
-                        *status_rtrn = BadLength;
-                        return (char *) mapWire;
-                    }
                     sli->maps[n].flags = mapWire->flags;
                     sli->maps[n].which_groups = mapWire->whichGroups;
                     sli->maps[n].groups = mapWire->groups;
@@ -6731,13 +6765,17 @@ SetDeviceIndicators(char *wire,
 }
 
 static int
-_XkbSetDeviceInfo(ClientPtr client, DeviceIntPtr dev,
+_XkbSetDeviceInfoCheck(ClientPtr client, DeviceIntPtr dev,
                   xkbSetDeviceInfoReq * stuff)
 {
     char *wire;
 
     wire = (char *) &stuff[1];
     if (stuff->change & XkbXI_ButtonActionsMask) {
+        int sz = stuff->nBtns * SIZEOF(xkbActionWireDesc);
+        if (!_XkbCheckRequestBounds(client, stuff, wire, (char *) wire + sz))
+            return BadLength;
+
         if (!dev->button) {
             client->errorValue = _XkbErrCode2(XkbErr_BadClass, ButtonClass);
             return XkbKeyboardErrorCode;
@@ -6748,13 +6786,13 @@ _XkbSetDeviceInfo(ClientPtr client, Devi
                              dev->button->numButtons);
             return BadMatch;
         }
-        wire += (stuff->nBtns * SIZEOF(xkbActionWireDesc));
+        wire += sz;
     }
     if (stuff->change & XkbXI_IndicatorsMask) {
         int status = Success;
 
         wire = CheckSetDeviceIndicators(wire, dev, stuff->nDeviceLedFBs,
-                                        &status, client);
+                                        &status, client, stuff);
         if (status != Success)
             return status;
     }
@@ -6765,8 +6803,8 @@ _XkbSetDeviceInfo(ClientPtr client, Devi
 }
 
 static int
-_XkbSetDeviceInfoCheck(ClientPtr client, DeviceIntPtr dev,
-                       xkbSetDeviceInfoReq * stuff)
+_XkbSetDeviceInfo(ClientPtr client, DeviceIntPtr dev,
+                  xkbSetDeviceInfoReq * stuff)
 {
     char *wire;
     xkbExtensionDeviceNotify ed;
@@ -6790,8 +6828,6 @@ _XkbSetDeviceInfoCheck(ClientPtr client,
         if (stuff->firstBtn + stuff->nBtns > nBtns)
             return BadValue;
         sz = stuff->nBtns * SIZEOF(xkbActionWireDesc);
-        if (!_XkbCheckRequestBounds(client, stuff, wire, (char *) wire + sz))
-            return BadLength;
         memcpy((char *) &acts[stuff->firstBtn], (char *) wire, sz);
         wire += sz;
         ed.reason |= XkbXI_ButtonActionsMask;

Reply via email to