xorg-server: Changes to 'upstream-experimental'
COPYING | 2
Xext/geext.c | 2
Xext/security.c | 2
Xext/sync.c | 172
Xext/xf86bigfont.c | 91
Xext/xselinux_ext.c | 6
Xi/exevents.c | 3
Xi/extinit.c | 1
Xi/xigrabdev.c | 2
Xi/xipassivegrab.c | 2
Xi/xiproperty.c | 2
Xi/xiquerypointer.c | 2
Xi/xiselectev.c | 15
Xi/xiwarppointer.c | 2
composite/compalloc.c | 40
composite/compext.c | 2
composite/compinit.c | 64
composite/compint.h | 7
composite/compoverlay.c | 2
composite/compwindow.c | 36
config/hal.c | 13
config/udev.c | 33
configure.ac | 40
cpprules.in | 49
dix/Xserver-dtrace.h.in | 2
dix/Xserver.d | 2
dix/deprecated.c | 30
dix/devices.c | 17
dix/dispatch.c | 2
dix/dixfonts.c | 6
dix/events.c | 137
dix/getevents.c | 60
dix/inpututils.c | 8
dix/property.c | 3
dix/resource.c | 44
dix/window.c | 4
doc/man/Makefile.am | 16
doc/xml/Xserver-spec.xml | 7
exa/exa.c | 3
exa/exa_accel.c | 2
exa/exa_driver.c | 2
exa/exa_migration_mixed.c | 17
exa/exa_mixed.c | 2
exa/exa_unaccel.c | 7
fb/Makefile.am | 4
fb/fbcmap_mi.c | 2
glx/glxcmds.c | 188
glx/glxcmdsswap.c | 171
glx/glxdri2.c | 2
glx/unpack.h | 2
glx/xfont.c | 2
hw/dmx/Makefile.am | 32
hw/dmx/Xdmx.man | 741 -
hw/dmx/config/Makefile.am | 21
hw/dmx/config/dmxtodmx.man | 41
hw/dmx/config/man/Makefile.am | 2
hw/dmx/config/man/dmxtodmx.man | 41
hw/dmx/config/man/vdltodmx.man | 95
hw/dmx/config/man/xdmxconfig.man | 63
hw/dmx/config/vdltodmx.man | 95
hw/dmx/config/xdmxconfig.c | 2
hw/dmx/config/xdmxconfig.man | 63
hw/dmx/dmx.c | 10
hw/dmx/dmxextension.c | 32
hw/dmx/dmxgc.c | 7
hw/dmx/dmxgcops.c | 10
hw/dmx/dmxpict.c | 54
hw/dmx/dmxwindow.c | 10
hw/dmx/doc/Makefile.am | 2
hw/dmx/glxProxy/glxcmds.c | 182
hw/dmx/glxProxy/glxext.c | 6
hw/dmx/glxProxy/unpack.h | 2
hw/dmx/input/dmxinputinit.c | 40
hw/dmx/man/Makefile.am | 2
hw/dmx/man/Xdmx.man | 741 +
hw/kdrive/ephyr/.gitignore | 2
hw/kdrive/ephyr/Makefile.am | 18
hw/kdrive/ephyr/Xephyr.man.pre | 89
hw/kdrive/ephyr/man/Makefile.am | 2
hw/kdrive/ephyr/man/Xephyr.man | 87
hw/vfb/.gitignore | 2
hw/vfb/Makefile.am | 21
hw/vfb/Xvfb.man.pre | 125
hw/vfb/man/Makefile.am | 2
hw/vfb/man/Xvfb.man | 125
hw/xfree86/.gitignore | 3
hw/xfree86/Makefile.am | 18
hw/xfree86/common/Makefile.am | 5
hw/xfree86/common/compiler.h | 13
hw/xfree86/common/scoasm.h | 142
hw/xfree86/common/xf86.h | 2
hw/xfree86/common/xf86AutoConfig.c | 6
hw/xfree86/common/xf86Bus.c | 35
hw/xfree86/common/xf86Config.c | 13
hw/xfree86/common/xf86Configure.c | 54
hw/xfree86/common/xf86Cursor.c | 6
hw/xfree86/common/xf86DGA.c | 51
hw/xfree86/common/xf86Events.c | 13
hw/xfree86/common/xf86Globals.c | 1
hw/xfree86/common/xf86Helper.c | 15
hw/xfree86/common/xf86Init.c | 30
hw/xfree86/common/xf86Module.h | 2
hw/xfree86/common/xf86Option.c | 7
hw/xfree86/common/xf86PM.c | 23
hw/xfree86/common/xf86Priv.h | 1
hw/xfree86/common/xf86ShowOpts.c | 10
hw/xfree86/common/xf86VGAarbiter.c | 5
hw/xfree86/common/xf86VGAarbiterPriv.h | 2
hw/xfree86/common/xf86VidMode.c | 2
hw/xfree86/common/xf86Xinput.c | 52
hw/xfree86/common/xf86pciBus.c | 4
hw/xfree86/common/xf86sbusBus.c | 6
hw/xfree86/common/xf86str.h | 7
hw/xfree86/common/xf86xv.c | 210
hw/xfree86/common/xf86xv.h | 3
hw/xfree86/common/xf86xvpriv.h | 6
hw/xfree86/ddc/ddc.c | 11
hw/xfree86/dixmods/extmod/dgaproc.h | 1
hw/xfree86/dixmods/extmod/modinit.c | 5
hw/xfree86/dixmods/extmod/modinit.h | 4
hw/xfree86/doc/Makefile.am | 4
hw/xfree86/doc/man/.gitignore | 4
hw/xfree86/doc/man/Makefile.am | 27
hw/xfree86/doc/man/Xorg.man | 689
hw/xfree86/doc/man/Xorg.man.pre | 689
hw/xfree86/doc/man/xorg.conf.d.man | 1
hw/xfree86/doc/man/xorg.conf.man | 2478 +++
hw/xfree86/doc/man/xorg.conf.man.pre | 2478 ---
hw/xfree86/dri/dri.c | 9
hw/xfree86/dri2/dri2.c | 13
hw/xfree86/exa/.gitignore | 2
hw/xfree86/exa/Makefile.am | 14
hw/xfree86/exa/exa.man.pre | 42
hw/xfree86/exa/man/Makefile.am | 2
hw/xfree86/exa/man/exa.man | 42
hw/xfree86/fbdevhw/.gitignore | 2
hw/xfree86/fbdevhw/Makefile.am | 14
hw/xfree86/fbdevhw/fbdevhw.c | 56
hw/xfree86/fbdevhw/fbdevhw.man.pre | 22
hw/xfree86/fbdevhw/man/Makefile.am | 2
hw/xfree86/fbdevhw/man/fbdevhw.man | 22
hw/xfree86/int10/helper_exec.c | 7
hw/xfree86/loader/loader.c | 20
hw/xfree86/loader/loadmod.c | 20
hw/xfree86/loader/os.c | 2
hw/xfree86/loader/sdksyms.sh | 7
hw/xfree86/modes/xf86Crtc.c | 11
hw/xfree86/modes/xf86EdidModes.c | 7
hw/xfree86/modes/xf86Modes.c | 37
hw/xfree86/modes/xf86cvt.c | 10
hw/xfree86/os-support/Makefile.am | 2
hw/xfree86/os-support/linux/lnx_agp.c | 2
hw/xfree86/os-support/linux/lnx_video.c | 2
hw/xfree86/os-support/sco/Makefile.am | 5
hw/xfree86/os-support/sco/VTsw_sco.c | 127
hw/xfree86/os-support/sco/sco_init.c | 294
hw/xfree86/os-support/sco/sco_iop.c | 90
hw/xfree86/os-support/sco/sco_video.c | 290
hw/xfree86/os-support/solaris/solaris-amd64.S | 2
hw/xfree86/os-support/solaris/solaris-ia32.S | 2
hw/xfree86/os-support/solaris/solaris-sparcv8plus.S | 2
hw/xfree86/os-support/solaris/sun_VTsw.c | 2
hw/xfree86/os-support/solaris/sun_agp.c | 2
hw/xfree86/os-support/solaris/sun_apm.c | 2
hw/xfree86/os-support/solaris/sun_bell.c | 2
hw/xfree86/os-support/solaris/sun_vid.c | 2
hw/xfree86/os-support/xf86_OSlib.h | 31
hw/xfree86/parser/Flags.c | 13
hw/xfree86/parser/Makefile.am | 8
hw/xfree86/parser/Pointer.c | 16
hw/xfree86/ramdac/Makefile.am | 4
hw/xfree86/utils/Makefile.am | 3
hw/xfree86/utils/cvt/.gitignore | 2
hw/xfree86/utils/cvt/Makefile.am | 15
hw/xfree86/utils/cvt/cvt.c | 18
hw/xfree86/utils/cvt/cvt.man.pre | 42
hw/xfree86/utils/gtf/.gitignore | 2
hw/xfree86/utils/gtf/Makefile.am | 19
hw/xfree86/utils/gtf/gtf.man.pre | 45
hw/xfree86/utils/man/Makefile.am | 2
hw/xfree86/utils/man/cvt.man | 42
hw/xfree86/utils/man/gtf.man | 45
hw/xfree86/vbe/vbeModes.c | 4
hw/xfree86/x86emu/ops.c | 63
hw/xfree86/xaa/Makefile.am | 52
hw/xfree86/xaa/xaaBitBlt.c | 6
hw/xfree86/xorgconf.cpp | 610
hw/xnest/.gitignore | 2
hw/xnest/Makefile.am | 26
hw/xnest/Xnest.man.pre | 428
hw/xnest/man/Makefile.am | 2
hw/xnest/man/Xnest.man | 428
hw/xquartz/GL/Makefile.am | 2
hw/xquartz/Makefile.am | 6
hw/xquartz/X11Application.h | 1
hw/xquartz/X11Application.m | 2
hw/xquartz/X11Controller.h | 1
hw/xquartz/X11Controller.m | 4
hw/xquartz/bundle/Info.plist.cpp | 8
hw/xquartz/bundle/Resources/Dutch.lproj/locversion.plist | 4
hw/xquartz/bundle/Resources/Dutch.lproj/main.nib/designable.nib | 440
hw/xquartz/bundle/Resources/Dutch.lproj/main.nib/keyedobjects.nib |binary
hw/xquartz/bundle/Resources/English.lproj/main.nib/designable.nib | 320
hw/xquartz/bundle/Resources/English.lproj/main.nib/keyedobjects.nib |binary
hw/xquartz/bundle/Resources/German.lproj/locversion.plist | 4
hw/xquartz/bundle/Resources/German.lproj/main.nib/designable.nib | 208
hw/xquartz/bundle/Resources/German.lproj/main.nib/keyedobjects.nib |binary
hw/xquartz/bundle/Resources/Italian.lproj/locversion.plist | 4
hw/xquartz/bundle/Resources/Italian.lproj/main.nib/designable.nib | 434
hw/xquartz/bundle/Resources/Italian.lproj/main.nib/keyedobjects.nib |binary
hw/xquartz/bundle/Resources/Japanese.lproj/locversion.plist | 4
hw/xquartz/bundle/Resources/Japanese.lproj/main.nib/designable.nib | 229
hw/xquartz/bundle/Resources/Japanese.lproj/main.nib/keyedobjects.nib |binary
hw/xquartz/bundle/Resources/Spanish.lproj/locversion.plist | 4
hw/xquartz/bundle/Resources/Spanish.lproj/main.nib/designable.nib | 441
hw/xquartz/bundle/Resources/Spanish.lproj/main.nib/keyedobjects.nib |binary
hw/xquartz/bundle/Resources/ar.lproj/locversion.plist | 4
hw/xquartz/bundle/Resources/ar.lproj/main.nib/designable.nib | 441
hw/xquartz/bundle/Resources/ar.lproj/main.nib/keyedobjects.nib |binary
hw/xquartz/bundle/Resources/da.lproj/locversion.plist | 4
hw/xquartz/bundle/Resources/da.lproj/main.nib/designable.nib | 402
hw/xquartz/bundle/Resources/da.lproj/main.nib/keyedobjects.nib |binary
hw/xquartz/bundle/Resources/fi.lproj/locversion.plist | 4
hw/xquartz/bundle/Resources/fi.lproj/main.nib/designable.nib | 209
hw/xquartz/bundle/Resources/fi.lproj/main.nib/keyedobjects.nib |binary
hw/xquartz/bundle/Resources/ko.lproj/locversion.plist | 4
hw/xquartz/bundle/Resources/ko.lproj/main.nib/designable.nib | 411
hw/xquartz/bundle/Resources/ko.lproj/main.nib/keyedobjects.nib |binary
hw/xquartz/bundle/Resources/no.lproj/locversion.plist | 4
hw/xquartz/bundle/Resources/no.lproj/main.nib/designable.nib | 448
hw/xquartz/bundle/Resources/no.lproj/main.nib/keyedobjects.nib |binary
hw/xquartz/bundle/Resources/pl.lproj/locversion.plist | 4
hw/xquartz/bundle/Resources/pl.lproj/main.nib/designable.nib | 418
hw/xquartz/bundle/Resources/pl.lproj/main.nib/keyedobjects.nib |binary
hw/xquartz/bundle/Resources/pt.lproj/locversion.plist | 4
hw/xquartz/bundle/Resources/pt.lproj/main.nib/designable.nib | 459
hw/xquartz/bundle/Resources/pt.lproj/main.nib/keyedobjects.nib |binary
hw/xquartz/bundle/Resources/pt_PT.lproj/locversion.plist | 4
hw/xquartz/bundle/Resources/pt_PT.lproj/main.nib/designable.nib | 198
hw/xquartz/bundle/Resources/pt_PT.lproj/main.nib/keyedobjects.nib |binary
hw/xquartz/bundle/Resources/ru.lproj/locversion.plist | 4
hw/xquartz/bundle/Resources/ru.lproj/main.nib/designable.nib | 424
hw/xquartz/bundle/Resources/ru.lproj/main.nib/keyedobjects.nib |binary
hw/xquartz/bundle/Resources/sv.lproj/locversion.plist | 4
hw/xquartz/bundle/Resources/sv.lproj/main.nib/designable.nib | 421
hw/xquartz/bundle/Resources/sv.lproj/main.nib/keyedobjects.nib |binary
hw/xquartz/bundle/Resources/zh_CN.lproj/Localizable.strings |binary
hw/xquartz/bundle/Resources/zh_CN.lproj/locversion.plist | 4
hw/xquartz/bundle/Resources/zh_CN.lproj/main.nib/designable.nib | 7106 ++++------
hw/xquartz/bundle/Resources/zh_CN.lproj/main.nib/keyedobjects.nib |binary
hw/xquartz/bundle/Resources/zh_TW.lproj/locversion.plist | 4
hw/xquartz/bundle/Resources/zh_TW.lproj/main.nib/designable.nib | 447
hw/xquartz/bundle/Resources/zh_TW.lproj/main.nib/keyedobjects.nib |binary
hw/xquartz/bundle/cpprules.in | 22
hw/xquartz/darwinEvents.c | 3
hw/xquartz/doc/Makefile.am | 16
hw/xquartz/doc/Xquartz.man.pre | 162
hw/xquartz/man/Makefile.am | 2
hw/xquartz/man/Xquartz.man | 162
hw/xquartz/quartz.c | 35
hw/xquartz/quartz.h | 1
hw/xquartz/quartzAudio.c | 329
hw/xquartz/quartzAudio.h | 37
hw/xquartz/quartzKeyboard.c | 1
hw/xquartz/quartzStartup.c | 4
hw/xwin/.gitignore | 3
hw/xwin/InitOutput.c | 13
hw/xwin/Makefile.am | 28
hw/xwin/XWin.man.pre | 346
hw/xwin/XWinrc.man.pre | 253
hw/xwin/man/Makefile.am | 3
hw/xwin/man/XWin.man | 397
hw/xwin/man/XWinrc.man | 253
hw/xwin/win.h | 63
hw/xwin/winclipboardxevents.c | 3
hw/xwin/winconfig.c | 77
hw/xwin/wincreatewnd.c | 48
hw/xwin/windialogs.c | 18
hw/xwin/winerror.c | 24
hw/xwin/winkeybd.c | 8
hw/xwin/winkeybd.h | 16
hw/xwin/winkeyhook.c | 4
hw/xwin/winkeynames.h | 13
hw/xwin/winlayouts.h | 8
hw/xwin/winmonitors.c | 92
hw/xwin/winmonitors.h | 14
hw/xwin/winnativegdi.c | 37
hw/xwin/winpfbdd.c | 108
hw/xwin/winprocarg.c | 131
hw/xwin/winrandr.c | 302
hw/xwin/winscrinit.c | 66
hw/xwin/winshaddd.c | 164
hw/xwin/winshadddnl.c | 152
hw/xwin/winshadgdi.c | 124
hw/xwin/winvalargs.c | 8
hw/xwin/winwindow.c | 1
hw/xwin/winwndproc.c | 307
include/Makefile.am | 1
include/Xprintf.h | 69
include/dix-config.h.in | 3
include/dix.h | 7
include/eventstr.h | 2
include/exevents.h | 4
include/input.h | 26
include/inputstr.h | 82
include/inpututils.h | 8
include/os.h | 13
include/resource.h | 2
include/scrnintstr.h | 7
include/windowstr.h | 3
m4/ax_tls.m4 | 74
manpages.am | 37
mi/micmap.c | 2
mi/micopy.c | 6
mi/miinitext.c | 2
mi/misprite.c | 122
miext/damage/Makefile.am | 2
miext/damage/damage.c | 20
miext/rootless/Makefile.am | 1
miext/rootless/rootlessScreen.c | 5
miext/shadow/Makefile.am | 2
miext/sync/misync.c | 1
os/WaitFor.c | 12
os/access.c | 36
os/connection.c | 1
os/log.c | 12
os/osdep.h | 4
os/osinit.c | 5
os/utils.c | 16
os/xprintf.c | 172
randr/rrdispatch.c | 2
randr/rrmode.c | 2
randr/rrscreen.c | 12
render/animcur.c | 26
render/mipict.c | 3
render/render.c | 14
test/input.c | 32
test/xi2/protocol-eventconvert.c | 12
test/xi2/protocol-xiselectevents.c | 18
xfixes/cursor.c | 4
xfixes/xfixes.c | 2
xfixes/xfixesint.h | 2
xkb/XKBMisc.c | 15
xkb/ddxList.c | 43
xkb/ddxLoad.c | 99
xkb/xkb.c | 23
xkb/xkbUtils.c | 9
347 files changed, 17051 insertions(+), 15788 deletions(-)
New commits:
commit 443d75446bcbe7d97a23860a1e2d46c0b7e7cb26
Author: Keith Packard <keithp@keithp.com>
Date: Fri Feb 18 14:46:33 2011 -0800
Version bumped to 1.9.99.902 (1.10 RC2)
Signed-off-by: Keith Packard <keithp@keithp.com>
diff --git a/configure.ac b/configure.ac
index 9b3e2be..ac4bf8c 100644
--- a/configure.ac
+++ b/configure.ac
@@ -26,8 +26,8 @@ dnl
dnl Process this file with autoconf to create configure.
AC_PREREQ(2.57)
-AC_INIT([xorg-server], 1.9.99.901, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
-RELEASE_DATE="2010-12-06"
+AC_INIT([xorg-server], 1.9.99.902, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
+RELEASE_DATE="2011-2-18"
AC_CONFIG_SRCDIR([Makefile.am])
AM_INIT_AUTOMAKE([foreign dist-bzip2])
AM_MAINTAINER_MODE
commit a73c28f0bdafb1c5cb8129179188a99c0ca052e2
Author: Justin Dou <Justin.Dou@intel.com>
Date: Thu Feb 10 16:27:29 2011 -0500
Replace malloc with calloc to initialize the buffers[] as NULL in do_get_buffers function
The calling for allocate_or_reuse_buffer may fail due to some reason, e.g. out of memory.
If the buffers[] were not initialized to be NULL, the following err_out may try to access an illegal memory, which will cause X crash afterward.
Reviewed-by: Kristian Høgsberg <krh@bitplanet.net>
Signed-off-by: Justin Dou <Justin.Dou@intel.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
diff --git a/hw/xfree86/dri2/dri2.c b/hw/xfree86/dri2/dri2.c
index 39996f9..9ca378f 100644
--- a/hw/xfree86/dri2/dri2.c
+++ b/hw/xfree86/dri2/dri2.c
@@ -403,7 +403,7 @@ do_get_buffers(DrawablePtr pDraw, int *width, int *height,
&& (pDraw->height == pPriv->height)
&& (pPriv->serialNumber == DRI2DrawableSerial(pDraw));
- buffers = malloc((count + 1) * sizeof(buffers[0]));
+ buffers = calloc((count + 1), sizeof(buffers[0]));
for (i = 0; i < count; i++) {
const unsigned attachment = *(attachments++);
commit 3bbb70a1a7b24d3d1375b20a13db7011cf961c86
Author: Peter Hutterer <peter.hutterer@who-t.net>
Date: Wed Feb 16 07:56:58 2011 +1000
xfree86: fix up an out-of-date comment.
InitInput simply initialises all input devices now.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
diff --git a/hw/xfree86/common/xf86Init.c b/hw/xfree86/common/xf86Init.c
index a1fda54..e664ce4 100644
--- a/hw/xfree86/common/xf86Init.c
+++ b/hw/xfree86/common/xf86Init.c
@@ -808,7 +808,7 @@ InitInput(int argc, char **argv)
GetEventList(&xf86Events);
- /* Call the PreInit function for each input device instance. */
+ /* Initialize all configured input devices */
for (pDev = xf86ConfigLayout.inputs; pDev && *pDev; pDev++) {
/* Replace obsolete keyboard driver with kbd */
if (!xf86NameCmp((*pDev)->driver, "keyboard")) {
commit 402b329c3aa8ddbebaa1f593306a02d4cd6fed26
Author: Julien Cristau <jcristau@debian.org>
Date: Sun Jan 23 13:35:54 2011 +0100
glx: Work around wrong request lengths sent by mesa
mesa used to send too long requests for GLXDestroyPixmap,
GLXDestroyWindow, GLXChangeDrawableAttributes, GLXGetDrawableAttributes
and GLXGetFBConfigsSGIX.
Fixes a regression introduced in ec9c97c6bf70b523bc500bd3adf62176f1bb33a4
X.Org bug#33324 <https://bugs.freedesktop.org/show_bug.cgi?id=33324>
Reported-by: xunx.fang@intel.com
Signed-off-by: Julien Cristau <jcristau@debian.org>
Reviewed-by: Adam Jackson <ajax@redhat.com>
diff --git a/glx/glxcmds.c b/glx/glxcmds.c
index 5d633df..9b4bc9e 100644
--- a/glx/glxcmds.c
+++ b/glx/glxcmds.c
@@ -1132,7 +1132,8 @@ int __glXDisp_GetFBConfigsSGIX(__GLXclientState *cl, GLbyte *pc)
{
ClientPtr client = cl->client;
xGLXGetFBConfigsSGIXReq *req = (xGLXGetFBConfigsSGIXReq *) pc;
- REQUEST_SIZE_MATCH(xGLXGetFBConfigsSGIXReq);
+ /* work around mesa bug, don't use REQUEST_SIZE_MATCH */
+ REQUEST_AT_LEAST_SIZE(xGLXGetFBConfigsSGIXReq);
return DoGetFBConfigs(cl, req->screen);
}
@@ -1356,7 +1357,9 @@ int __glXDisp_DestroyPixmap(__GLXclientState *cl, GLbyte *pc)
ClientPtr client = cl->client;
xGLXDestroyPixmapReq *req = (xGLXDestroyPixmapReq *) pc;
- REQUEST_SIZE_MATCH(xGLXDestroyPixmapReq);
+ /* should be REQUEST_SIZE_MATCH, but mesa's glXDestroyPixmap used to set
+ * length to 3 instead of 2 */
+ REQUEST_AT_LEAST_SIZE(xGLXDestroyPixmapReq);
return DoDestroyDrawable(cl, req->glxpixmap, GLX_DRAWABLE_PIXMAP);
}
@@ -1498,7 +1501,13 @@ int __glXDisp_ChangeDrawableAttributes(__GLXclientState *cl, GLbyte *pc)
client->errorValue = req->numAttribs;
return BadValue;
}
+#if 0
+ /* mesa sends an additional 8 bytes */
REQUEST_FIXED_SIZE(xGLXChangeDrawableAttributesReq, req->numAttribs << 3);
+#else
+ if (((sizeof(xGLXChangeDrawableAttributesReq) + (req->numAttribs << 3)) >> 2) < client->req_len)
+ return BadLength;
+#endif
return DoChangeDrawableAttributes(cl->client, req->drawable,
req->numAttribs, (CARD32 *) (req + 1));
@@ -1563,7 +1572,8 @@ int __glXDisp_DestroyWindow(__GLXclientState *cl, GLbyte *pc)
ClientPtr client = cl->client;
xGLXDestroyWindowReq *req = (xGLXDestroyWindowReq *) pc;
- REQUEST_SIZE_MATCH(xGLXDestroyWindowReq);
+ /* mesa's glXDestroyWindow used to set length to 3 instead of 2 */
+ REQUEST_AT_LEAST_SIZE(xGLXDestroyWindowReq);
return DoDestroyDrawable(cl, req->glxwindow, GLX_DRAWABLE_WINDOW);
}
@@ -1872,7 +1882,8 @@ int __glXDisp_GetDrawableAttributes(__GLXclientState *cl, GLbyte *pc)
ClientPtr client = cl->client;
xGLXGetDrawableAttributesReq *req = (xGLXGetDrawableAttributesReq *)pc;
- REQUEST_SIZE_MATCH(xGLXGetDrawableAttributesReq);
+ /* this should be REQUEST_SIZE_MATCH, but mesa sends an additional 4 bytes */
+ REQUEST_AT_LEAST_SIZE(xGLXGetDrawableAttributesReq);
return DoGetDrawableAttributes(cl, req->drawable);
}
diff --git a/glx/glxcmdsswap.c b/glx/glxcmdsswap.c
index d58de62..76e6fb6 100644
--- a/glx/glxcmdsswap.c
+++ b/glx/glxcmdsswap.c
@@ -279,7 +279,7 @@ int __glXDispSwap_GetFBConfigsSGIX(__GLXclientState *cl, GLbyte *pc)
xGLXGetFBConfigsSGIXReq *req = (xGLXGetFBConfigsSGIXReq *) pc;
__GLX_DECLARE_SWAP_VARIABLES;
- REQUEST_SIZE_MATCH(xGLXGetFBConfigsSGIXReq);
+ REQUEST_AT_LEAST_SIZE(xGLXGetFBConfigsSGIXReq);
__GLX_SWAP_INT(&req->screen);
return __glXDisp_GetFBConfigsSGIX(cl, pc);
@@ -368,7 +368,7 @@ int __glXDispSwap_DestroyPixmap(__GLXclientState *cl, GLbyte *pc)
xGLXDestroyGLXPixmapReq *req = (xGLXDestroyGLXPixmapReq *) pc;
__GLX_DECLARE_SWAP_VARIABLES;
- REQUEST_SIZE_MATCH(xGLXDestroyGLXPixmapReq);
+ REQUEST_AT_LEAST_SIZE(xGLXDestroyGLXPixmapReq);
__GLX_SWAP_SHORT(&req->length);
__GLX_SWAP_INT(&req->glxpixmap);
@@ -476,7 +476,9 @@ int __glXDispSwap_ChangeDrawableAttributes(__GLXclientState *cl, GLbyte *pc)
client->errorValue = req->numAttribs;
return BadValue;
}
- REQUEST_FIXED_SIZE(xGLXChangeDrawableAttributesReq, req->numAttribs << 3);
+ if (((sizeof(xGLXChangeDrawableAttributesReq) + (req->numAttribs << 3)) >> 2) < client->req_len)
+ return BadLength;
+
attribs = (CARD32*)(req + 1);
__GLX_SWAP_INT_ARRAY(attribs, req->numAttribs << 1);
@@ -542,7 +544,7 @@ int __glXDispSwap_DestroyWindow(__GLXclientState *cl, GLbyte *pc)
xGLXDestroyWindowReq *req = (xGLXDestroyWindowReq *) pc;
__GLX_DECLARE_SWAP_VARIABLES;
- REQUEST_SIZE_MATCH(xGLXDestroyWindowReq);
+ REQUEST_AT_LEAST_SIZE(xGLXDestroyWindowReq);
__GLX_SWAP_INT(&req->glxwindow);
@@ -742,7 +744,7 @@ int __glXDispSwap_GetDrawableAttributes(__GLXclientState *cl, GLbyte *pc)
xGLXGetDrawableAttributesReq *req = (xGLXGetDrawableAttributesReq *)pc;
__GLX_DECLARE_SWAP_VARIABLES;
- REQUEST_SIZE_MATCH(xGLXGetDrawableAttributesReq);
+ REQUEST_AT_LEAST_SIZE(xGLXGetDrawableAttributesReq);
__GLX_SWAP_SHORT(&req->length);
__GLX_SWAP_INT(&req->drawable);
commit 1137c11be0f82049d28024eaf963c6f76e0d4334
Author: Julien Cristau <jcristau@debian.org>
Date: Wed Jan 26 13:06:53 2011 +0100
glx: fix BindTexImageEXT length check
The request is followed by a list of attributes.
X.Org bug#33449
Reported-and-tested-by: meng <mengmeng.meng@intel.com>
Signed-off-by: Julien Cristau <jcristau@debian.org>
Reviewed-by: Adam Jackson <ajax@redhat.com>
diff --git a/glx/glxcmds.c b/glx/glxcmds.c
index 0b375c3..5d633df 100644
--- a/glx/glxcmds.c
+++ b/glx/glxcmds.c
@@ -1697,13 +1697,21 @@ int __glXDisp_BindTexImageEXT(__GLXclientState *cl, GLbyte *pc)
GLXDrawable drawId;
int buffer;
int error;
+ CARD32 num_attribs;
- REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 8);
+ if ((sizeof(xGLXVendorPrivateReq) + 12) >> 2 > client->req_len)
+ return BadLength;
pc += __GLX_VENDPRIV_HDR_SIZE;
drawId = *((CARD32 *) (pc));
buffer = *((INT32 *) (pc + 4));
+ num_attribs = *((CARD32 *) (pc + 8));
+ if (num_attribs > (UINT32_MAX >> 3)) {
+ client->errorValue = num_attribs;
+ return BadValue;
+ }
+ REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 12 + (num_attribs << 3));
if (buffer != GLX_FRONT_LEFT_EXT)
return __glXError(GLXBadPixmap);
diff --git a/glx/glxcmdsswap.c b/glx/glxcmdsswap.c
index 9d96c9d..d58de62 100644
--- a/glx/glxcmdsswap.c
+++ b/glx/glxcmdsswap.c
@@ -648,19 +648,23 @@ int __glXDispSwap_BindTexImageEXT(__GLXclientState *cl, GLbyte *pc)
xGLXVendorPrivateReq *req = (xGLXVendorPrivateReq *) pc;
GLXDrawable *drawId;
int *buffer;
+ CARD32 *num_attribs;
__GLX_DECLARE_SWAP_VARIABLES;
- REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 8);
+ if ((sizeof(xGLXVendorPrivateReq) + 12) >> 2 > client->req_len)
+ return BadLength;
pc += __GLX_VENDPRIV_HDR_SIZE;
drawId = ((GLXDrawable *) (pc));
buffer = ((int *) (pc + 4));
+ num_attribs = ((CARD32 *) (pc + 8));
__GLX_SWAP_SHORT(&req->length);
__GLX_SWAP_INT(&req->contextTag);
__GLX_SWAP_INT(drawId);
__GLX_SWAP_INT(buffer);
+ __GLX_SWAP_INT(num_attribs);
return __glXDisp_BindTexImageEXT(cl, (GLbyte *)pc);
}
commit a883cf1545abd89bb2cadfa659718884b56fd234
Author: Julien Cristau <jcristau@debian.org>
Date: Sun Jan 23 17:05:26 2011 +0100
glx: fix request length check for CreateGLXPbufferSGIX
The request is followed by an attribute list.
Signed-off-by: Julien Cristau <jcristau@debian.org>
Reviewed-by: Adam Jackson <ajax@redhat.com>
diff --git a/glx/glxcmds.c b/glx/glxcmds.c
index 3ef567d..0b375c3 100644
--- a/glx/glxcmds.c
+++ b/glx/glxcmds.c
@@ -1436,7 +1436,7 @@ int __glXDisp_CreateGLXPbufferSGIX(__GLXclientState *cl, GLbyte *pc)
ClientPtr client = cl->client;
xGLXCreateGLXPbufferSGIXReq *req = (xGLXCreateGLXPbufferSGIXReq *) pc;
- REQUEST_SIZE_MATCH(xGLXCreateGLXPbufferSGIXReq);
+ REQUEST_AT_LEAST_SIZE(xGLXCreateGLXPbufferSGIXReq);
return DoCreatePbuffer(cl->client, req->screen, req->fbconfig,
req->width, req->height, req->pbuffer);
diff --git a/glx/glxcmdsswap.c b/glx/glxcmdsswap.c
index 3bb4cad..9d96c9d 100644
--- a/glx/glxcmdsswap.c
+++ b/glx/glxcmdsswap.c
@@ -421,7 +421,7 @@ int __glXDispSwap_CreateGLXPbufferSGIX(__GLXclientState *cl, GLbyte *pc)
xGLXCreateGLXPbufferSGIXReq *req = (xGLXCreateGLXPbufferSGIXReq *) pc;
__GLX_DECLARE_SWAP_VARIABLES;
- REQUEST_SIZE_MATCH(xGLXCreateGLXPbufferSGIXReq);
+ REQUEST_AT_LEAST_SIZE(xGLXCreateGLXPbufferSGIXReq);
__GLX_SWAP_INT(&req->screen);
__GLX_SWAP_INT(&req->fbconfig);
commit c9f7b303a36ca501c6ecf1196c266ee8e8f49d2d
Author: Peter Hutterer <peter.hutterer@who-t.net>
Date: Fri Feb 11 13:50:10 2011 +1000
xfixes: calloc, not malloc the cursorScreenRec
Debugging NULL pointers is significantly easier than random memory.
Plus, if new fields (such as pointer barriers) are added they may just be
properly initialised.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
diff --git a/xfixes/cursor.c b/xfixes/cursor.c
index 54e5d75..fb608f6 100644
--- a/xfixes/cursor.c
+++ b/xfixes/cursor.c
@@ -1045,7 +1045,7 @@ XFixesCursorInit (void)
ScreenPtr pScreen = screenInfo.screens[i];
CursorScreenPtr cs;
- cs = (CursorScreenPtr) malloc(sizeof (CursorScreenRec));
+ cs = (CursorScreenPtr) calloc(1, sizeof (CursorScreenRec));
if (!cs)
return FALSE;
Wrap (cs, pScreen, CloseScreen, CursorCloseScreen);
commit d3499556d8d83396fa2585bd00371a81e086be36
Author: Peter Hutterer <peter.hutterer@who-t.net>
Date: Thu Feb 10 15:12:14 2011 +1000
xkb: if the keymap failed to compile, load the default keymap instead.
We really need symbols, compat, keynames, vmods and types for a sensible keymap.
Try this in your xorg.conf.d snippets for all keyboards:
Option "XkbLayout" "us"
Option "XkbVariant" "nodeadkeys"
us(nodeadkeys) doesn't exist so xkbcomp provides everything but the symbols
map. We say we want everything but don't _need_ anything, the server happily
gives us a keymap with every key mapped to NoSymbol. This in turn isn't what
we want after all.
So instead, require symbols, compat, keynames, vmods and types from the
keymap and if that fails, load the default keymap instead. If that fails
too, all bets are off.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Dan Nicholson <dbn.lists@gmail.com>
diff --git a/xkb/ddxLoad.c b/xkb/ddxLoad.c
index b968c43..ac587fc 100644
--- a/xkb/ddxLoad.c
+++ b/xkb/ddxLoad.c
@@ -470,13 +470,34 @@ XkbDescPtr
XkbCompileKeymap(DeviceIntPtr dev, XkbRMLVOSet *rmlvo)
{
XkbDescPtr xkb;
+ unsigned int need;
if (!dev || !rmlvo) {
LogMessage(X_ERROR, "XKB: No device or RMLVO specified\n");
return NULL;
}
- xkb = XkbCompileKeymapForDevice(dev, rmlvo, 0);
+ /* These are the components we really really need */
+ need = XkmSymbolsMask | XkmCompatMapMask | XkmTypesMask |
+ XkmKeyNamesMask | XkmVirtualModsMask;
+
+
+ xkb = XkbCompileKeymapForDevice(dev, rmlvo, need);
+
+ if (!xkb) {
+ XkbRMLVOSet dflts;
+
+ /* we didn't get what we really needed. And that will likely leave
+ * us with a keyboard that doesn't work. Use the defaults instead */
+ LogMessage(X_ERROR, "XKB: Failed to load keymap. Loading default "
+ "keymap instead.\n");
+
+ XkbGetRulesDflts(&dflts);
+
+ xkb = XkbCompileKeymapForDevice(dev, &dflts, 0);
+
+ XkbFreeRMLVOSet(&dflts, FALSE);
+ }
return xkb;
}
commit 47d1d2fed656c3a3b2600491078da90962c46934
Author: Peter Hutterer <peter.hutterer@who-t.net>
Date: Thu Feb 10 15:11:34 2011 +1000
xkb: split out keymap compilation.
Refactoring for simpler double-use in the next patch. No functional changes.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Dan Nicholson <dbn.lists@gmail.com>
diff --git a/xkb/ddxLoad.c b/xkb/ddxLoad.c
index 51b5777..b968c43 100644
--- a/xkb/ddxLoad.c
+++ b/xkb/ddxLoad.c
@@ -425,35 +425,58 @@ XkbRF_RulesPtr rules;
return complete;
}
-XkbDescPtr
-XkbCompileKeymap(DeviceIntPtr dev, XkbRMLVOSet *rmlvo)
+static Bool
+XkbRMLVOtoKcCGST(DeviceIntPtr dev, XkbRMLVOSet *rmlvo, XkbComponentNamesPtr kccgst)
{
- XkbComponentNamesRec kccgst;
XkbRF_VarDefsRec mlvo;
- XkbDescPtr xkb;
- char name[PATH_MAX];
-
- if (!dev || !rmlvo) {
- LogMessage(X_ERROR, "XKB: No device or RMLVO specified\n");
- return NULL;
- }
mlvo.model = rmlvo->model;
mlvo.layout = rmlvo->layout;
mlvo.variant = rmlvo->variant;
mlvo.options = rmlvo->options;
- /* XDNFR already logs for us. */
- if (!XkbDDXNamesFromRules(dev, rmlvo->rules, &mlvo, &kccgst))
+ return XkbDDXNamesFromRules(dev, rmlvo->rules, &mlvo, kccgst);
+}
+
+/**
+ * Compile the given RMLVO keymap and return it. Returns the XkbDescPtr on
+ * success or NULL on failure. If the components compiled are not a superset
+ * or equal to need, the compiliation is treated as failure.
+ */
+static XkbDescPtr
+XkbCompileKeymapForDevice(DeviceIntPtr dev, XkbRMLVOSet *rmlvo, int need)
+{
+ XkbDescPtr xkb;
+ unsigned int provided;
+ XkbComponentNamesRec kccgst;
+ char name[PATH_MAX];
+
+ if (!XkbRMLVOtoKcCGST(dev, rmlvo, &kccgst))
return NULL;
- /* XDLKBN too, but it might return 0 as well as allocating. */
- if (!XkbDDXLoadKeymapByNames(dev, &kccgst, XkmAllIndicesMask, 0, &xkb, name,
- PATH_MAX)) {
- if (xkb)
+ provided = XkbDDXLoadKeymapByNames(dev, &kccgst, XkmAllIndicesMask, need,
+ &xkb, name, PATH_MAX);
+ if ((need & provided) != need) {
+ if (xkb) {
XkbFreeKeyboard(xkb, 0, TRUE);
+ xkb = NULL;
+ }
+ }
+
+ return xkb;
+}
+
+XkbDescPtr
+XkbCompileKeymap(DeviceIntPtr dev, XkbRMLVOSet *rmlvo)
+{
+ XkbDescPtr xkb;
+
+ if (!dev || !rmlvo) {
+ LogMessage(X_ERROR, "XKB: No device or RMLVO specified\n");
return NULL;
}
+ xkb = XkbCompileKeymapForDevice(dev, rmlvo, 0);
+
return xkb;
}
commit 787ba25a8a3af52b38448a1a6f8c9704ea8b7905
Author: Carlos Garnacho <carlosg@gnome.org>
Date: Mon Feb 7 18:21:31 2011 +0100
Xi: make XIQueryPointer return the current modifiers/group as documented.
The previous XKB info was being returned instead of the current
one, producing inconsistent results between the latest events
and the modifiers/group returned by this call.
Signed-off-by: Carlos Garnacho <carlosg@gnome.org>
Reviewed-by: Daniel Stone <daniel@fooishbar.org>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>`
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
diff --git a/Xi/xiquerypointer.c b/Xi/xiquerypointer.c
index b521c48..8df958e 100644
--- a/Xi/xiquerypointer.c
+++ b/Xi/xiquerypointer.c
@@ -129,7 +129,7 @@ ProcXIQueryPointer(ClientPtr client)
if (kbd)
{
- state = &kbd->key->xkbInfo->prev_state;
+ state = &kbd->key->xkbInfo->state;
rep.mods.base_mods = state->base_mods;
rep.mods.latched_mods = state->latched_mods;
rep.mods.locked_mods = state->locked_mods;
commit 85f9017393c9bb19553e9afcf554673a44a09993
Author: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira@nokia.com>
Date: Tue Feb 8 11:10:10 2011 +0200
ProcXkbGetXkbByName: fix use of uninitialised bytes valgrind error.
==9999== Syscall param writev(vector[...]) points to uninitialised byte(s)
==9999== at 0x4AB5154: writev (writev.c:51)
==9999== by 0x7C7C3: _XSERVTransWritev (Xtrans.c:912)
==9999== by 0x61C8B: FlushClient (io.c:924)
==9999== by 0x62423: WriteToClient (io.c:846)
==9999== by 0xCE39B: XkbSendMap (xkb.c:1408)
==9999== by 0xD247B: ProcXkbGetKbdByName (xkb.c:5814)
==9999== by 0x4AB53: Dispatch (dispatch.c:432)
==9999== by 0x205BF: main (main.c:291)
==9999== Address 0x557eb68 is 40 bytes inside a block of size 4,096 alloc'd
==9999== at 0x48334A4: calloc (vg_replace_malloc.c:467)
==9999== by 0x62567: WriteToClient (io.c:1065)
==9999== by 0x452EB: ProcEstablishConnection (dispatch.c:3685)
==9999== by 0x4AB53: Dispatch (dispatch.c:432)
==9999== by 0x205BF: main (main.c:291)
==9999== Uninitialised value was created by a stack allocation
==9999== at 0xD1910: ProcXkbGetKbdByName (xkb.c:5559)
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Oliver McFadden <oliver.mcfadden@nokia.com>
Signed-off-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira@nokia.com>
diff --git a/xkb/xkb.c b/xkb/xkb.c
index a2cbbf3..a57139f 100644
--- a/xkb/xkb.c
+++ b/xkb/xkb.c
@@ -5569,13 +5569,13 @@ ProcXkbGetKbdByName(ClientPtr client)
{
DeviceIntPtr dev;
DeviceIntPtr tmpd;
- xkbGetKbdByNameReply rep;
- xkbGetMapReply mrep;
- xkbGetCompatMapReply crep;
- xkbGetIndicatorMapReply irep;
- xkbGetNamesReply nrep;
- xkbGetGeometryReply grep;
- XkbComponentNamesRec names;
+ xkbGetKbdByNameReply rep = {0};
+ xkbGetMapReply mrep = {0};
+ xkbGetCompatMapReply crep = {0};
+ xkbGetIndicatorMapReply irep = {0};
+ xkbGetNamesReply nrep = {0};
+ xkbGetGeometryReply grep = {0};
+ XkbComponentNamesRec names = {0};
XkbDescPtr xkb, new;
unsigned char * str;
char mapFile[PATH_MAX];
commit 8a34d7a8532c7ca013e67307f3baf200167abb92
Author: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira@nokia.com>
Date: Tue Feb 8 11:10:11 2011 +0200
XkbSendNames: fix use of uninitialised bytes valgrind error.
==537== Syscall param writev(vector[...]) points to uninitialised byte(s)
==537== at 0x4AB7154: writev (writev.c:51)
==537== by 0x8935B: _XSERVTransWritev (Xtrans.c:912)
==537== by 0x6C55F: FlushClient (io.c:924)
==537== by 0x6CCF3: WriteToClient (io.c:846)
==537== by 0xD51D3: XkbSendNames (xkb.c:3765)
==537== by 0xD8183: ProcXkbGetKbdByName (xkb.c:5825)
==537== by 0x27B7B: Dispatch (dispatch.c:432)
==537== by 0x205B7: main (main.c:291)
==537== Address 0x55899f2 is 154 bytes inside a block of size 1,896 alloc'd
==537== at 0x4834C48: malloc (vg_replace_malloc.c:236)
==537== by 0xD47AF: XkbSendNames (xkb.c:3642)
==537== by 0xD8183: ProcXkbGetKbdByName (xkb.c:5825)
==537== by 0x27B7B: Dispatch (dispatch.c:432)
==537== by 0x205B7: main (main.c:291)
==537== Uninitialised value was created by a heap allocation
==537== at 0x4834C48: malloc (vg_replace_malloc.c:236)
==537== by 0xD47AF: XkbSendNames (xkb.c:3642)
==537== by 0xD8183: ProcXkbGetKbdByName (xkb.c:5825)
==537== by 0x27B7B: Dispatch (dispatch.c:432)
==537== by 0x205B7: main (main.c:291)
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Oliver McFadden <oliver.mcfadden@nokia.com>
Signed-off-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira@nokia.com>
diff --git a/xkb/xkb.c b/xkb/xkb.c
index 6fd66c5..a2cbbf3 100644
--- a/xkb/xkb.c
+++ b/xkb/xkb.c
@@ -3644,7 +3644,7 @@ register int n;
swapl(&rep->indicators,n);
}
- start = desc = malloc(length);
+ start = desc = calloc(1, length);
if ( !start )
return BadAlloc;
if (xkb->names) {
commit 87fbef9157a6f1e1318382e368d27942d7ad72ab
Author: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira@nokia.com>
Date: Tue Feb 8 11:10:09 2011 +0200
ProcRRCreateMode: fix use of uninitialised bytes valgrind error.
==543== Syscall param writev(vector[...]) points to uninitialised byte(s)
==543== at 0x4AB7154: writev (writev.c:51)
==543== by 0x8935B: _XSERVTransWritev (Xtrans.c:912)
==543== by 0x6C55F: FlushClient (io.c:924)
==543== by 0x6D013: FlushAllOutput (io.c:668)
==543== by 0x27A83: Dispatch (dispatch.c:453)
==543== by 0x205B7: main (main.c:291)
==543== Address 0x556dc8c is 12 bytes inside a block of size 4,096 alloc'd
==543== at 0x48334A4: calloc (vg_replace_malloc.c:467)
==543== by 0x6CE37: WriteToClient (io.c:1065)
==543== by 0x223A7: ProcEstablishConnection (dispatch.c:3685)
==543== by 0x27B7B: Dispatch (dispatch.c:432)
==543== by 0x205B7: main (main.c:291)
==543== Uninitialised value was created by a stack allocation
==543== at 0xA3350: ProcRRCreateMode (rrmode.c:289)
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Oliver McFadden <oliver.mcfadden@nokia.com>
Signed-off-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira@nokia.com>
Reply to: