[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

xorg-server: Changes to 'debian-unstable'



 Xext/panoramiXprocs.c                            |   70 +++++++++--
 Xext/shm.c                                       |    1 
 Xi/xibarriers.c                                  |    9 -
 Xi/xiwarppointer.c                               |    4 
 configure.ac                                     |    9 -
 debian/changelog                                 |    5 
 debian/upstream/signing-key.asc                  |   77 ++++++------
 dix/dispatch.c                                   |    4 
 glamor/glamor.c                                  |    3 
 glamor/glamor_copy.c                             |   21 +--
 glamor/glamor_dash.c                             |    2 
 glamor/glamor_fbo.c                              |    4 
 glamor/glamor_glyphblt.c                         |   26 ++--
 glamor/glamor_largepixmap.c                      |   11 -
 glamor/glamor_lines.c                            |   13 +-
 glamor/glamor_points.c                           |   14 +-
 glamor/glamor_rects.c                            |   13 +-
 glamor/glamor_render.c                           |    5 
 glamor/glamor_segs.c                             |   14 +-
 glamor/glamor_spans.c                            |   13 +-
 glamor/glamor_transform.c                        |   11 +
 glamor/glamor_transform.h                        |    2 
 glamor/glamor_utils.h                            |    4 
 glamor/glamor_xv.c                               |    9 -
 hw/dmx/dmxinit.c                                 |   63 ----------
 hw/dmx/dmxsync.c                                 |    2 
 hw/dmx/input/usb-keyboard.c                      |    3 
 hw/kdrive/ephyr/ephyr.c                          |    6 
 hw/kdrive/ephyr/ephyrvideo.c                     |    5 
 hw/kdrive/ephyr/hostx.c                          |    6 
 hw/xfree86/Makefile.am                           |   10 -
 hw/xfree86/common/xf86Init.c                     |    1 
 hw/xfree86/common/xf86Xinput.c                   |    3 
 hw/xfree86/common/xf86pciBus.c                   |    2 
 hw/xfree86/dixmods/Makefile.am                   |    4 
 hw/xfree86/dixmods/xkbKillSrv.c                  |   54 --------
 hw/xfree86/dixmods/xkbPrivate.c                  |   53 --------
 hw/xfree86/dixmods/xkbVT.c                       |   64 ----------
 hw/xfree86/dri2/pci_ids/i965_pci_ids.h           |   63 +++++++---
 hw/xfree86/drivers/modesetting/dri2.c            |   74 +++---------
 hw/xfree86/drivers/modesetting/driver.c          |    5 
 hw/xfree86/drivers/modesetting/driver.h          |   17 ++
 hw/xfree86/drivers/modesetting/drmmode_display.c |   66 +++++++++-
 hw/xfree86/drivers/modesetting/present.c         |   25 ----
 hw/xfree86/drivers/modesetting/vblank.c          |   69 +++++++++--
 hw/xfree86/modes/xf86RandR12.c                   |  139 +++++++++++++++--------
 hw/xfree86/os-support/linux/lnx_init.c           |    3 
 hw/xfree86/os-support/shared/posix_tty.c         |    3 
 hw/xfree86/parser/scan.c                         |    2 
 hw/xfree86/xkb/Makefile.am                       |    6 
 hw/xfree86/xkb/meson.build                       |   12 +
 hw/xfree86/xkb/xkbKillSrv.c                      |   54 ++++++++
 hw/xfree86/xkb/xkbPrivate.c                      |   53 ++++++++
 hw/xfree86/xkb/xkbVT.c                           |   64 ++++++++++
 hw/xfree86/xorg-wrapper.c                        |    3 
 hw/xquartz/quartz.c                              |    1 
 hw/xwayland/drm.xml                              |   35 +++--
 hw/xwayland/xwayland-input.c                     |   32 +++++
 hw/xwayland/xwayland-output.c                    |    3 
 hw/xwayland/xwayland.c                           |   38 +++++-
 include/xorg-config.h.in                         |    3 
 os/io.c                                          |   38 ++++--
 os/osinit.c                                      |    1 
 os/utils.c                                       |    8 +
 present/present.c                                |    4 
 randr/rrcrtc.c                                   |    5 
 record/record.c                                  |    3 
 test/Makefile.am                                 |    2 
 test/signal-logging.c                            |    2 
 xkb/xkbtext.c                                    |   42 +++---
 70 files changed, 897 insertions(+), 598 deletions(-)

New commits:
commit c4dec70aa8ca949a125e3e8150f667304922d293
Author: Timo Aaltonen <tjaalton@debian.org>
Date:   Thu Oct 5 10:36:23 2017 +0300

    close some bugs

diff --git a/debian/changelog b/debian/changelog
index eb5770a..0afe3d4 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -5,7 +5,7 @@ xorg-server (2:1.19.4-1) UNRELEASED; urgency=medium
     (Closes: #868876, LP: #1059947).
 
   [ Timo Aaltonen ]
-  * New upstream release.
+  * New upstream release. (Closes: #855206, #857983, #860886)
     - CVE-2017-13721, CVE-2017-13723
   * rules: Drop dh_strip override, dbgsym transition is done
     (Closes: #876690).

commit 72d2aeda88d5f883c7ad89e6ba5e60a4caa0f655
Author: Timo Aaltonen <tjaalton@debian.org>
Date:   Thu Oct 5 10:23:27 2017 +0300

    fixes two CVE's

diff --git a/debian/changelog b/debian/changelog
index 4dd3760..eb5770a 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -6,6 +6,7 @@ xorg-server (2:1.19.4-1) UNRELEASED; urgency=medium
 
   [ Timo Aaltonen ]
   * New upstream release.
+    - CVE-2017-13721, CVE-2017-13723
   * rules: Drop dh_strip override, dbgsym transition is done
     (Closes: #876690).
   * signing-key.asc: Update Adam Jackson's key.

commit 2f7fb09988d093bd77e99e61597106908985ac21
Author: Timo Aaltonen <tjaalton@debian.org>
Date:   Thu Oct 5 10:14:29 2017 +0300

    signing-key.asc: Update Adam Jackson's key.

diff --git a/debian/changelog b/debian/changelog
index 23163d9..4dd3760 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -8,6 +8,7 @@ xorg-server (2:1.19.4-1) UNRELEASED; urgency=medium
   * New upstream release.
   * rules: Drop dh_strip override, dbgsym transition is done
     (Closes: #876690).
+  * signing-key.asc: Update Adam Jackson's key.
 
   [ Julien Cristau ]
   * Restore definition of DEB_HOST_ARCH_OS in debian/rules, lost in dh
diff --git a/debian/upstream/signing-key.asc b/debian/upstream/signing-key.asc
index 2395a38..0880e35 100644
--- a/debian/upstream/signing-key.asc
+++ b/debian/upstream/signing-key.asc
@@ -280,43 +280,44 @@ DNOWZJQhmuWMtbOUL2WMkKRPDwJrcbwpt3bc6aZCeAH1SSRLEe9Y+2uLeneTMA==
 =+xMJ
 -----END PGP PUBLIC KEY BLOCK-----
 -----BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1
+Version: GnuPG v2
 
-mQGiBEDLnMIRBACNlsJkPRfH7RMOn7nirvYN5StKVvwdJa2MFUM3sjoaA11nW+Zw
-Yxion4GkbIOtz25R29TcwuAaK1UWhy1Rz6aIOOMOzBeUNGGCvRXF76rKHBHOdSJw
-AXEvNa/9rKOIaPL7PBN7Lb4CmrjEbA9gKYtZQD9qQSKcAwyyxszkW1e7TwCg7MbV
-Bq5MWlATjOAzXLoSpgyENwMD/jPz53KmwUobbqri2pFhozacl5N93cy7b3pwpTZY
-fM50cXVSSshYpqdCr5AoWG/DXNGRixv1DnBKOI2Cv6YAQLntcATHxR8ssemOZHRv
-7D0hvWwC3o6GSKdg0rSOtRHfDhEL4IFVmPLZaXIRDZ0/ancrCuQPdZ9mzCi/LQmV
-noTeA/kB73zJMYH7Z0TSKv490AMWQHbKVvos8+tXxATlq0Otib+s55LXQocSPjgp
-GR5qKzqTn9elg2dyo4GYeAYvGBmhQtBdeYo1rVq2pC6HCzMG79zozL9O25SnDLpj
-WoqJB6qHBAd9tlTHzkRxv1Fqr4jfIupNborXbhR25tiYOm72irQcQWRhbSBKYWNr
-c29uIDxhamF4QG53bmsubmV0PohhBBMRAgAhAhsDBgsJCAcDAgMVAgMDFgIBAh4B
-AheABQJEZNYGAhkBAAoJEFuKLVCg7NDTlj8AoL9RgTs++HaD5w5lYARcE+OB+0Jg
-AKDZBhJhVgOsEjeg7atMglFR7s36mrQeQWRhbSBKYWNrc29uIDxhamF4QHJlZGhh
-dC5jb20+iGAEExECACAFAkfENSICGwMGCwkIBwMCBBUCCAMEFgIDAQIeAQIXgAAK
-CRBbii1QoOzQ0x6CAJ0fevUkaaBcTzKa0lTgfNFQ0E+JwgCfaWy44eNKttn4WWEZ
-CTGF+e+zraS0IEFkYW0gSmFja3NvbiA8YWpheEBlbmdyLnNnaS5jb20+iF4EExEC
-AB4FAkHB1gECGwMGCwkIBwMCAxUCAwMWAgECHgECF4AACgkQW4otUKDs0NNTOgCg
-lu1MOCbysvn68WReXz+v02+y2VkAoL12gktA0TFZnPBk3cweEAwCkUlXtCZBZGFt
-IEphY2tzb24gPGFqYXhAd2lsZG9wZW5zb3VyY2UuY29tPoheBBMRAgAeBQJBriSn
-AhsDBgsJCAcDAgMVAgMDFgIBAh4BAheAAAoJEFuKLVCg7NDTOe4AnRUJ6FqQLaoY
-XWCToQdl/Gry4UNZAJ97YYHMt1FIo1TLCWWozSiG+VtTq7QnQWRhbSBKYWNrc29u
-IDxhamF4QGJlbnplZHJpbmUubnduay5uZXQ+iF4EExECAB4FAkRk1eACGwMGCwkI
-BwMCAxUCAwMWAgECHgECF4AACgkQW4otUKDs0NN+fwCg2cPLDbAb07gMWBETKTRm
-sj34FsAAn0SQ4kuqs9Ms0ZRKDqNQ1YTMwyEHuQINBEDLnNAQCACrbu13VZsigsM6
-8MzfdGQ4x/acO4Vd+Dg/aFj3EhPfXZHRauuJ7gQtWc9Mk2ghTjbqEXj0JILbif95
-IyShdC/fxEYiFybRODR6FHlXj6BFCxZFfqi4mOuaGQ4BeB57g/gW+FSoIPzYU4IY
-85KD62qeS37zQEBAAK+mCEboUGfPT0wHrkFtkTObjOg7UTjpBp5/HknUREYo8mLo
-WBv7CDlApicmXoqnKfAcFaNY2YLMjklwFHh2i2+6dPbkdWSEpuZhkxIQ/8JlYS6A
-2g5DMKcNdmqr4Z6xjk8Fj1SO7ILc9EtR+ACqkqkmlU3m4AUHjdR/4kk7tEJ5DytP
-c95JcuJnAAMFB/9KWUqJbdeHs47LJBksZ6tnHArcSG653e9uejtNt5xquJIz2wxb
-exMV9Bkzwu9v/A8Vo7px7Bkhh++sBrgpGD4z5Jr+PaWOsw5qrO9OVVgzXkUf2QoD
-gw4Hh8m9jpx1s6tNasPsy12OGMJ4a5a1GCGg8F7sPlWLBd491viavDyOWYkKozLH
-hXwKlGOec0sCRGeHTiqPinxs29PXaTE7Dl/f2dYgiNzTSWetSx7Sv1H9EX4qxPgc
-smdRuGV7k7dIw/J02rcI/Ol4OUORRMY2cgJnb5mNxIxTgTGJysm+MjfPrZnOeDVK
-TroAYtas/uirqiNzk7fdIdUdgbOhsAl9n3QZiEYEGBECAAYFAkDLnNAACgkQW4ot
-UKDs0NP3CACfS1DKwgN/rB7Ib+RJiuK0F/BQoEYAoOhr0VXCT5dP0Yr1kIad7njC
-GBF1
-=bYOv
+mQGNBFnVVFMBDACz5+V0s2/JjDuvutBbI4hAO3Zgb8mlny5nM/YgkCCVe79MsOAe
+5Kn4Gj+lc8LiwJ4fyYPAWx1FIliryYE4RgpnKhipQhZB/UcvImTHQA4tqIavReyo
+H4o5+CbPgRY7XNE2wRWOogWd3WuSeuq/37mu1gORmq3KogzuarjJvffLNL4saA+w
+J37BXWhQ3P+eRiyF0qHaozf+bMenqtWEy0n0IQEg5wUS/zGXVlOX3fNhJeskq93a
+US0bu3axZL4sxOMKxnhRK0XDziFaiMu/DTj4Y0SWDXgK0owkcc7Ow2eAX52Z+zvw
+m9O3nBaQvQV7cUxNwYBmc2WkVts9XBrGT7tZ3HmFAkzB6YyPfdXYT4TpyFLofLVs
+JDvpa8iXkOmy22JUuqJlW36Idpmv/2jNkEfiIbby3wwZtONJOD9xNxCmOiVGA59+
+q+Lgs0aCWzomNx07zMOEeVvLOj9ficZhTqfvhZrkPD4iEOKKIpRRjCyDyMa0HTb7
+XAkDYk/NcZe4kQsAEQEAAbQcQWRhbSBKYWNrc29uIDxhamF4QG53bmsubmV0PokB
+zgQTAQgAOBYhBJle1cimE46wlh8YR0wJ3YPKqlCyBQJZ1VRTAhsDBQsJCAcCBhUI
+CQoLAgQWAgMBAh4BAheAAAoJEEwJ3YPKqlCy6A4L/Ru8dHFdsNKvKtBH9szNgd5d
+qcjEVWzw6YZKRTVpqw30O9uTcfuHzjV5ATIVTPEdXLklQficyCb4mGQLwxL2q5kT
+YMrGteTwBt4pYExo/DYIEZom3f9+75+OgN1PleXQ9pTYo+Ndw18GsnD/sW04HX2I
+IGKY3qUX3qhlxG6zdXsHTTIoCCBXrWepaD/IdA9Nw37tiyaTq2NH/ChcxFN7SuYr
+SWpBkPRhcsxKDju7j+s4KzO9f1QYFB2Vi3TbbYLEJ3BJg6AxVoiVe4B9xfl6KfCa
+EUjFWMqUprWiOjxNAdRUnfBN3UF2O/BxAtgZMk3RwVGG7fAEkfACkws8G5lcraTu
+kHQJBfzdlbbwrQG4020kRRdNihblPHZAWI5PJG5jpdGcqftyD+lRvv4gljHpAg/I
+eMK4rHjGANX3uQvcCelNwKf8TPVIDTB5vYvWmnHtRmEQkIeHhrMRzjhZej+uzNDF
+FpKPZayGn2uyPLv77aZCQmEs1O1EafWz1+IfBWDUmLkBjQRZ1VRTAQwA5E5W/FDK
+wfm+owkPenG0VYoXRfLlrBDvHcewLt04evdygHZZxNdV9Ycpsve9INdEg4nTJHj4
+mf302faUGECtiMKek78mfymzbAXS0kEXc2NoaXtEgFlPhavM4e8PpJ5aAKEsSHnQ
+1HMS2KJ4bPbDNSLpWkT4HBDAzsJHOFNDu0Z6TsyG/bA1VLoj0iMC9jL8xWz1lOBN
+iAhukMkjHOvmeq4BA2ktH5CUh8qwn8iEyw4sps5RcFKanIeru3sg8SVed4w0oCId
+Tw54mSNE3vzGiK9tDk0yhDRq2oFT7ER4r0Cr3ctyAsDPJCwhgVJ2YWAGdHewdfg6
+l1hfsvmO1omjR1SQBSEbw6Ftl6GySd91rsvT9i5+3LiNIpYgYb2L6wNn7cSXc9NF
+RXDWtw07P1mRJiRrBHwX1Brro7h9tvFT751F5yWSDdah5dUaqbl0C3cmXMoM+FLv
+E0dECfuM/mwOvtvlYzL1htdTSLZRb25dddZ6nTlH3sLkVpd9oZRSd7kdABEBAAGJ
+AbYEGAEIACAWIQSZXtXIphOOsJYfGEdMCd2DyqpQsgUCWdVUUwIbDAAKCRBMCd2D
+yqpQsjd+C/sHZFFz3zSLBo1sUIHCGl6P2DYHatEoQTP7R8g1kAHd145pAGrvXzR4
+F6T5SgM8t4a04Ia2SJLaptNXpf1pJXKlEpEaCb/oDhB/eCt8sOilcqSojkEmpe7z
+1xZY/ePNSzbsXDWTOagTM70UdaxgDand1dxMs2q8+Q3y3xZltXcYDmM48a/mRwe7
+rtPK68v3A54ZbcXojNcIMS1JBk+XcuBbmeI0yfGkcqbO2hiP8W81n1mb96jfZ/wj
+QhNzLqI3zxRnFHPiBMLy9tF0odNCRccQ2mbKdV2cfOIF5WKC4lrcyqz3eit2RYdS
+W3PPUqS3x2696I40zI2KoFjRn7YcWJ6T+skZPWW5bHCVcUN57v7270IG2MCA6D6a
+Rto7m6yUbLNgGadDyIjTQladTN1aKYK/QAsxS4y+EhkAPeaQRvZxBhZEocjIAE0B
+D2qzco+dq7IuQHIhXTnGRGEsS0bQdEnpQAoTQMVRo7loR2/XqzCIjkG40JH7Cr/r
+gPSRdLLYOLo=
+=+H4u
 -----END PGP PUBLIC KEY BLOCK-----

commit 891a2d0343c5ce3b12469d509c800e5d61c8856e
Author: Timo Aaltonen <tjaalton@debian.org>
Date:   Thu Oct 5 10:03:56 2017 +0300

    bump the version

diff --git a/debian/changelog b/debian/changelog
index f17f20e..23163d9 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,10 +1,11 @@
-xorg-server (2:1.19.3-3) UNRELEASED; urgency=medium
+xorg-server (2:1.19.4-1) UNRELEASED; urgency=medium
 
   [ Sven Joachim ]
   * xvfb-run: Do not redirect stderr to stdout when running the program
     (Closes: #868876, LP: #1059947).
 
   [ Timo Aaltonen ]
+  * New upstream release.
   * rules: Drop dh_strip override, dbgsym transition is done
     (Closes: #876690).
 

commit ec37e559614cf4eaba67d3ca0693f09fd95a5d57
Author: Adam Jackson <ajax@redhat.com>
Date:   Wed Oct 4 15:29:18 2017 -0400

    xserver 1.19.4
    
    Signed-off-by: Adam Jackson <ajax@redhat.com>

diff --git a/configure.ac b/configure.ac
index e078f12..682c655 100644
--- a/configure.ac
+++ b/configure.ac
@@ -26,9 +26,9 @@ dnl
 dnl Process this file with autoconf to create configure.
 
 AC_PREREQ(2.60)
-AC_INIT([xorg-server], 1.19.3, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
-RELEASE_DATE="2017-03-15"
-RELEASE_NAME="Lobster Bisque"
+AC_INIT([xorg-server], 1.19.4, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
+RELEASE_DATE="2017-10-04"
+RELEASE_NAME="French Onion Soup"
 AC_CONFIG_SRCDIR([Makefile.am])
 AC_CONFIG_MACRO_DIR([m4])
 AM_INIT_AUTOMAKE([foreign dist-bzip2])

commit 12fe3d3e9f494ef84832efe94ba00db92be499b1
Author: Louis-Francis Ratté-Boulianne <lfrb@collabora.com>
Date:   Wed Sep 27 01:19:58 2017 -0400

    present: Check the whole exec queue on event
    
    Later events are sometimes added in front of the queue (e.g.
    if page flipping fails) so we need to check the whole queue
    on event.
    
    Signed-off-by: Louis-Francis Ratté-Boulianne <lfrb@collabora.com>
    Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
    (cherry picked from commit c2f2b25ab55c67f9f3ad07c02fa746eae7c61196)

diff --git a/present/present.c b/present/present.c
index c9c68dc..7d428fc 100644
--- a/present/present.c
+++ b/present/present.c
@@ -543,8 +543,6 @@ present_event_notify(uint64_t event_id, uint64_t ust, uint64_t msc)
             present_execute(vblank, ust, msc);
             return;
         }
-        if (match < 0)
-            break;
     }
     xorg_list_for_each_entry(vblank, &present_flip_queue, event_queue) {
         if (vblank->event_id == event_id) {
@@ -1007,8 +1005,6 @@ present_abort_vblank(ScreenPtr screen, RRCrtcPtr crtc, uint64_t event_id, uint64
             vblank->queued = FALSE;
             return;
         }
-        if (match < 0)
-            break;
     }
     xorg_list_for_each_entry(vblank, &present_flip_queue, event_queue) {
         if (vblank->event_id == event_id) {

commit 388dc1aeac9acf2d51ad5103570beffd81d78b96
Author: Keith Packard <keithp@keithp.com>
Date:   Fri Sep 29 08:48:33 2017 -0700

    xf86-video-modesetting: Add ms_queue_vblank helper [v3]
    
    This provides an API wrapper around the kernel interface for queueing
    a vblank event, simplifying all of the callers.
    
    v2: Fix missing '|' in computing vbl.request.type
    
    v3: Remove spurious bit of next patch (thanks, Michel Dänzer)
    
    Signed-off-by: Keith Packard <keithp@keithp.com>
    Reviewed-by: Adam Jackson <ajax@redhat.com>
    (cherry picked from commit 677c32bcda98a96585bb1f66b57e0755a157b772)

diff --git a/hw/xfree86/drivers/modesetting/dri2.c b/hw/xfree86/drivers/modesetting/dri2.c
index 8944ef1..8f44899 100644
--- a/hw/xfree86/drivers/modesetting/dri2.c
+++ b/hw/xfree86/drivers/modesetting/dri2.c
@@ -695,19 +695,16 @@ ms_dri2_schedule_wait_msc(ClientPtr client, DrawablePtr draw, CARD64 target_msc,
 {
     ScreenPtr screen = draw->pScreen;
     ScrnInfoPtr scrn = xf86ScreenToScrn(screen);
-    modesettingPtr ms = modesettingPTR(scrn);
     ms_dri2_frame_event_ptr wait_info;
-    drmVBlank vbl;
     int ret;
     xf86CrtcPtr crtc = ms_dri2_crtc_covering_drawable(draw);
-    drmmode_crtc_private_ptr drmmode_crtc;
     CARD64 current_msc, current_ust, request_msc;
     uint32_t seq;
+    uint64_t queued_msc;
 
     /* Drawable not visible, return immediately */
     if (!crtc)
         goto out_complete;
-    drmmode_crtc = crtc->driver_private;
 
     wait_info = calloc(1, sizeof(*wait_info));
     if (!wait_info)
@@ -747,13 +744,8 @@ ms_dri2_schedule_wait_msc(ClientPtr client, DrawablePtr draw, CARD64 target_msc,
 
         if (current_msc >= target_msc)
             target_msc = current_msc;
-        vbl.request.type = (DRM_VBLANK_ABSOLUTE |
-                            DRM_VBLANK_EVENT |
-                            drmmode_crtc->vblank_pipe);
-        vbl.request.sequence = ms_crtc_msc_to_kernel_msc(crtc, target_msc);
-        vbl.request.signal = (unsigned long)seq;
 
-        ret = drmWaitVBlank(ms->fd, &vbl);
+        ret = ms_queue_vblank(crtc, MS_QUEUE_ABSOLUTE, target_msc, &queued_msc, seq);
         if (ret) {
             static int limit = 5;
             if (limit) {
@@ -766,7 +758,7 @@ ms_dri2_schedule_wait_msc(ClientPtr client, DrawablePtr draw, CARD64 target_msc,
             goto out_free;
         }
 
-        wait_info->frame = ms_kernel_msc_to_crtc_msc(crtc, vbl.reply.sequence);
+        wait_info->frame = queued_msc;
         DRI2BlockClient(client, draw);
         return TRUE;
     }
@@ -775,9 +767,6 @@ ms_dri2_schedule_wait_msc(ClientPtr client, DrawablePtr draw, CARD64 target_msc,
      * If we get here, target_msc has already passed or we don't have one,
      * so we queue an event that will satisfy the divisor/remainder equation.
      */
-    vbl.request.type =
-        DRM_VBLANK_ABSOLUTE | DRM_VBLANK_EVENT | drmmode_crtc->vblank_pipe;
-
     request_msc = current_msc - (current_msc % divisor) +
         remainder;
     /*
@@ -795,11 +784,7 @@ ms_dri2_schedule_wait_msc(ClientPtr client, DrawablePtr draw, CARD64 target_msc,
     if (!seq)
         goto out_free;
 
-    vbl.request.sequence = ms_crtc_msc_to_kernel_msc(crtc, request_msc);
-    vbl.request.signal = (unsigned long)seq;
-
-    ret = drmWaitVBlank(ms->fd, &vbl);
-    if (ret) {
+    if (!ms_queue_vblank(crtc, MS_QUEUE_ABSOLUTE, request_msc, &queued_msc, seq)) {
         static int limit = 5;
         if (limit) {
             xf86DrvMsg(scrn->scrnIndex, X_WARNING,
@@ -811,7 +796,8 @@ ms_dri2_schedule_wait_msc(ClientPtr client, DrawablePtr draw, CARD64 target_msc,
         goto out_free;
     }
 
-    wait_info->frame = ms_kernel_msc_to_crtc_msc(crtc, vbl.reply.sequence);
+    wait_info->frame = queued_msc;
+
     DRI2BlockClient(client, draw);
 
     return TRUE;
@@ -839,20 +825,18 @@ ms_dri2_schedule_swap(ClientPtr client, DrawablePtr draw,
 {
     ScreenPtr screen = draw->pScreen;
     ScrnInfoPtr scrn = xf86ScreenToScrn(screen);
-    modesettingPtr ms = modesettingPTR(scrn);
-    drmVBlank vbl;
     int ret, flip = 0;
     xf86CrtcPtr crtc = ms_dri2_crtc_covering_drawable(draw);
-    drmmode_crtc_private_ptr drmmode_crtc;
     ms_dri2_frame_event_ptr frame_info = NULL;
     uint64_t current_msc, current_ust;
     uint64_t request_msc;
     uint32_t seq;
+    ms_queue_flag ms_flag = MS_QUEUE_ABSOLUTE;
+    uint64_t queued_msc;
 
     /* Drawable not displayed... just complete the swap */
     if (!crtc)
         goto blit_fallback;
-    drmmode_crtc = crtc->driver_private;
 
     frame_info = calloc(1, sizeof(*frame_info));
     if (!frame_info)
@@ -878,6 +862,8 @@ ms_dri2_schedule_swap(ClientPtr client, DrawablePtr draw,
     ms_dri2_reference_buffer(back);
 
     ret = ms_get_crtc_ust_msc(crtc, &current_ust, &current_msc);
+    if (ret != Success)
+        goto blit_fallback;
 
     /* Flips need to be submitted one frame before */
     if (can_flip(scrn, draw, front, back)) {
@@ -892,22 +878,19 @@ ms_dri2_schedule_swap(ClientPtr client, DrawablePtr draw,
     if (*target_msc > 0)
         *target_msc -= flip;
 
+    /* If non-pageflipping, but blitting/exchanging, we need to use
+     * DRM_VBLANK_NEXTONMISS to avoid unreliable timestamping later
+     * on.
+     */
+    if (flip == 0)
+        ms_flag |= MS_QUEUE_NEXT_ON_MISS;
+
     /*
      * If divisor is zero, or current_msc is smaller than target_msc
      * we just need to make sure target_msc passes before initiating
      * the swap.
      */
     if (divisor == 0 || current_msc < *target_msc) {
-        vbl.request.type = (DRM_VBLANK_ABSOLUTE |
-                            DRM_VBLANK_EVENT |
-                            drmmode_crtc->vblank_pipe);
-
-        /* If non-pageflipping, but blitting/exchanging, we need to use
-         * DRM_VBLANK_NEXTONMISS to avoid unreliable timestamping later
-         * on.
-         */
-        if (flip == 0)
-            vbl.request.type |= DRM_VBLANK_NEXTONMISS;
 
         /* If target_msc already reached or passed, set it to
          * current_msc to ensure we return a reasonable value back
@@ -922,19 +905,14 @@ ms_dri2_schedule_swap(ClientPtr client, DrawablePtr draw,
         if (!seq)
             goto blit_fallback;
 
-        vbl.request.sequence = ms_crtc_msc_to_kernel_msc(crtc, *target_msc);
-        vbl.request.signal = (unsigned long)seq;
-
-        ret = drmWaitVBlank(ms->fd, &vbl);
-        if (ret) {
+        if (!ms_queue_vblank(crtc, ms_flag, *target_msc, &queued_msc, seq)) {
             xf86DrvMsg(scrn->scrnIndex, X_WARNING,
                        "divisor 0 get vblank counter failed: %s\n",
                        strerror(errno));
             goto blit_fallback;
         }
 
-        *target_msc = ms_kernel_msc_to_crtc_msc(crtc,
-                                                vbl.reply.sequence + flip);
+        *target_msc = queued_msc + flip;
         frame_info->frame = *target_msc;
 
         return TRUE;
@@ -945,11 +923,6 @@ ms_dri2_schedule_swap(ClientPtr client, DrawablePtr draw,
      * and we need to queue an event that will satisfy the divisor/remainder
      * equation.
      */
-    vbl.request.type = (DRM_VBLANK_ABSOLUTE |
-                        DRM_VBLANK_EVENT |
-                        drmmode_crtc->vblank_pipe);
-    if (flip == 0)
-        vbl.request.type |= DRM_VBLANK_NEXTONMISS;
 
     request_msc = current_msc - (current_msc % divisor) +
         remainder;
@@ -966,7 +939,6 @@ ms_dri2_schedule_swap(ClientPtr client, DrawablePtr draw,
     if (request_msc <= current_msc)
         request_msc += divisor;
 
-
     seq = ms_drm_queue_alloc(crtc, frame_info,
                              ms_dri2_frame_event_handler,
                              ms_dri2_frame_event_abort);
@@ -974,11 +946,7 @@ ms_dri2_schedule_swap(ClientPtr client, DrawablePtr draw,
         goto blit_fallback;
 
     /* Account for 1 frame extra pageflip delay if flip > 0 */
-    vbl.request.sequence = ms_crtc_msc_to_kernel_msc(crtc, request_msc) - flip;
-    vbl.request.signal = (unsigned long)seq;
-
-    ret = drmWaitVBlank(ms->fd, &vbl);
-    if (ret) {
+    if (!ms_queue_vblank(crtc, ms_flag, request_msc - flip, &queued_msc, seq)) {
         xf86DrvMsg(scrn->scrnIndex, X_WARNING,
                    "final get vblank counter failed: %s\n",
                    strerror(errno));
@@ -986,7 +954,7 @@ ms_dri2_schedule_swap(ClientPtr client, DrawablePtr draw,
     }
 
     /* Adjust returned value for 1 fame pageflip offset of flip > 0 */
-    *target_msc = ms_kernel_msc_to_crtc_msc(crtc, vbl.reply.sequence + flip);
+    *target_msc = queued_msc + flip;
     frame_info->frame = *target_msc;
 
     return TRUE;
diff --git a/hw/xfree86/drivers/modesetting/driver.h b/hw/xfree86/drivers/modesetting/driver.h
index eee96e5..66034ba 100644
--- a/hw/xfree86/drivers/modesetting/driver.h
+++ b/hw/xfree86/drivers/modesetting/driver.h
@@ -119,6 +119,10 @@ typedef struct _modesettingRec {
     Bool dirty_enabled;
 
     uint32_t cursor_width, cursor_height;
+
+    Bool has_queue_sequence;
+    Bool tried_queue_sequence;
+
 } modesettingRec, *modesettingPtr;
 
 #define modesettingPTR(p) ((modesettingPtr)((p)->driverPrivate))
@@ -129,6 +133,15 @@ uint32_t ms_drm_queue_alloc(xf86CrtcPtr crtc,
                             ms_drm_handler_proc handler,
                             ms_drm_abort_proc abort);
 
+typedef enum ms_queue_flag {
+    MS_QUEUE_ABSOLUTE = 0,
+    MS_QUEUE_RELATIVE = 1,
+    MS_QUEUE_NEXT_ON_MISS = 2
+} ms_queue_flag;
+
+Bool ms_queue_vblank(xf86CrtcPtr crtc, ms_queue_flag flags,
+                     uint64_t msc, uint64_t *msc_queued, uint32_t seq);
+
 void ms_drm_abort(ScrnInfoPtr scrn,
                   Bool (*match)(void *data, void *match_data),
                   void *match_data);
@@ -140,8 +153,8 @@ xf86CrtcPtr ms_dri2_crtc_covering_drawable(DrawablePtr pDraw);
 
 int ms_get_crtc_ust_msc(xf86CrtcPtr crtc, CARD64 *ust, CARD64 *msc);
 
-uint32_t ms_crtc_msc_to_kernel_msc(xf86CrtcPtr crtc, uint64_t expect);
-uint64_t ms_kernel_msc_to_crtc_msc(xf86CrtcPtr crtc, uint32_t sequence);
+uint64_t ms_crtc_msc_to_kernel_msc(xf86CrtcPtr crtc, uint64_t expect);
+uint64_t ms_kernel_msc_to_crtc_msc(xf86CrtcPtr crtc, uint64_t sequence);
 
 
 Bool ms_dri2_screen_init(ScreenPtr screen);
diff --git a/hw/xfree86/drivers/modesetting/drmmode_display.c b/hw/xfree86/drivers/modesetting/drmmode_display.c
index 53e1cf5..025725a 100644
--- a/hw/xfree86/drivers/modesetting/drmmode_display.c
+++ b/hw/xfree86/drivers/modesetting/drmmode_display.c
@@ -279,8 +279,6 @@ drmmode_SharedPixmapPresentOnVBlank(PixmapPtr ppix, xf86CrtcPtr crtc,
 {
     drmmode_crtc_private_ptr drmmode_crtc = crtc->driver_private;
     msPixmapPrivPtr ppriv = msGetPixmapPriv(drmmode, ppix);
-
-    drmVBlank vbl;
     struct vblank_event_args *event_args;
 
     if (ppix == drmmode_crtc->prime_pixmap)
@@ -303,12 +301,7 @@ drmmode_SharedPixmapPresentOnVBlank(PixmapPtr ppix, xf86CrtcPtr crtc,
                            drmmode_SharedPixmapVBlankEventHandler,
                            drmmode_SharedPixmapVBlankEventAbort);
 
-    vbl.request.type =
-        DRM_VBLANK_RELATIVE | DRM_VBLANK_EVENT | drmmode_crtc->vblank_pipe;
-    vbl.request.sequence = 1;
-    vbl.request.signal = (unsigned long) ppriv->flip_seq;
-
-    return drmWaitVBlank(drmmode->fd, &vbl) >= 0;
+    return ms_queue_vblank(crtc, MS_QUEUE_RELATIVE, 1, NULL, ppriv->flip_seq);
 }
 
 Bool
diff --git a/hw/xfree86/drivers/modesetting/present.c b/hw/xfree86/drivers/modesetting/present.c
index 55b622c..67982d7 100644
--- a/hw/xfree86/drivers/modesetting/present.c
+++ b/hw/xfree86/drivers/modesetting/present.c
@@ -109,13 +109,7 @@ ms_present_queue_vblank(RRCrtcPtr crtc,
                         uint64_t msc)
 {
     xf86CrtcPtr xf86_crtc = crtc->devPrivate;
-    ScreenPtr screen = crtc->pScreen;
-    ScrnInfoPtr scrn = xf86ScreenToScrn(screen);
-    modesettingPtr ms = modesettingPTR(scrn);
-    drmmode_crtc_private_ptr drmmode_crtc = xf86_crtc->driver_private;
     struct ms_present_vblank_event *event;
-    drmVBlank vbl;
-    int ret;
     uint32_t seq;
 
     event = calloc(sizeof(struct ms_present_vblank_event), 1);
@@ -130,22 +124,9 @@ ms_present_queue_vblank(RRCrtcPtr crtc,
         return BadAlloc;
     }
 
-    vbl.request.type =
-        DRM_VBLANK_ABSOLUTE | DRM_VBLANK_EVENT | drmmode_crtc->vblank_pipe;
-    vbl.request.sequence = ms_crtc_msc_to_kernel_msc(xf86_crtc, msc);
-    vbl.request.signal = seq;
-    for (;;) {
-        ret = drmWaitVBlank(ms->fd, &vbl);
-        if (!ret)
-            break;
-        /* If we hit EBUSY, then try to flush events.  If we can't, then
-         * this is an error.
-         */
-        if (errno != EBUSY || ms_flush_drm_events(screen) < 0) {
-	    ms_drm_abort_seq(scrn, seq);
-            return BadAlloc;
-        }
-    }
+    if (!ms_queue_vblank(xf86_crtc, MS_QUEUE_ABSOLUTE, msc, NULL, seq))
+        return BadAlloc;
+
     DebugPresent(("\t\tmq %lld seq %u msc %llu (hw msc %u)\n",
                  (long long) event_id, seq, (long long) msc,
                  vbl.request.sequence));
diff --git a/hw/xfree86/drivers/modesetting/vblank.c b/hw/xfree86/drivers/modesetting/vblank.c
index 8682f4d..31cf0bd 100644
--- a/hw/xfree86/drivers/modesetting/vblank.c
+++ b/hw/xfree86/drivers/modesetting/vblank.c
@@ -173,7 +173,7 @@ ms_dri2_crtc_covering_drawable(DrawablePtr pDraw)
 
 static Bool
 ms_get_kernel_ust_msc(xf86CrtcPtr crtc,
-                      uint32_t *msc, uint64_t *ust)
+                      uint64_t *msc, uint64_t *ust)
 {
     ScreenPtr screen = crtc->randr_crtc->pScreen;
     ScrnInfoPtr scrn = xf86ScreenToScrn(screen);
@@ -198,13 +198,50 @@ ms_get_kernel_ust_msc(xf86CrtcPtr crtc,
     }
 }
 
+Bool
+ms_queue_vblank(xf86CrtcPtr crtc, ms_queue_flag flags,
+                uint64_t msc, uint64_t *msc_queued, uint32_t seq)
+{
+    ScreenPtr screen = crtc->randr_crtc->pScreen;
+    ScrnInfoPtr scrn = xf86ScreenToScrn(screen);
+    modesettingPtr ms = modesettingPTR(scrn);
+    drmmode_crtc_private_ptr drmmode_crtc = crtc->driver_private;
+    drmVBlank vbl;
+    int ret;
+
+    for (;;) {
+        /* Queue an event at the specified sequence */
+        vbl.request.type = DRM_VBLANK_EVENT | drmmode_crtc->vblank_pipe;
+        if (flags & MS_QUEUE_RELATIVE)
+            vbl.request.type |= DRM_VBLANK_RELATIVE;
+        else
+            vbl.request.type |= DRM_VBLANK_ABSOLUTE;
+        if (flags & MS_QUEUE_NEXT_ON_MISS)
+            vbl.request.type |= DRM_VBLANK_NEXTONMISS;
+
+        vbl.request.sequence = ms_crtc_msc_to_kernel_msc(crtc, msc);
+        vbl.request.signal = seq;
+        ret = drmWaitVBlank(ms->fd, &vbl);
+        if (ret == 0) {
+            if (msc_queued)
+                *msc_queued = ms_kernel_msc_to_crtc_msc(crtc, vbl.reply.sequence);
+            return TRUE;
+        }
+        if (errno != EBUSY) {
+            ms_drm_abort_seq(scrn, msc);
+            return FALSE;
+        }
+        ms_flush_drm_events(screen);
+    }
+}
+
 /**
  * Convert a 32-bit kernel MSC sequence number to a 64-bit local sequence
  * number, adding in the vblank_offset and high 32 bits, and dealing
  * with 64-bit wrapping
  */
 uint64_t
-ms_kernel_msc_to_crtc_msc(xf86CrtcPtr crtc, uint32_t sequence)
+ms_kernel_msc_to_crtc_msc(xf86CrtcPtr crtc, uint64_t sequence)
 {
     drmmode_crtc_private_rec *drmmode_crtc = crtc->driver_private;
     sequence += drmmode_crtc->vblank_offset;
@@ -218,7 +255,7 @@ ms_kernel_msc_to_crtc_msc(xf86CrtcPtr crtc, uint32_t sequence)
 int
 ms_get_crtc_ust_msc(xf86CrtcPtr crtc, CARD64 *ust, CARD64 *msc)
 {
-    uint32_t kernel_msc;
+    uint64_t kernel_msc;
 
     if (!ms_get_kernel_ust_msc(crtc, &kernel_msc, ust))
         return BadMatch;
@@ -230,13 +267,13 @@ ms_get_crtc_ust_msc(xf86CrtcPtr crtc, CARD64 *ust, CARD64 *msc)
 #define MAX_VBLANK_OFFSET       1000
 
 /**
- * Convert a 64-bit adjusted MSC value into a 32-bit kernel sequence number,
- * removing the high 32 bits and subtracting out the vblank_offset term.
+ * Convert a 64-bit adjusted MSC value into a 64-bit kernel sequence number,
+ * by subtracting out the vblank_offset term.
  *
  * This also updates the vblank_offset when it notices that the value should
  * change.
  */
-uint32_t
+uint64_t
 ms_crtc_msc_to_kernel_msc(xf86CrtcPtr crtc, uint64_t expect)
 {
     drmmode_crtc_private_rec *drmmode_crtc = crtc->driver_private;
@@ -257,7 +294,7 @@ ms_crtc_msc_to_kernel_msc(xf86CrtcPtr crtc, uint64_t expect)
                 drmmode_crtc->vblank_offset = 0;
         }
     }
-    return (uint32_t) (expect - drmmode_crtc->vblank_offset);
+    return (expect - drmmode_crtc->vblank_offset);
 }
 
 /**
@@ -375,25 +412,31 @@ ms_drm_abort(ScrnInfoPtr scrn, Bool (*match)(void *data, void *match_data),
  * drm event queue and calls the handler for it.
  */
 static void
-ms_drm_handler(int fd, uint32_t frame, uint32_t sec, uint32_t usec,
-               void *user_ptr)
+ms_drm_sequence_handler(int fd, uint64_t frame, uint64_t ns, uint64_t user_data)
 {
     struct ms_drm_queue *q, *tmp;
-    uint32_t user_data = (uint32_t) (intptr_t) user_ptr;
+    uint32_t seq = (uint32_t) user_data;
 
     xorg_list_for_each_entry_safe(q, tmp, &ms_drm_queue, list) {
-        if (q->seq == user_data) {
+        if (q->seq == seq) {
             uint64_t msc;
 
             msc = ms_kernel_msc_to_crtc_msc(q->crtc, frame);
             xorg_list_del(&q->list);
-            q->handler(msc, (uint64_t) sec * 1000000 + usec, q->data);
+            q->handler(msc, ns / 1000, q->data);
             free(q);
             break;
         }
     }
 }
 
+static void
+ms_drm_handler(int fd, uint32_t frame, uint32_t sec, uint32_t usec,
+               void *user_ptr)
+{
+    ms_drm_sequence_handler(fd, frame, ((uint64_t) sec * 1000000 + usec) * 1000, (uint32_t) (uintptr_t) user_ptr);
+}
+
 Bool
 ms_vblank_screen_init(ScreenPtr screen)
 {

commit 8bd33a2db7337b2801fc630a57e36b6aeea219d9
Author: Keith Packard <keithp@keithp.com>
Date:   Thu Jul 27 10:08:32 2017 -0700

    xkb: Handle xkb formated string output safely (CVE-2017-13723)
    
    Generating strings for XKB data used a single shared static buffer,
    which offered several opportunities for errors. Use a ring of
    resizable buffers instead, to avoid problems when strings end up
    longer than anticipated.
    
    Reviewed-by: Michal Srb <msrb@suse.com>
    Signed-off-by: Keith Packard <keithp@keithp.com>
    Signed-off-by: Julien Cristau <jcristau@debian.org>
    (cherry picked from commit 94f11ca5cf011ef123bd222cabeaef6f424d76ac)

diff --git a/xkb/xkbtext.c b/xkb/xkbtext.c
index ead2b1a..d2a2567 100644
--- a/xkb/xkbtext.c
+++ b/xkb/xkbtext.c
@@ -47,23 +47,27 @@
 
 /***====================================================================***/
 
-#define	BUFFER_SIZE	512
-
-static char textBuffer[BUFFER_SIZE];
-static int tbNext = 0;
+#define NUM_BUFFER      8
+static struct textBuffer {
+    int size;
+    char *buffer;
+} textBuffer[NUM_BUFFER];
+static int textBufferIndex;
 
 static char *
 tbGetBuffer(unsigned size)
 {
-    char *rtrn;
+    struct textBuffer *tb;
 
-    if (size >= BUFFER_SIZE)
-        return NULL;
-    if ((BUFFER_SIZE - tbNext) <= size)
-        tbNext = 0;
-    rtrn = &textBuffer[tbNext];
-    tbNext += size;
-    return rtrn;
+    tb = &textBuffer[textBufferIndex];
+    textBufferIndex = (textBufferIndex + 1) % NUM_BUFFER;
+
+    if (size > tb->size) {
+        free(tb->buffer);
+        tb->buffer = xnfalloc(size);
+        tb->size = size;
+    }
+    return tb->buffer;
 }
 
 /***====================================================================***/
@@ -79,8 +83,6 @@ XkbAtomText(Atom atm, unsigned format)
         int len;
 
         len = strlen(atmstr) + 1;
-        if (len > BUFFER_SIZE)
-            len = BUFFER_SIZE - 2;
         rtrn = tbGetBuffer(len);
         strlcpy(rtrn, atmstr, len);
     }
@@ -128,8 +130,6 @@ XkbVModIndexText(XkbDescPtr xkb, unsigned ndx, unsigned format)
     len = strlen(tmp) + 1;
     if (format == XkbCFile)
         len += 4;
-    if (len >= BUFFER_SIZE)
-        len = BUFFER_SIZE - 1;
     rtrn = tbGetBuffer(len);
     if (format == XkbCFile) {
         strcpy(rtrn, "vmod_");
@@ -140,6 +140,8 @@ XkbVModIndexText(XkbDescPtr xkb, unsigned ndx, unsigned format)
     return rtrn;
 }
 
+#define VMOD_BUFFER_SIZE        512
+
 char *
 XkbVModMaskText(XkbDescPtr xkb,
                 unsigned modMask, unsigned mask, unsigned format)
@@ -147,7 +149,7 @@ XkbVModMaskText(XkbDescPtr xkb,
     register int i, bit;
     int len;
     char *mm, *rtrn;
-    char *str, buf[BUFFER_SIZE];
+    char *str, buf[VMOD_BUFFER_SIZE];
 
     if ((modMask == 0) && (mask == 0)) {
         rtrn = tbGetBuffer(5);
@@ -173,7 +175,7 @@ XkbVModMaskText(XkbDescPtr xkb,
                 len = strlen(tmp) + 1 + (str == buf ? 0 : 1);
                 if (format == XkbCFile)
                     len += 4;
-                if ((str - (buf + len)) <= BUFFER_SIZE) {
+                if ((str - (buf + len)) <= VMOD_BUFFER_SIZE) {
                     if (str != buf) {
                         if (format == XkbCFile)
                             *str++ = '|';
@@ -199,8 +201,6 @@ XkbVModMaskText(XkbDescPtr xkb,
         len = 0;
     if (str)
         len += strlen(str) + (mm == NULL ? 0 : 1);
-    if (len >= BUFFER_SIZE)
-        len = BUFFER_SIZE - 1;
     rtrn = tbGetBuffer(len + 1);
     rtrn[0] = '\0';
 

commit 3094c4c6d879215923f2183ecd048b4f5429b182
Author: Michal Srb <msrb@suse.com>
Date:   Thu Jul 27 11:54:26 2017 +0200

    xkb: Escape non-printable characters correctly.
    
    XkbStringText escapes non-printable characters using octal numbers. Such escape
    sequence would be at most 5 characters long ("\0123"), so it reserves 5 bytes
    in the buffer. Due to char->unsigned int conversion, it would print much longer
    string for negative numbers.
    
    Reviewed-by: Keith Packard <keithp@keithp.com>
    Signed-off-by: Julien Cristau <jcristau@debian.org>
    (cherry picked from commit eaf1f72ed8994b708d94ec2de7b1a99f5c4a39b8)

diff --git a/xkb/xkbtext.c b/xkb/xkbtext.c
index ffbc546..ead2b1a 100644
--- a/xkb/xkbtext.c
+++ b/xkb/xkbtext.c
@@ -603,7 +603,7 @@ XkbStringText(char *str, unsigned format)
             }
             else {
                 *out++ = '0';
-                sprintf(out, "%o", *in);
+                sprintf(out, "%o", (unsigned char) *in);
                 while (*out != '\0')
                     out++;
             }

commit a510fb811100bc27f0bfafe5d073998551161819
Author: Michal Srb <msrb@suse.com>
Date:   Fri Jul 28 16:27:10 2017 +0200

    Xext/shm: Validate shmseg resource id (CVE-2017-13721)
    
    Otherwise it can belong to a non-existing client and abort X server with
    FatalError "client not in use", or overwrite existing segment of another
    existing client.
    
    Signed-off-by: Julien Cristau <jcristau@debian.org>
    (cherry picked from commit b95f25af141d33a65f6f821ea9c003f66a01e1f1)

diff --git a/Xext/shm.c b/Xext/shm.c
index 1b622e3..c98d4a0 100644
--- a/Xext/shm.c
+++ b/Xext/shm.c
@@ -1238,6 +1238,7 @@ ProcShmCreateSegment(ClientPtr client)
     };
 
     REQUEST_SIZE_MATCH(xShmCreateSegmentReq);
+    LEGAL_NEW_RESOURCE(stuff->shmseg, client);
     if ((stuff->readOnly != xTrue) && (stuff->readOnly != xFalse)) {
         client->errorValue = stuff->readOnly;
         return BadValue;

commit 3cea13cc40e2421ebefcf2ee0eb949a7bc4e63fd
Author: Adam Jackson <ajax@redhat.com>
Date:   Fri Jun 16 15:44:47 2017 -0400

    dmx: Remove some not-very-interesting debug prints
    
    gcc/glibc think the snprintf in dmxExecOS() might truncate. Yes, it
    might, and we also don't care. Just delete all this.
    
    Signed-off-by: Adam Jackson <ajax@redhat.com>
    Acked-by: Keith Packard <keithp@keithp.com>
    (cherry picked from commit d6db66811643d3762716f6b144a7358572216a4f)

diff --git a/hw/dmx/dmxinit.c b/hw/dmx/dmxinit.c
index 3d394c5..24bb875 100644
--- a/hw/dmx/dmxinit.c
+++ b/hw/dmx/dmxinit.c
@@ -532,63 +532,6 @@ dmxDisplayInit(DMXScreenInfo * dmxScreen)
     dmxGetPixmapFormats(dmxScreen);
 }
 
-/* If this doesn't compile, just add || defined(yoursystem) to the line
- * below.  This information is to help with bug reports and is not
- * critical. */
-#if !defined(_POSIX_SOURCE)
-static const char *
-dmxExecOS(void)
-{
-    return "";
-}
-#else
-#include <sys/utsname.h>
-static const char *
-dmxExecOS(void)
-{
-    static char buffer[128];
-    static int initialized = 0;
-    struct utsname u;
-
-    if (!initialized++) {
-        memset(buffer, 0, sizeof(buffer));
-        uname(&u);
-        snprintf(buffer, sizeof(buffer) - 1, "%s %s %s",
-                 u.sysname, u.release, u.version);
-    }
-    return buffer;
-}
-#endif
-


Reply to: