X Strike Force X.Org X11 SVN commit: r602 - in trunk/debian: . patches/general
Author: dnusinow
Date: 2005-09-14 20:55:59 -0500 (Wed, 14 Sep 2005)
New Revision: 602
Modified:
trunk/debian/changelog
trunk/debian/patches/general/0000_backport_from_upstream.diff
Log:
* Fix for CAN-2005-2495. See also freedesktop bug #594. Disallows pixmaps
greater than the allocation limit. This is incorporated in to
general/0000_backport_from_upstream.diff.
* Set changelog for release of 6.8.2.dfsg.1-7
Modified: trunk/debian/changelog
===================================================================
--- trunk/debian/changelog 2005-09-15 01:53:54 UTC (rev 601)
+++ trunk/debian/changelog 2005-09-15 01:55:59 UTC (rev 602)
@@ -1,4 +1,4 @@
-xorg-x11 (6.8.2.dfsg.1-6+SVN) UNRELEASED; urgency=low
+xorg-x11 (6.8.2.dfsg.1-7) unstable; urgency=high
[ Branden Robinson ]
* Add patch #000k: Fix VSW5 (and therefore LSB 3.0) test failures by
@@ -9,6 +9,9 @@
replace_conffile_with_symlink_rollback() actually exists.
[ David Nusinow ]
+ * Fix for CAN-2005-2495. See also freedesktop bug #594. Disallows pixmaps
+ greater than the allocation limit. This is incorporated in to
+ general/0000_backport_from_upstream.diff.
* Add Build-Depends on linux-kernel-headers to (>= 2.6.13+0rc3-1.1) so that
people do not get FTBFSes due to Bug#320515. The previous build-conflict
was not enough to ensure that the necessary version of l-k-h was
@@ -18,7 +21,7 @@
dpkg-buildpackage -nc to work. Thanks Jeremy Shaw.
+ Also add -f to ln command in genscripts to allow -nc to work
- -- David Nusinow <dnusinow@debian.org> Sat, 3 Sep 2005 14:52:46 -0400
+ -- David Nusinow <dnusinow@debian.org> Wed, 7 Sep 2005 16:17:18 -0400
xorg-x11 (6.8.2.dfsg.1-6) unstable; urgency=low
Modified: trunk/debian/patches/general/0000_backport_from_upstream.diff
===================================================================
--- trunk/debian/patches/general/0000_backport_from_upstream.diff 2005-09-15 01:53:54 UTC (rev 601)
+++ trunk/debian/patches/general/0000_backport_from_upstream.diff 2005-09-15 01:55:59 UTC (rev 602)
@@ -148,9 +148,27 @@
* config/cf/linux.cf:
Fix typo that I introduced on 2005-03-06.
-diff -ruN xc-old/config/cf/linux.cf xc/config/cf/linux.cf
---- xc-old/config/cf/linux.cf 2005-06-05 23:06:14.000000000 -0400
-+++ xc/config/cf/linux.cf 2005-07-19 11:07:43.000000000 -0400
+* NOTE: This patch not taken from CVS, as it is a security bug, so info
+* written by David Nusinow *
+
+ * programs/Xserver/afb/afbpixmap.c
+ * programs/Xserver/cfb/cfbpixmap.c
+ * programs/Xserver/dix/dispatch.c
+ * programs/Xserver/fb/fbpixmap.c
+ * programs/Xserver/hw/xfree86/exa/exa.c
+ * programs/Xserver/hw/xfree86/xaa/xaaInit.c
+ * programs/Xserver/hw/xfree86/xf4bpp/ppcPixmap.c
+ * programs/Xserver/ilbm/ilbmpixmap.c
+ * programs/Xserver/iplan2p4/iplpixmap.c
+ * programs/Xserver/mfb/mfbpixmap.c
+
+ Fix for CAN-2005-2495 and https://bugs.freedesktop.org/show_bug.cgi?id=594
+ Do not allow allocation of pixmaps that are greater than the maximum limit
+
+Index: xc/config/cf/linux.cf
+===================================================================
+--- xc/config/cf/linux.cf.orig 2005-08-08 19:15:58.000000000 -0400
++++ xc/config/cf/linux.cf 2005-08-27 09:48:12.000000000 -0400
@@ -95,13 +95,13 @@
XCOMM binutils: (LinuxBinUtilsMajorVersion)
@@ -204,9 +222,10 @@
/* extended instruction set support */
# ifdef i386Architecture
# define HasX86Support YES
-diff -ruN xc-old/config/cf/xorg.cf xc/config/cf/xorg.cf
---- xc-old/config/cf/xorg.cf 2005-05-08 23:33:45.000000000 -0400
-+++ xc/config/cf/xorg.cf 2005-07-19 11:07:43.000000000 -0400
+Index: xc/config/cf/xorg.cf
+===================================================================
+--- xc/config/cf/xorg.cf.orig 2005-08-08 19:15:58.000000000 -0400
++++ xc/config/cf/xorg.cf 2005-08-27 09:48:12.000000000 -0400
@@ -415,15 +415,12 @@
# ifndef DriDrivers
@@ -241,9 +260,10 @@
# endif
#endif /*AMD64Arcitecture*/
-diff -ruN xc-old/extras/Xpm/lib/create.c xc/extras/Xpm/lib/create.c
---- xc-old/extras/Xpm/lib/create.c 2005-06-05 23:06:15.000000000 -0400
-+++ xc/extras/Xpm/lib/create.c 2005-07-19 11:07:43.000000000 -0400
+Index: xc/extras/Xpm/lib/create.c
+===================================================================
+--- xc/extras/Xpm/lib/create.c.orig 2005-08-08 19:15:58.000000000 -0400
++++ xc/extras/Xpm/lib/create.c 2005-08-27 09:48:12.000000000 -0400
@@ -1215,10 +1215,10 @@
register char *src;
register char *dst;
@@ -257,9 +277,10 @@
data = image->data;
iptr = pixelindex;
-diff -ruN xc-old/extras/Xpm/lib/scan.c xc/extras/Xpm/lib/scan.c
---- xc-old/extras/Xpm/lib/scan.c 2005-06-05 23:06:15.000000000 -0400
-+++ xc/extras/Xpm/lib/scan.c 2005-07-19 11:07:43.000000000 -0400
+Index: xc/extras/Xpm/lib/scan.c
+===================================================================
+--- xc/extras/Xpm/lib/scan.c.orig 2005-08-08 19:15:58.000000000 -0400
++++ xc/extras/Xpm/lib/scan.c 2005-08-27 09:48:12.000000000 -0400
@@ -621,8 +621,8 @@
char *dst;
unsigned int *iptr;
@@ -281,9 +302,10 @@
if ((image->bits_per_pixel | image->depth) == 1) {
ibu = image->bitmap_unit;
for (y = 0; y < height; y++)
-diff -ruN xc-old/include/extensions/scrnsaver.h xc/include/extensions/scrnsaver.h
---- xc-old/include/extensions/scrnsaver.h 2005-05-08 23:08:13.000000000 -0400
-+++ xc/include/extensions/scrnsaver.h 2005-07-19 11:07:43.000000000 -0400
+Index: xc/include/extensions/scrnsaver.h
+===================================================================
+--- xc/include/extensions/scrnsaver.h.orig 2005-08-08 19:15:58.000000000 -0400
++++ xc/include/extensions/scrnsaver.h 2005-08-27 09:48:12.000000000 -0400
@@ -32,6 +32,7 @@
#define _SCRNSAVER_H_
@@ -292,9 +314,10 @@
#include <X11/extensions/saver.h>
typedef struct {
-diff -ruN xc-old/include/extensions/xf86mscstr.h xc/include/extensions/xf86mscstr.h
---- xc-old/include/extensions/xf86mscstr.h 2005-05-08 23:08:13.000000000 -0400
-+++ xc/include/extensions/xf86mscstr.h 2005-07-19 11:07:43.000000000 -0400
+Index: xc/include/extensions/xf86mscstr.h
+===================================================================
+--- xc/include/extensions/xf86mscstr.h.orig 2005-08-08 19:15:58.000000000 -0400
++++ xc/include/extensions/xf86mscstr.h 2005-08-27 09:48:12.000000000 -0400
@@ -14,7 +14,7 @@
#define XF86MISCNAME "XFree86-Misc"
@@ -304,9 +327,10 @@
typedef struct _XF86MiscQueryVersion {
CARD8 reqType; /* always XF86MiscReqCode */
-diff -ruN xc-old/programs/Xserver/hw/dmx/config/Imakefile xc/programs/Xserver/hw/dmx/config/Imakefile
---- xc-old/programs/Xserver/hw/dmx/config/Imakefile 2005-05-08 23:25:43.000000000 -0400
-+++ xc/programs/Xserver/hw/dmx/config/Imakefile 2005-07-19 11:07:43.000000000 -0400
+Index: xc/programs/Xserver/hw/dmx/config/Imakefile
+===================================================================
+--- xc/programs/Xserver/hw/dmx/config/Imakefile.orig 2005-08-08 19:15:58.000000000 -0400
++++ xc/programs/Xserver/hw/dmx/config/Imakefile 2005-08-27 09:48:12.000000000 -0400
@@ -68,6 +68,10 @@
LinkSourceFile(dmxlog.c,..)
@@ -318,9 +342,10 @@
InstallManPage(dmxtodmx,$(MANDIR))
InstallManPage(vdltodmx,$(MANDIR))
InstallManPage(xdmxconfig,$(MANDIR))
-diff -ruN xc-old/programs/Xserver/hw/xfree86/common/compiler.h xc/programs/Xserver/hw/xfree86/common/compiler.h
---- xc-old/programs/Xserver/hw/xfree86/common/compiler.h 2005-05-08 23:22:38.000000000 -0400
-+++ xc/programs/Xserver/hw/xfree86/common/compiler.h 2005-07-19 11:07:43.000000000 -0400
+Index: xc/programs/Xserver/hw/xfree86/common/compiler.h
+===================================================================
+--- xc/programs/Xserver/hw/xfree86/common/compiler.h.orig 2005-08-08 19:15:58.000000000 -0400
++++ xc/programs/Xserver/hw/xfree86/common/compiler.h 2005-08-27 09:48:12.000000000 -0400
@@ -478,7 +478,7 @@
# ifndef __INTEL_COMPILER
# define ia64_flush_cache(Addr) \
@@ -330,9 +355,10 @@
"sync.i;;;" \
"mf;;;" \
"srlz.i;;;" \
-diff -ruN xc-old/programs/Xserver/hw/xfree86/common/Imakefile xc/programs/Xserver/hw/xfree86/common/Imakefile
---- xc-old/programs/Xserver/hw/xfree86/common/Imakefile 2005-05-08 23:22:38.000000000 -0400
-+++ xc/programs/Xserver/hw/xfree86/common/Imakefile 2005-07-19 11:07:43.000000000 -0400
+Index: xc/programs/Xserver/hw/xfree86/common/Imakefile
+===================================================================
+--- xc/programs/Xserver/hw/xfree86/common/Imakefile.orig 2005-08-08 19:15:58.000000000 -0400
++++ xc/programs/Xserver/hw/xfree86/common/Imakefile 2005-08-27 09:48:12.000000000 -0400
@@ -190,10 +190,14 @@
OSNAME = OSName
OSVENDOR = OSVendor
@@ -351,9 +377,10 @@
#if defined(BuilderString)
BUILDERSTRING = BuilderString
BUILDERMSG = -DBUILDERSTRING='$(BUILDERSTRING)'
-diff -ruN xc-old/programs/Xserver/hw/xfree86/common/xf86PciInfo.h xc/programs/Xserver/hw/xfree86/common/xf86PciInfo.h
---- xc-old/programs/Xserver/hw/xfree86/common/xf86PciInfo.h 2005-05-08 23:22:38.000000000 -0400
-+++ xc/programs/Xserver/hw/xfree86/common/xf86PciInfo.h 2005-07-19 11:24:05.000000000 -0400
+Index: xc/programs/Xserver/hw/xfree86/common/xf86PciInfo.h
+===================================================================
+--- xc/programs/Xserver/hw/xfree86/common/xf86PciInfo.h.orig 2005-08-08 19:15:58.000000000 -0400
++++ xc/programs/Xserver/hw/xfree86/common/xf86PciInfo.h 2005-08-27 09:48:12.000000000 -0400
@@ -140,6 +140,7 @@
#define PCI_CHIP_RV360_AR 0x4152
#define PCI_CHIP_RV350_AS 0x4153
@@ -491,9 +518,10 @@
#define PCI_CHIP_SAVAGE2000 0x9102
/* ARK Logic */
-diff -ruN xc-old/programs/Xserver/hw/xfree86/drivers/ati/r128_driver.c xc/programs/Xserver/hw/xfree86/drivers/ati/r128_driver.c
---- xc-old/programs/Xserver/hw/xfree86/drivers/ati/r128_driver.c 2005-05-08 23:25:12.000000000 -0400
-+++ xc/programs/Xserver/hw/xfree86/drivers/ati/r128_driver.c 2005-07-19 11:07:43.000000000 -0400
+Index: xc/programs/Xserver/hw/xfree86/drivers/ati/r128_driver.c
+===================================================================
+--- xc/programs/Xserver/hw/xfree86/drivers/ati/r128_driver.c.orig 2005-08-08 19:15:58.000000000 -0400
++++ xc/programs/Xserver/hw/xfree86/drivers/ati/r128_driver.c 2005-08-27 09:48:12.000000000 -0400
@@ -137,7 +137,8 @@
OPTION_PROG_FP_REGS,
OPTION_FBDEV,
@@ -648,9 +676,10 @@
vgaHWFreeHWRec(pScrn);
R128FreeRec(pScrn);
}
-diff -ruN xc-old/programs/Xserver/hw/xfree86/drivers/ati/r128.h xc/programs/Xserver/hw/xfree86/drivers/ati/r128.h
---- xc-old/programs/Xserver/hw/xfree86/drivers/ati/r128.h 2005-05-08 23:25:12.000000000 -0400
-+++ xc/programs/Xserver/hw/xfree86/drivers/ati/r128.h 2005-07-19 11:07:43.000000000 -0400
+Index: xc/programs/Xserver/hw/xfree86/drivers/ati/r128.h
+===================================================================
+--- xc/programs/Xserver/hw/xfree86/drivers/ati/r128.h.orig 2005-08-08 19:15:58.000000000 -0400
++++ xc/programs/Xserver/hw/xfree86/drivers/ati/r128.h 2005-08-27 09:48:12.000000000 -0400
@@ -401,6 +401,8 @@
I2CBusPtr pI2CBus;
CARD32 DDCReg;
@@ -660,9 +689,10 @@
} R128InfoRec, *R128InfoPtr;
#define R128WaitForFifo(pScrn, entries) \
-diff -ruN xc-old/programs/Xserver/hw/xfree86/drivers/ati/r128.man xc/programs/Xserver/hw/xfree86/drivers/ati/r128.man
---- xc-old/programs/Xserver/hw/xfree86/drivers/ati/r128.man 2005-05-08 23:25:12.000000000 -0400
-+++ xc/programs/Xserver/hw/xfree86/drivers/ati/r128.man 2005-07-19 11:07:43.000000000 -0400
+Index: xc/programs/Xserver/hw/xfree86/drivers/ati/r128.man
+===================================================================
+--- xc/programs/Xserver/hw/xfree86/drivers/ati/r128.man.orig 2005-08-08 19:15:58.000000000 -0400
++++ xc/programs/Xserver/hw/xfree86/drivers/ati/r128.man 2005-08-27 09:48:12.000000000 -0400
@@ -123,6 +123,17 @@
.BI "Option \*qShowCache\*q \*q" boolean \*q
Enable or disable viewing offscreen cache memory. A
@@ -681,9 +711,10 @@
.SH "SEE ALSO"
__xservername__(__appmansuffix__), __xconfigfile__(__filemansuffix__), xorgconfig(__appmansuffix__), Xserver(__appmansuffix__), X(__miscmansuffix__)
-diff -ruN xc-old/programs/Xserver/hw/xfree86/drivers/ati/radeon_accel.c xc/programs/Xserver/hw/xfree86/drivers/ati/radeon_accel.c
---- xc-old/programs/Xserver/hw/xfree86/drivers/ati/radeon_accel.c 2005-05-08 23:25:12.000000000 -0400
-+++ xc/programs/Xserver/hw/xfree86/drivers/ati/radeon_accel.c 2005-07-19 11:07:43.000000000 -0400
+Index: xc/programs/Xserver/hw/xfree86/drivers/ati/radeon_accel.c
+===================================================================
+--- xc/programs/Xserver/hw/xfree86/drivers/ati/radeon_accel.c.orig 2005-08-08 19:15:58.000000000 -0400
++++ xc/programs/Xserver/hw/xfree86/drivers/ati/radeon_accel.c 2005-08-27 09:48:12.000000000 -0400
@@ -291,10 +291,8 @@
OUTREGP(RADEON_DP_DATATYPE, 0, ~RADEON_HOST_BIG_ENDIAN_EN);
#endif
@@ -697,9 +728,10 @@
RADEONWaitForFifo(pScrn, 1);
OUTREG(RADEON_DEFAULT_SC_BOTTOM_RIGHT, (RADEON_DEFAULT_SC_RIGHT_MAX
-diff -ruN xc-old/programs/Xserver/hw/xfree86/drivers/ati/radeon_chipset.h xc/programs/Xserver/hw/xfree86/drivers/ati/radeon_chipset.h
---- xc-old/programs/Xserver/hw/xfree86/drivers/ati/radeon_chipset.h 2005-05-08 23:25:12.000000000 -0400
-+++ xc/programs/Xserver/hw/xfree86/drivers/ati/radeon_chipset.h 2005-07-19 11:18:10.000000000 -0400
+Index: xc/programs/Xserver/hw/xfree86/drivers/ati/radeon_chipset.h
+===================================================================
+--- xc/programs/Xserver/hw/xfree86/drivers/ati/radeon_chipset.h.orig 2005-08-08 19:15:58.000000000 -0400
++++ xc/programs/Xserver/hw/xfree86/drivers/ati/radeon_chipset.h 2005-08-27 09:48:12.000000000 -0400
@@ -35,6 +35,7 @@
{ PCI_CHIP_RV280_5961, "ATI Radeon 9200 5961 (AGP)" },
{ PCI_CHIP_RV280_5962, "ATI Radeon 9200 5962 (AGP)" },
@@ -774,9 +806,10 @@
{ -1, NULL }
};
-diff -ruN xc-old/programs/Xserver/hw/xfree86/drivers/ati/radeon_driver.c xc/programs/Xserver/hw/xfree86/drivers/ati/radeon_driver.c
---- xc-old/programs/Xserver/hw/xfree86/drivers/ati/radeon_driver.c 2005-05-08 23:25:12.000000000 -0400
-+++ xc/programs/Xserver/hw/xfree86/drivers/ati/radeon_driver.c 2005-07-19 11:18:10.000000000 -0400
+Index: xc/programs/Xserver/hw/xfree86/drivers/ati/radeon_driver.c
+===================================================================
+--- xc/programs/Xserver/hw/xfree86/drivers/ati/radeon_driver.c.orig 2005-08-08 19:15:58.000000000 -0400
++++ xc/programs/Xserver/hw/xfree86/drivers/ati/radeon_driver.c 2005-08-27 09:48:12.000000000 -0400
@@ -164,7 +164,10 @@
OPTION_SUBPIXEL_ORDER,
#endif
@@ -1647,9 +1680,10 @@
vgaHWFreeHWRec(pScrn);
RADEONFreeRec(pScrn);
}
-diff -ruN xc-old/programs/Xserver/hw/xfree86/drivers/ati/radeon.h xc/programs/Xserver/hw/xfree86/drivers/ati/radeon.h
---- xc-old/programs/Xserver/hw/xfree86/drivers/ati/radeon.h 2005-05-08 23:25:12.000000000 -0400
-+++ xc/programs/Xserver/hw/xfree86/drivers/ati/radeon.h 2005-07-19 11:07:43.000000000 -0400
+Index: xc/programs/Xserver/hw/xfree86/drivers/ati/radeon.h
+===================================================================
+--- xc/programs/Xserver/hw/xfree86/drivers/ati/radeon.h.orig 2005-08-08 19:15:58.000000000 -0400
++++ xc/programs/Xserver/hw/xfree86/drivers/ati/radeon.h 2005-08-27 09:48:12.000000000 -0400
@@ -596,6 +596,9 @@
/* special handlings for DELL triple-head server */
@@ -1660,9 +1694,10 @@
} RADEONInfoRec, *RADEONInfoPtr;
-diff -ruN xc-old/programs/Xserver/hw/xfree86/drivers/ati/radeon.man xc/programs/Xserver/hw/xfree86/drivers/ati/radeon.man
---- xc-old/programs/Xserver/hw/xfree86/drivers/ati/radeon.man 2005-05-08 23:25:12.000000000 -0400
-+++ xc/programs/Xserver/hw/xfree86/drivers/ati/radeon.man 2005-07-19 11:18:10.000000000 -0400
+Index: xc/programs/Xserver/hw/xfree86/drivers/ati/radeon.man
+===================================================================
+--- xc/programs/Xserver/hw/xfree86/drivers/ati/radeon.man.orig 2005-08-08 19:15:58.000000000 -0400
++++ xc/programs/Xserver/hw/xfree86/drivers/ati/radeon.man 2005-08-27 09:48:12.000000000 -0400
@@ -52,6 +52,9 @@
.B RS350
Radeon 9200 IGP
@@ -1729,9 +1764,10 @@
.SH SEE ALSO
__xservername__(__appmansuffix__), __xconfigfile__(__filemansuffix__), xorgconfig(__appmansuffix__), Xserver(__appmansuffix__), X(__miscmansuffix__)
-diff -ruN xc-old/programs/Xserver/hw/xfree86/drivers/ati/radeon_probe.c xc/programs/Xserver/hw/xfree86/drivers/ati/radeon_probe.c
---- xc-old/programs/Xserver/hw/xfree86/drivers/ati/radeon_probe.c 2005-05-08 23:25:12.000000000 -0400
-+++ xc/programs/Xserver/hw/xfree86/drivers/ati/radeon_probe.c 2005-07-19 11:18:10.000000000 -0400
+Index: xc/programs/Xserver/hw/xfree86/drivers/ati/radeon_probe.c
+===================================================================
+--- xc/programs/Xserver/hw/xfree86/drivers/ati/radeon_probe.c.orig 2005-08-08 19:15:58.000000000 -0400
++++ xc/programs/Xserver/hw/xfree86/drivers/ati/radeon_probe.c 2005-08-27 09:48:12.000000000 -0400
@@ -88,6 +88,7 @@
{ PCI_CHIP_RV280_5961, PCI_CHIP_RV280_5961, RES_SHARED_VGA },
{ PCI_CHIP_RV280_5962, PCI_CHIP_RV280_5962, RES_SHARED_VGA },
@@ -1806,9 +1842,10 @@
{ -1, -1, RES_UNDEFINED }
};
-diff -ruN xc-old/programs/Xserver/hw/xfree86/drivers/savage/savage_driver.c xc/programs/Xserver/hw/xfree86/drivers/savage/savage_driver.c
---- xc-old/programs/Xserver/hw/xfree86/drivers/savage/savage_driver.c 2005-05-08 23:24:48.000000000 -0400
-+++ xc/programs/Xserver/hw/xfree86/drivers/savage/savage_driver.c 2005-07-19 11:07:43.000000000 -0400
+Index: xc/programs/Xserver/hw/xfree86/drivers/savage/savage_driver.c
+===================================================================
+--- xc/programs/Xserver/hw/xfree86/drivers/savage/savage_driver.c.orig 2005-08-08 19:15:58.000000000 -0400
++++ xc/programs/Xserver/hw/xfree86/drivers/savage/savage_driver.c 2005-08-27 09:48:12.000000000 -0400
@@ -121,8 +121,8 @@
{ PCI_CHIP_SAVAGE_IX, "Savage/IX" },
{ PCI_CHIP_PROSAVAGE_PM, "ProSavage PM133" },
@@ -1820,9 +1857,10 @@
{ PCI_CHIP_SUPSAV_MX128, "SuperSavage/MX 128" },
{ PCI_CHIP_SUPSAV_MX64, "SuperSavage/MX 64" },
{ PCI_CHIP_SUPSAV_MX64C, "SuperSavage/MX 64C" },
-diff -ruN xc-old/programs/Xserver/hw/xfree86/drivers/savage/savage_regs.h xc/programs/Xserver/hw/xfree86/drivers/savage/savage_regs.h
---- xc-old/programs/Xserver/hw/xfree86/drivers/savage/savage_regs.h 2005-05-08 23:24:48.000000000 -0400
-+++ xc/programs/Xserver/hw/xfree86/drivers/savage/savage_regs.h 2005-07-19 11:07:43.000000000 -0400
+Index: xc/programs/Xserver/hw/xfree86/drivers/savage/savage_regs.h
+===================================================================
+--- xc/programs/Xserver/hw/xfree86/drivers/savage/savage_regs.h.orig 2005-08-08 19:15:58.000000000 -0400
++++ xc/programs/Xserver/hw/xfree86/drivers/savage/savage_regs.h 2005-08-27 09:48:12.000000000 -0400
@@ -3,30 +3,6 @@
#ifndef _SAVAGE_REGS_H
#define _SAVAGE_REGS_H
@@ -1854,9 +1892,10 @@
#define S3_SAVAGE3D_SERIES(chip) ((chip>=S3_SAVAGE3D) && (chip<=S3_SAVAGE_MX))
#define S3_SAVAGE4_SERIES(chip) ((chip==S3_SAVAGE4) || (chip==S3_PROSAVAGE))
-diff -ruN xc-old/programs/Xserver/hw/xfree86/i2c/xf86i2c.c xc/programs/Xserver/hw/xfree86/i2c/xf86i2c.c
---- xc-old/programs/Xserver/hw/xfree86/i2c/xf86i2c.c 2005-05-08 23:23:09.000000000 -0400
-+++ xc/programs/Xserver/hw/xfree86/i2c/xf86i2c.c 2005-07-19 11:07:43.000000000 -0400
+Index: xc/programs/Xserver/hw/xfree86/i2c/xf86i2c.c
+===================================================================
+--- xc/programs/Xserver/hw/xfree86/i2c/xf86i2c.c.orig 2005-08-08 19:15:58.000000000 -0400
++++ xc/programs/Xserver/hw/xfree86/i2c/xf86i2c.c 2005-08-27 09:48:12.000000000 -0400
@@ -87,7 +87,7 @@
d_secs = (a_secs - b_secs);
d_usecs = (a_usecs - b_usecs);
@@ -1866,9 +1905,10 @@
}
}
#endif
-diff -ruN xc-old/programs/Xserver/hw/xfree86/loader/elfloader.c xc/programs/Xserver/hw/xfree86/loader/elfloader.c
---- xc-old/programs/Xserver/hw/xfree86/loader/elfloader.c 2005-05-08 23:22:46.000000000 -0400
-+++ xc/programs/Xserver/hw/xfree86/loader/elfloader.c 2005-07-19 11:07:43.000000000 -0400
+Index: xc/programs/Xserver/hw/xfree86/loader/elfloader.c
+===================================================================
+--- xc/programs/Xserver/hw/xfree86/loader/elfloader.c.orig 2005-08-08 19:15:58.000000000 -0400
++++ xc/programs/Xserver/hw/xfree86/loader/elfloader.c 2005-08-27 09:48:12.000000000 -0400
@@ -2785,6 +2785,14 @@
mprotect( (char *)elffile->lsection[j].saddr - round,
SecSize(i) + round, PROT_READ | PROT_WRITE | PROT_EXEC);
@@ -1884,9 +1924,10 @@
break;
#endif
case SHT_SYMTAB:
-diff -ruN xc-old/programs/Xserver/Xext/xf86misc.c xc/programs/Xserver/Xext/xf86misc.c
---- xc-old/programs/Xserver/Xext/xf86misc.c 2005-05-08 23:26:08.000000000 -0400
-+++ xc/programs/Xserver/Xext/xf86misc.c 2005-07-19 11:07:43.000000000 -0400
+Index: xc/programs/Xserver/Xext/xf86misc.c
+===================================================================
+--- xc/programs/Xserver/Xext/xf86misc.c.orig 2005-08-08 19:15:58.000000000 -0400
++++ xc/programs/Xserver/Xext/xf86misc.c 2005-08-27 09:48:12.000000000 -0400
@@ -582,20 +582,29 @@
strncpy(msgtype,(char*)(&stuff[1]),stuff->typelen);
} else return BadValue;
@@ -1931,3 +1972,192 @@
return (client->noClientException);
}
+Index: xc/programs/Xserver/afb/afbpixmap.c
+===================================================================
+--- xc/programs/Xserver/afb/afbpixmap.c.orig 2005-05-08 23:26:12.000000000 -0400
++++ xc/programs/Xserver/afb/afbpixmap.c 2005-08-27 09:49:57.000000000 -0400
+@@ -73,10 +73,14 @@
+ int depth;
+ {
+ PixmapPtr pPixmap;
+- int datasize;
+- int paddedWidth;
++ size_t datasize;
++ size_t paddedWidth;
+
+ paddedWidth = BitmapBytePad(width);
++
++ if (paddedWidth > 32767 || height > 32767)
++ return NullPixmap;
++
+ datasize = height * paddedWidth * depth;
+ pPixmap = AllocatePixmap(pScreen, datasize);
+ if (!pPixmap)
+Index: xc/programs/Xserver/cfb/cfbpixmap.c
+===================================================================
+--- xc/programs/Xserver/cfb/cfbpixmap.c.orig 2005-05-08 23:26:18.000000000 -0400
++++ xc/programs/Xserver/cfb/cfbpixmap.c 2005-08-27 09:50:52.000000000 -0400
+@@ -70,10 +70,14 @@
+ int depth;
+ {
+ PixmapPtr pPixmap;
+- int datasize;
+- int paddedWidth;
++ size_t datasize;
++ size_t paddedWidth;
+
+ paddedWidth = PixmapBytePad(width, depth);
++
++ if (paddedWidth > 32767 || height > 32767)
++ return NullPixmap;
++
+ datasize = height * paddedWidth;
+ pPixmap = AllocatePixmap(pScreen, datasize);
+ if (!pPixmap)
+Index: xc/programs/Xserver/dix/dispatch.c
+===================================================================
+--- xc/programs/Xserver/dix/dispatch.c.orig 2005-05-08 23:25:56.000000000 -0400
++++ xc/programs/Xserver/dix/dispatch.c 2005-08-27 09:53:13.000000000 -0400
+@@ -1506,6 +1506,23 @@
+ client->errorValue = 0;
+ return BadValue;
+ }
++ if (stuff->width > 32767 || stuff->height > 32767)
++ {
++ /* It is allowed to try and allocate a pixmap which is larger than
++ * 32767 in either dimension. However, all of the framebuffer code
++ * is buggy and does not reliably draw to such big pixmaps, basically
++ * because the Region data structure operates with signed shorts
++ * for the rectangles in it.
++ *
++ * Furthermore, several places in the X server computes the
++ * size in bytes of the pixmap and tries to store it in an
++ * integer. This integer can overflow and cause the allocated size
++ * to be much smaller.
++ *
++ * So, such big pixmaps are rejected here with a BadAlloc
++ */
++ return BadAlloc;
++ }
+ if (stuff->depth != 1)
+ {
+ pDepth = pDraw->pScreen->allowedDepths;
+Index: xc/programs/Xserver/fb/fbpixmap.c
+===================================================================
+--- xc/programs/Xserver/fb/fbpixmap.c.orig 2005-05-08 23:20:09.000000000 -0400
++++ xc/programs/Xserver/fb/fbpixmap.c 2005-08-27 09:54:06.000000000 -0400
+@@ -32,12 +32,16 @@
+ fbCreatePixmapBpp (ScreenPtr pScreen, int width, int height, int depth, int bpp)
+ {
+ PixmapPtr pPixmap;
+- int datasize;
+- int paddedWidth;
++ size_t datasize;
++ size_t paddedWidth;
+ int adjust;
+ int base;
+
+ paddedWidth = ((width * bpp + FB_MASK) >> FB_SHIFT) * sizeof (FbBits);
++
++ if (paddedWidth > 32767 || height > 32767)
++ return NullPixmap;
++
+ datasize = height * paddedWidth;
+ #ifdef PIXPRIV
+ base = pScreen->totalPixmapSize;
+Index: xc/programs/Xserver/hw/xfree86/xaa/xaaInit.c
+===================================================================
+--- xc/programs/Xserver/hw/xfree86/xaa/xaaInit.c.orig 2005-05-08 23:22:15.000000000 -0400
++++ xc/programs/Xserver/hw/xfree86/xaa/xaaInit.c 2005-08-27 09:55:16.000000000 -0400
+@@ -499,6 +499,9 @@
+ PixmapPtr pPix = NULL;
+ int size = w * h;
+
++ if (w > 32767 || h > 32767)
++ return NullPixmap;
++
+ if (!infoRec->offscreenDepthsInitialized)
+ XAAInitializeOffscreenDepths (pScreen);
+
+Index: xc/programs/Xserver/hw/xfree86/xf4bpp/ppcPixmap.c
+===================================================================
+--- xc/programs/Xserver/hw/xfree86/xf4bpp/ppcPixmap.c.orig 2005-05-08 23:21:52.000000000 -0400
++++ xc/programs/Xserver/hw/xfree86/xf4bpp/ppcPixmap.c 2005-08-27 09:57:51.000000000 -0400
+@@ -85,13 +85,16 @@
+ int depth ;
+ {
+ register PixmapPtr pPixmap = (PixmapPtr)NULL;
+- int size ;
++ size_t size ;
+
+ TRACE(("xf4bppCreatePixmap(pScreen=0x%x, width=%d, height=%d, depth=%d)\n", pScreen, width, height, depth)) ;
+
+ if ( depth > 8 )
+ return (PixmapPtr) NULL ;
+
++ if (width > 32767 || height > 32767)
++ return (PixmapPtr) NULL ;
++
+ size = PixmapBytePad(width, depth);
+ pPixmap = AllocatePixmap (pScreen, (height * size));
+
+Index: xc/programs/Xserver/ilbm/ilbmpixmap.c
+===================================================================
+--- xc/programs/Xserver/ilbm/ilbmpixmap.c.orig 2005-05-08 23:19:50.000000000 -0400
++++ xc/programs/Xserver/ilbm/ilbmpixmap.c 2005-08-27 09:59:01.000000000 -0400
+@@ -75,10 +75,12 @@
+ int depth;
+ {
+ PixmapPtr pPixmap;
+- int datasize;
+- int paddedWidth;
++ size_t datasize;
++ size_t paddedWidth;
+
+ paddedWidth = BitmapBytePad(width);
++ if (paddedWidth > 32767 || height > 32767)
++ return NullPixmap;
+ datasize = height * paddedWidth * depth;
+ pPixmap = AllocatePixmap(pScreen, datasize);
+ if (!pPixmap)
+Index: xc/programs/Xserver/iplan2p4/iplpixmap.c
+===================================================================
+--- xc/programs/Xserver/iplan2p4/iplpixmap.c.orig 2005-05-08 23:20:12.000000000 -0400
++++ xc/programs/Xserver/iplan2p4/iplpixmap.c 2005-08-27 10:00:09.000000000 -0400
+@@ -74,12 +74,14 @@
+ int depth;
+ {
+ PixmapPtr pPixmap;
+- int datasize;
+- int paddedWidth;
++ size_t datasize;
++ size_t paddedWidth;
+ int ipad=INTER_PLANES*2 - 1;
+
+ paddedWidth = PixmapBytePad(width, depth);
+ paddedWidth = (paddedWidth + ipad) & ~ipad;
++ if (paddedWidth > 32767 || height > 32767)
++ return NullPixmap;
+ datasize = height * paddedWidth;
+ pPixmap = AllocatePixmap(pScreen, datasize);
+ if (!pPixmap)
+Index: xc/programs/Xserver/mfb/mfbpixmap.c
+===================================================================
+--- xc/programs/Xserver/mfb/mfbpixmap.c.orig 2005-05-08 23:26:31.000000000 -0400
++++ xc/programs/Xserver/mfb/mfbpixmap.c 2005-08-27 10:01:09.000000000 -0400
+@@ -72,11 +72,13 @@
+ int depth;
+ {
+ PixmapPtr pPixmap;
+- int datasize;
+- int paddedWidth;
++ size_t datasize;
++ size_t paddedWidth;
+
+ if (depth != 1)
+ return NullPixmap;
++ if (width > 32767 || height > 32767)
++ return NullPixmap;
+ paddedWidth = BitmapBytePad(width);
+ datasize = height * paddedWidth;
+ pPixmap = AllocatePixmap(pScreen, datasize);
Reply to: