[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

xorg-server: Changes to 'upstream-unstable'



 Xext/shm.c                     |    6 +-----
 Xi/xipassivegrab.c             |   13 ++++++++++---
 config/udev.c                  |    2 +-
 configure.ac                   |    4 ++--
 dix/dispatch.c                 |    1 -
 dix/dixfonts.c                 |   30 +++++++++++++++---------------
 dix/events.c                   |   39 +++++++++++++++++++++++++++++----------
 dix/grabs.c                    |    2 +-
 fb/fbpict.c                    |    4 +++-
 hw/xfree86/modes/xf86Crtc.c    |    1 +
 hw/xquartz/X11Application.m    |    2 +-
 hw/xquartz/pbproxy/Makefile.am |    1 +
 test/input.c                   |    2 +-
 xkb/xkb.c                      |    3 +++
 14 files changed, 69 insertions(+), 41 deletions(-)

New commits:
commit 374be44d13bc8f04a2413b6d5b2006e73d5a8f53
Author: Jeremy Huddleston <jeremyhu@apple.com>
Date:   Fri Oct 14 16:29:54 2011 -0700

    configure.ac: Bump to 1.11.1.901 (1.11.2 RC1)
    
    Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>

diff --git a/configure.ac b/configure.ac
index 51d01e4..cc4292b 100644
--- a/configure.ac
+++ b/configure.ac
@@ -26,8 +26,8 @@ dnl
 dnl Process this file with autoconf to create configure.
 
 AC_PREREQ(2.57)
-AC_INIT([xorg-server], 1.11.1, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
-RELEASE_DATE="2011-09-24"
+AC_INIT([xorg-server], 1.11.1.901, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
+RELEASE_DATE="2011-10-14"
 AC_CONFIG_SRCDIR([Makefile.am])
 AM_INIT_AUTOMAKE([foreign dist-bzip2])
 AM_MAINTAINER_MODE

commit bbe6a69da398dba93679c23c3c50f9916cb562ca
Author: Peter Hutterer <peter.hutterer@who-t.net>
Date:   Fri Jul 29 16:33:54 2011 +1000

    dix: don't XWarpPointer through the last slave anymore (#38313)
    
    This line was introduced pre-1.6 to fix Bug 19297. The effect of warping
    through the VCP then was that if a device had custom valuator ranges, the
    warp position would be wrong. The better device for this effect is the the
    XTest device.
    
    This fixes a server crash where the lastSlave is a pointer device without
    valuators (Bug 38313#0).
    
    And while we're at it, make sure the Xinerama code-path does the same.
    
    X.Org Bug 38313 <http://bugs.freedesktop.org/show_bug.cgi?id=38313>
    
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    Reviewed-by: Daniel Stone <daniel@fooishbar.org>
    (cherry picked from commit 2bfb802839688ecf328119c4c6979390fc60348d)

diff --git a/dix/events.c b/dix/events.c
index 8e7f9c3..8068fc7 100644
--- a/dix/events.c
+++ b/dix/events.c
@@ -3351,16 +3351,21 @@ XineramaWarpPointer(ClientPtr client)
 {
     WindowPtr	dest = NULL;
     int		x, y, rc;
-    SpritePtr   pSprite = PickPointer(client)->spriteInfo->sprite;
+    DeviceIntPtr dev;
+    SpritePtr   pSprite;
 
     REQUEST(xWarpPointerReq);
 
-
     if (stuff->dstWid != None) {
 	rc = dixLookupWindow(&dest, stuff->dstWid, client, DixReadAccess);
 	if (rc != Success)
 	    return rc;
     }
+
+    /* Post through the XTest device */
+    dev = PickPointer(client);
+    dev = GetXTestDevice(dev);
+    pSprite = dev->spriteInfo->sprite;
     x = pSprite->hotPhys.x;
     y = pSprite->hotPhys.y;
 
@@ -3410,9 +3415,9 @@ XineramaWarpPointer(ClientPtr client)
     else if (y >= pSprite->physLimits.y2)
 	y = pSprite->physLimits.y2 - 1;
     if (pSprite->hotShape)
-	ConfineToShape(PickPointer(client), pSprite->hotShape, &x, &y);
+	ConfineToShape(dev, pSprite->hotShape, &x, &y);
 
-    XineramaSetCursorPosition(PickPointer(client), x, y, TRUE);
+    XineramaSetCursorPosition(dev, x, y, TRUE);
 
     return Success;
 }
@@ -3430,7 +3435,7 @@ ProcWarpPointer(ClientPtr client)
     WindowPtr	dest = NULL;
     int		x, y, rc;
     ScreenPtr	newScreen;
-    DeviceIntPtr dev, tmp;
+    DeviceIntPtr dev, tmp, xtest_dev = NULL;
     SpritePtr   pSprite;
 
     REQUEST(xWarpPointerReq);
@@ -3443,11 +3448,13 @@ ProcWarpPointer(ClientPtr client)
 	    rc = XaceHook(XACE_DEVICE_ACCESS, client, dev, DixWriteAccess);
 	    if (rc != Success)
 		return rc;
+            if (IsXTestDevice(tmp, dev))
+                xtest_dev = tmp;
 	}
     }
 
-    if (dev->lastSlave)
-        dev = dev->lastSlave;
+    /* Use the XTest device to actually move the pointer */
+    dev = xtest_dev;
     pSprite = dev->spriteInfo->sprite;
 
 #ifdef PANORAMIX

commit 2e28ff155ffc30707d42d885d5f6fc891bc82252
Author: Nobuhiro Iwamatsu <iwamatsu@nigauri.org>
Date:   Tue Aug 9 11:00:34 2011 +0900

    Disable check of double-aligned in test/input.c on Renesas SH
    
    Renesas SH is not aligned at size of double.
    When structure has double value, It is aligned in 4byte (long).
    
    Signed-off-by: Nobuhiro Iwamatsu <iwamatsu@nigauri.org>
    Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    (cherry picked from commit b29ce0726d55ec41cfbce0814e21b0217ef64efe)

diff --git a/test/input.c b/test/input.c
index 837ce49..6a0c523 100644
--- a/test/input.c
+++ b/test/input.c
@@ -1223,7 +1223,7 @@ static void dix_valuator_alloc(void)
 
         assert(v);
         assert(v->numAxes == num_axes);
-#ifndef __i386__
+#if !defined(__i386__) && !defined(__sh__)
         /* must be double-aligned on 64 bit */
         assert(((void*)v->axisVal - (void*)v) % sizeof(double) == 0);
         assert(((void*)v->axes - (void*)v) % sizeof(double) == 0);

commit 79ac611d3121801c34f111c91b5ace5769719695
Author: Peter Hutterer <peter.hutterer@who-t.net>
Date:   Mon Aug 1 14:12:41 2011 +1000

    dix: don't use the pointer as modifier device in UngrabKey.
    
    Modifier device is always the keyboard.
    
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    Reviewed-by: Daniel Stone <daniel@fooishbar.org>
    (cherry picked from commit 8c5a4d6fbecf79f2dc4f2d836d741203b2d5e856)

diff --git a/dix/events.c b/dix/events.c
index 89f6810..8e7f9c3 100644
--- a/dix/events.c
+++ b/dix/events.c
@@ -5372,7 +5372,7 @@ ProcUngrabKey(ClientPtr client)
     tempGrab.window = pWin;
     tempGrab.modifiersDetail.exact = stuff->modifiers;
     tempGrab.modifiersDetail.pMask = NULL;
-    tempGrab.modifierDevice = GetPairedDevice(keybd);
+    tempGrab.modifierDevice = keybd;
     tempGrab.type = KeyPress;
     tempGrab.grabtype = GRABTYPE_CORE;
     tempGrab.detail.exact = stuff->key;

commit 843737b4f979fed3a6d74cdfc7047ce5ca886639
Author: Peter Hutterer <peter.hutterer@who-t.net>
Date:   Thu Jul 28 15:56:08 2011 +1000

    dix: ignore devices when adding passive core grabs to list (#39545)
    
    Passive core grabs are mostly device-independent. In an MPX scenario, they
    may change to reflect whichever master pair activated the grab last. For
    adding new grabs to the list, ignore the device for core grabs to return
    failures when trying to set the same grab combo twice on a window.
    
    X.Org Bug 39545 <http://bugs.freedesktop.org/show_bug.cgi?id=39545>
    
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    Reviewed-by: Daniel Stone <daniel@fooishbar.org>
    (cherry picked from commit 09496996accfdaf7bc01097a25db400912004d97)

diff --git a/dix/grabs.c b/dix/grabs.c
index 85ca9ee..c28356d 100644
--- a/dix/grabs.c
+++ b/dix/grabs.c
@@ -479,7 +479,7 @@ AddPassiveGrabToList(ClientPtr client, GrabPtr pGrab)
 
     for (grab = wPassiveGrabs(pGrab->window); grab; grab = grab->next)
     {
-	if (GrabMatchesSecond(pGrab, grab, FALSE))
+	if (GrabMatchesSecond(pGrab, grab, (pGrab->grabtype == GRABTYPE_CORE)))
 	{
 	    if (CLIENT_BITS(pGrab->resource) != CLIENT_BITS(grab->resource))
 	    {

commit cb9c1d6d6cb25f55b1e4ac382e5af72a044e06aa
Author: Peter Hutterer <peter.hutterer@who-t.net>
Date:   Thu Jul 28 15:43:10 2011 +1000

    dix: avoid using the VCP as modifier device
    
    Core grabs may change device when they're activated to reflect the master
    they apply to. If the device is a keyboard, modifierDevice is erroneously
    set to the Virtual Core Pointer.
    
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    Reviewed-by: Daniel Stone <daniel@fooishbar.org>
    (cherry picked from commit 80c37048539daa1d257d127d66502bde45c97c85)

diff --git a/dix/events.c b/dix/events.c
index 9e58edb..89f6810 100644
--- a/dix/events.c
+++ b/dix/events.c
@@ -3678,7 +3678,7 @@ CheckPassiveGrabsOnWindow(
             if (tempGrab.type < GenericEvent)
             {
                 grab->device = device;
-                grab->modifierDevice = GetPairedDevice(device);
+                grab->modifierDevice = GetMaster(device, MASTER_KEYBOARD);
             }
 
             for (other = inputInfo.devices; other; other = other->next)

commit ef5c31430c891cf44148ea31058ed4cfb9bec21a
Author: Peter Hutterer <peter.hutterer@who-t.net>
Date:   Wed Jul 20 16:21:28 2011 +1000

    config: fix a log message
    
    PRODUCT was taken from the parent, hence ppath.
    
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    Reviewed-by: Daniel Stone <daniel@fooishbar.org>
    (cherry picked from commit e684e816acb617b4dc66a68e2b0ba8f80399170a)

diff --git a/config/udev.c b/config/udev.c
index e7383dc..42713e9 100644
--- a/config/udev.c
+++ b/config/udev.c
@@ -114,7 +114,7 @@ device_added(struct udev_device *udev_device)
                 == -1)
                 attrs.usb_id = NULL;
             else
-                LOG_PROPERTY(path, "PRODUCT", product);
+                LOG_PROPERTY(ppath, "PRODUCT", product);
         }
     }
     if (!name)

commit ec8ee3a9f76cc94d6fa4e7245c1a8fb68a42783c
Author: Peter Harris <pharris@opentext.com>
Date:   Fri Sep 2 18:45:16 2011 -0400

    xkb: add missing swaps for xkbGetDeviceInfoReply
    
    Caught during review of e095369bf.
    
    Signed-off-by: Peter Harris <pharris@opentext.com>
    Reviewed-by-by: Matt Turner <mattst88@gmail.com>
    Signed-off-by: Matt Turner <mattst88@gmail.com>
    (cherry picked from commit c90903b4f7a826ae6826a8dd0a901c8362500e46)
    
    Conflicts:
    
    	xkb/xkb.c
    
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>

diff --git a/xkb/xkb.c b/xkb/xkb.c
index 9c66955..6e0f542 100644
--- a/xkb/xkb.c
+++ b/xkb/xkb.c
@@ -6240,6 +6240,9 @@ char *			str;
 	swaps(&rep.unsupported,n);
 	swaps(&rep.nDeviceLedFBs,n);
 	swapl(&rep.type,n);
+	swaps(&rep.dfltKbdFB, n);
+	swaps(&rep.dfltLedFB, n);
+	swapl(&rep.devType, n);
     }
     WriteToClient(client,SIZEOF(xkbGetDeviceInfoReply), (char *)&rep);
 

commit 603ad6608a0dbe2fb1bdc4bcd8b4117f2b0bc8b2
Author: Jeremy Huddleston <jeremyhu@apple.com>
Date:   Tue Oct 4 21:40:03 2011 -0700

    XQuartz: pbproxy: Add missing AM_OBJCFLAGS
    
    Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>
    (cherry picked from commit fae7ed62ad476114bd37b566202cf6b6546c0a1f)

diff --git a/hw/xquartz/pbproxy/Makefile.am b/hw/xquartz/pbproxy/Makefile.am
index b8b95d2..1b14dff 100644
--- a/hw/xquartz/pbproxy/Makefile.am
+++ b/hw/xquartz/pbproxy/Makefile.am
@@ -2,6 +2,7 @@ AM_CPPFLAGS=-F/System/Library/Frameworks/ApplicationServices.framework/Framework
 	-DBUNDLE_ID_PREFIX=\"$(BUNDLE_ID_PREFIX)\"
 
 AM_CFLAGS=$(XPBPROXY_CFLAGS) 
+AM_OBJCFLAGS=$(XPBPROXY_CFLAGS)
 
 noinst_LTLIBRARIES = libxpbproxy.la
 libxpbproxy_la_SOURCES = \

commit 65469f5ea98074ab27ce0a2d482157b9d5c2cbc7
Author: vdb@picaros.org <vdb@picaros.org>
Date:   Sat Sep 17 18:55:47 2011 +0200

    Fix a rare memory leak
    
    Signed-off-by: Servaas Vandenberghe <vdb@picaros.org>
    Reviewed-by: Jeremy Huddleston <jeremyhu@apple.com>
    (cherry picked from commit e4cddf509e1729e8ff40354275b65455111ad2bd)

diff --git a/hw/xfree86/modes/xf86Crtc.c b/hw/xfree86/modes/xf86Crtc.c
index c2814d4..3fae039 100644
--- a/hw/xfree86/modes/xf86Crtc.c
+++ b/hw/xfree86/modes/xf86Crtc.c
@@ -133,6 +133,7 @@ xf86CrtcCreate (ScrnInfoPtr		scrn,
 	crtcs = malloc((xf86_config->num_crtc + 1) * sizeof (xf86CrtcPtr));
     if (!crtcs)
     {
+	free(crtc->gamma_red);
 	free(crtc);
 	return NULL;
     }

commit bec15eb73a17fb47963ff6b747ea504f7dc05deb
Author: Kirill Elagin <kirelagin@gmail.com>
Date:   Tue Oct 4 23:02:20 2011 +0400

    Fix server crash due to invalid images
    
    See https://bugs.freedesktop.org/show_bug.cgi?id=39383
    
    Signed-off-by: Kirill Elagin <kirelagin@gmail.com>
    Reviewed-by: Jeremy Huddleston <jeremyhu@apple.com>
    (cherry picked from commit 53611213396479abfdce0f7752681572e0d26d78)

diff --git a/fb/fbpict.c b/fb/fbpict.c
index d1fd0cb..57c93fd 100644
--- a/fb/fbpict.c
+++ b/fb/fbpict.c
@@ -163,7 +163,9 @@ create_bits_picture (PicturePtr pict,
 	(pixman_format_code_t)pict->format,
 	pixmap->drawable.width, pixmap->drawable.height,
 	(uint32_t *)bits, stride * sizeof (FbStride));
-    
+
+    if (!image)
+	return NULL;
     
 #ifdef FB_ACCESS_WRAPPER
 #if FB_SHIFT==5

commit b45e22675364915c32560c26404cf30d77ab68aa
Author: Alan Hourihane <alanh@vmware.com>
Date:   Tue Oct 4 19:42:46 2011 -0700

    dixfonts: Don't overwrite local c variable until new_closure is safely initialized.
    
    Signed-off-by: Alan Hourihane <alanh@vmware.com>
    Reviewed-by: Jeremy Huddleston <jeremyhu@apple.com>
    (cherry picked from commit 7a33c5b934382b5554f41ab1502514e91c9bc52e)

diff --git a/dix/dixfonts.c b/dix/dixfonts.c
index fbac124..d2bcb84 100644
--- a/dix/dixfonts.c
+++ b/dix/dixfonts.c
@@ -1302,31 +1302,30 @@ doPolyText(ClientPtr client, PTclosurePtr c)
 			goto bail;
 		    }
 		    *new_closure = *c;
-		    c = new_closure;
 
-		    len = c->endReq - c->pElt;
-		    c->data = malloc(len);
-		    if (!c->data)
+		    len = new_closure->endReq - new_closure->pElt;
+		    new_closure->data = malloc(len);
+		    if (!new_closure->data)
 		    {
-			free(c);
+			free(new_closure);
 			err = BadAlloc;
 			goto bail;
 		    }
-		    memmove(c->data, c->pElt, len);
-		    c->pElt = c->data;
-		    c->endReq = c->pElt + len;
+		    memmove(new_closure->data, new_closure->pElt, len);
+		    new_closure->pElt = new_closure->data;
+		    new_closure->endReq = new_closure->pElt + len;
 
 		    /* Step 2 */
 
-		    pGC = GetScratchGC(c->pGC->depth, c->pGC->pScreen);
+		    pGC = GetScratchGC(new_closure->pGC->depth, new_closure->pGC->pScreen);
 		    if (!pGC)
 		    {
-			free(c->data);
-			free(c);
+			free(new_closure->data);
+			free(new_closure);
 			err = BadAlloc;
 			goto bail;
 		    }
-		    if ((err = CopyGC(c->pGC, pGC, GCFunction |
+		    if ((err = CopyGC(new_closure->pGC, pGC, GCFunction |
 				      GCPlaneMask | GCForeground |
 				      GCBackground | GCFillStyle |
 				      GCTile | GCStipple |
@@ -1337,15 +1336,16 @@ doPolyText(ClientPtr client, PTclosurePtr c)
 				      Success)
 		    {
 			FreeScratchGC(pGC);
-			free(c->data);
-			free(c);
+			free(new_closure->data);
+			free(new_closure);
 			err = BadAlloc;
 			goto bail;
 		    }
+		    c = new_closure;
 		    origGC = c->pGC;
 		    c->pGC = pGC;
 		    ValidateGC(c->pDraw, c->pGC);
-		    
+
 		    ClientSleep(client, (ClientSleepProcPtr)doPolyText, c);
 
 		    /* Set up to perform steps 3 and 4 */

commit e9ae33316012ffe9acfeeb7303ab3392c2ca2a2b
Author: Sam Spilsbury <sam.spilsbury@canonical.com>
Date:   Wed Sep 14 09:58:34 2011 +0800

    Remove the SendEvent bit (0x80) before doing range checks on event type.
    
    Some extension libraries may set this bit before converting the event to
    wire protocol and as such range checking the event will cause an invalid
    BadValue error to result. As the documentation suggests the the bit
    should be "forced on", remove it before doing range checks and continue
    to force it on in the server.
    
    Reviewed-by: Jamey Sharp <jamey@minilop.net>
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    (cherry picked from commit 2d2dce558d24eeea0eb011ec9ebaa6c5c2273c39)

diff --git a/dix/events.c b/dix/events.c
index 8a4c6b9..9e58edb 100644
--- a/dix/events.c
+++ b/dix/events.c
@@ -5224,6 +5224,8 @@ CloseDownEvents(void)
     InputEventList = NULL;
 }
 
+#define SEND_EVENT_BIT 0x80
+
 /**
  * Server-side protocol handling for SendEvent request.
  *
@@ -5241,6 +5243,16 @@ ProcSendEvent(ClientPtr client)
 
     REQUEST_SIZE_MATCH(xSendEventReq);
 
+    /* libXext and other extension libraries may set the bit indicating
+     * that this event came from a SendEvent request so remove it
+     * since otherwise the event type may fail the range checks
+     * and cause an invalid BadValue error to be returned.
+     *
+     * This is safe to do since we later add the SendEvent bit (0x80)
+     * back in once we send the event to the client */
+
+    stuff->event.u.u.type &= ~(SEND_EVENT_BIT);
+
     /* The client's event type must be a core event type or one defined by an
 	extension. */
 
@@ -5298,7 +5310,7 @@ ProcSendEvent(ClientPtr client)
 	client->errorValue = stuff->propagate;
 	return BadValue;
     }
-    stuff->event.u.u.type |= 0x80;
+    stuff->event.u.u.type |= SEND_EVENT_BIT;
     if (stuff->propagate)
     {
 	for (;pWin; pWin = pWin->parent)

commit 347f5610ca023fb31485aa19c20607af8bf9c834
Author: Carlos Garnacho <carlosg@gnome.org>
Date:   Wed Aug 31 00:46:52 2011 +0200

    Xi: Fix passive XI2 ungrabs on XIAll[Master]Devices
    
    The corresponding DeviceIntPtr wasn't being gotten properly,
    resulting in BadDevice from dixLookupDevice().
    
    Signed-off-by: Carlos Garnacho <carlosg@gnome.org>
    Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    (cherry picked from commit f52d5cd374563544dafe29587411f345e31bbdf8)

diff --git a/Xi/xipassivegrab.c b/Xi/xipassivegrab.c
index ae43433..5cdd8ac 100644
--- a/Xi/xipassivegrab.c
+++ b/Xi/xipassivegrab.c
@@ -261,9 +261,16 @@ ProcXIPassiveUngrabDevice(ClientPtr client)
     REQUEST(xXIPassiveUngrabDeviceReq);
     REQUEST_AT_LEAST_SIZE(xXIPassiveUngrabDeviceReq);
 
-    rc = dixLookupDevice(&dev, stuff->deviceid, client, DixGrabAccess);
-    if (rc != Success)
-	return rc;
+    if (stuff->deviceid == XIAllDevices)
+        dev = inputInfo.all_devices;
+    else if (stuff->deviceid == XIAllMasterDevices)
+        dev = inputInfo.all_master_devices;
+    else
+    {
+        rc = dixLookupDevice(&dev, stuff->deviceid, client, DixGrabAccess);
+        if (rc != Success)
+	    return rc;
+    }
 
     if (stuff->grab_type != XIGrabtypeButton &&
         stuff->grab_type != XIGrabtypeKeycode &&

commit 7b74bb67528033bf2d2a1714a801c38e7822642e
Author: Jeremy Huddleston <jeremyhu@apple.com>
Date:   Tue Sep 20 20:39:06 2011 -0700

    XQuartz: Use set_front_process rather than X11ApplicationSetFrontProcess since we're already in the AppKit thread
    
    Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>
    (cherry picked from commit 38e9e28ba2fbffee52ad9889ef6d4e94c7af3e10)

diff --git a/hw/xquartz/X11Application.m b/hw/xquartz/X11Application.m
index 7fd7dab..12ff53c 100644
--- a/hw/xquartz/X11Application.m
+++ b/hw/xquartz/X11Application.m
@@ -356,7 +356,7 @@ static void message_kit_thread (SEL selector, NSObject *arg) {
                          */
                         _appFlags._active = YES;
 
-                        X11ApplicationSetFrontProcess();
+                        [self set_front_process:nil];
 
                         /* Get the Spaces preference for SwitchOnActivate */
                         (void)CFPreferencesAppSynchronize(CFSTR("com.apple.dock"));

commit bd6ea85209e5ab80375d4ec9994d10a89fd1374a
Author: Jamey Sharp <jamey@minilop.net>
Date:   Tue Sep 14 18:35:21 2010 -0700

    Fix pixmap double-frees on error paths.
    
    If AddResource fails, it will automatically free the object that was
    passed to it by calling the appropriate deleteFunc; and of course
    FreeResource also calls the deleteFunc. In both cases it's wrong to call
    the destroy hook manually.
    
    Commit by Jamey Sharp and Josh Triplett.
    
    Signed-off-by: Jamey Sharp <jamey@minilop.net>
    Signed-off-by: Josh Triplett <josh@joshtriplett.org>
    Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
    Reviewed-by: Aaron Plattner <aplattner@nvidia.com>
    (cherry picked from commit 0f380a5005f800572773cd4667ce43c7459cc467)

diff --git a/Xext/shm.c b/Xext/shm.c
index b08af82..4141a8f 100644
--- a/Xext/shm.c
+++ b/Xext/shm.c
@@ -991,7 +991,6 @@ CreatePmap:
 	    pMap->drawable.serialNumber = NEXT_SERIAL_NUMBER;
 	    pMap->drawable.id = newPix->info[j].id;
 	    if (!AddResource(newPix->info[j].id, RT_PIXMAP, (pointer)pMap)) {
-		(*pScreen->DestroyPixmap)(pMap);
 		result = BadAlloc;
 		break;
 	    }
@@ -1002,10 +1001,8 @@ CreatePmap:
     }
 
     if(result == BadAlloc) {
-	while(j--) {
-	    (*pScreen->DestroyPixmap)(pMap);
+	while(j--)
 	    FreeResource(newPix->info[j].id, RT_NONE);
-	}
 	free(newPix);
     } else 
 	AddResource(stuff->pid, XRT_PIXMAP, newPix);
@@ -1110,7 +1107,6 @@ CreatePmap:
 	{
 	    return Success;
 	}
-	pDraw->pScreen->DestroyPixmap(pMap);
     }
     return BadAlloc;
 }
diff --git a/dix/dispatch.c b/dix/dispatch.c
index 192c8c3..f8200b1 100644
--- a/dix/dispatch.c
+++ b/dix/dispatch.c
@@ -1419,7 +1419,6 @@ CreatePmap:
 	}
 	if (AddResource(stuff->pid, RT_PIXMAP, (pointer)pMap))
 	    return Success;
-	(*pDraw->pScreen->DestroyPixmap)(pMap);
     }
     return BadAlloc;
 }


Reply to: