[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

libxrandr: Changes to 'upstream-unstable'



 AUTHORS                         |    2 
 COPYING                         |    4 
 Makefile.am                     |    8 
 autogen.sh                      |    4 
 configure.ac                    |   11 -
 include/X11/extensions/Xrandr.h |  137 +++++++++++++--
 src/Makefile.am                 |    8 
 src/Xrandr.c                    |   85 ++++++++-
 src/Xrandrint.h                 |   21 +-
 src/XrrConfig.c                 |   44 ++--
 src/XrrCrtc.c                   |   32 +--
 src/XrrMode.c                   |   10 -
 src/XrrOutput.c                 |   21 +-
 src/XrrProperty.c               |   56 ++++--
 src/XrrProvider.c               |  217 ++++++++++++++++++++++++
 src/XrrProviderProperty.c       |  355 ++++++++++++++++++++++++++++++++++++++++
 src/XrrScreen.c                 |   16 -
 17 files changed, 903 insertions(+), 128 deletions(-)

New commits:
commit f97d44f8fb9f90ce3227cca8affd3b947e9b08ca
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date:   Fri May 31 15:52:23 2013 -0700

    libXrandr 1.4.1
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>

diff --git a/configure.ac b/configure.ac
index 8466999..6776233 100644
--- a/configure.ac
+++ b/configure.ac
@@ -29,7 +29,7 @@ AC_PREREQ([2.60])
 # digit in the version number to track changes which don't affect the
 # protocol, so Xrandr version l.n.m corresponds to protocol version l.n
 #
-AC_INIT([libXrandr], [1.4.0],
+AC_INIT([libXrandr], [1.4.1],
         [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], [libXrandr])
 AC_CONFIG_SRCDIR([Makefile.am])
 AC_CONFIG_HEADERS([config.h])

commit c90f74497dbcb96854346435349c6e2207b530c5
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date:   Sat May 4 21:47:50 2013 -0700

    Make XRRGet*Property() always initialize returned values
    
    Avoids memory corruption and other errors when callers access them
    without checking to see if the calls returned an error value.
    
    Callers are still required to check for errors, this just reduces the
    damage when they don't.
    
    (Same as reported against libX11 XGetWindowProperty by Ilja Van Sprundel)
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>

diff --git a/src/XrrProperty.c b/src/XrrProperty.c
index 707a28d..2096c56 100644
--- a/src/XrrProperty.c
+++ b/src/XrrProperty.c
@@ -259,6 +259,13 @@ XRRGetOutputProperty (Display *dpy, RROutput output,
     xRRGetOutputPropertyReq	*req;
     unsigned long		nbytes, rbytes;
 
+    /* Always initialize return values, in case callers fail to initialize
+       them and fail to check the return code for an error. */
+    *actual_type = None;
+    *actual_format = 0;
+    *nitems = *bytes_after = 0L;
+    *prop = (unsigned char *) NULL;
+
     RRCheckExtension (dpy, info, 1);
 
     LockDisplay (dpy);
@@ -280,7 +287,6 @@ XRRGetOutputProperty (Display *dpy, RROutput output,
 	return ((xError *)&rep)->errorCode;
     }
 
-    *prop = (unsigned char *) NULL;
     if (rep.propertyType != None) {
 	int format = rep.format;
 
diff --git a/src/XrrProviderProperty.c b/src/XrrProviderProperty.c
index 6989580..34cc082 100644
--- a/src/XrrProviderProperty.c
+++ b/src/XrrProviderProperty.c
@@ -259,6 +259,13 @@ XRRGetProviderProperty (Display *dpy, RRProvider provider,
     xRRGetProviderPropertyReq	*req;
     unsigned long		nbytes, rbytes;
 
+    /* Always initialize return values, in case callers fail to initialize
+       them and fail to check the return code for an error. */
+    *actual_type = None;
+    *actual_format = 0;
+    *nitems = *bytes_after = 0L;
+    *prop = (unsigned char *) NULL;
+
     RRCheckExtension (dpy, info, 1);
 
     LockDisplay (dpy);
@@ -280,7 +287,6 @@ XRRGetProviderProperty (Display *dpy, RRProvider provider,
 	return ((xError *)&rep)->errorCode;
     }
 
-    *prop = (unsigned char *) NULL;
     if (rep.propertyType != None) {
 	int format = rep.format;
 

commit 4254bf0ee4c7a8f9d03841cf0d8e16cbb201dfbd
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date:   Sat May 4 21:37:49 2013 -0700

    integer overflow in XRRGetProviderProperty() [CVE-2013-1986 4/4]
    
    If the reported number of properties is too large, the calculations
    to allocate memory for them may overflow, leaving us returning less
    memory to the caller than implied by the value written to *nitems.
    
    (Same as reported against libX11 XGetWindowProperty by Ilja Van Sprundel)
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>

diff --git a/src/XrrProviderProperty.c b/src/XrrProviderProperty.c
index dc699f6..6989580 100644
--- a/src/XrrProviderProperty.c
+++ b/src/XrrProviderProperty.c
@@ -257,7 +257,7 @@ XRRGetProviderProperty (Display *dpy, RRProvider provider,
     XExtDisplayInfo		*info = XRRFindDisplay(dpy);
     xRRGetProviderPropertyReply	rep;
     xRRGetProviderPropertyReq	*req;
-    long    			nbytes, rbytes;
+    unsigned long		nbytes, rbytes;
 
     RRCheckExtension (dpy, info, 1);
 
@@ -282,34 +282,40 @@ XRRGetProviderProperty (Display *dpy, RRProvider provider,
 
     *prop = (unsigned char *) NULL;
     if (rep.propertyType != None) {
+	int format = rep.format;
+
+	/*
+	 * Protect against both integer overflow and just plain oversized
+	 * memory allocation - no server should ever return this many props.
+	 */
+	if (rep.nItems >= (INT_MAX >> 4))
+	    format = -1;        /* fall through to default error case */
+
 	/*
 	 * One extra byte is malloced than is needed to contain the property
 	 * data, but this last byte is null terminated and convenient for
 	 * returning string properties, so the client doesn't then have to
 	 * recopy the string to make it null terminated.
 	 */
-	switch (rep.format) {
+	switch (format) {
 	case 8:
 	    nbytes = rep.nItems;
 	    rbytes = rep.nItems + 1;
-	    if (rbytes > 0 &&
-		(*prop = (unsigned char *) Xmalloc ((unsigned)rbytes)))
+	    if (rbytes > 0 && (*prop = Xmalloc (rbytes)))
 		_XReadPad (dpy, (char *) *prop, nbytes);
 	    break;
 
 	case 16:
 	    nbytes = rep.nItems << 1;
 	    rbytes = rep.nItems * sizeof (short) + 1;
-	    if (rbytes > 0 &&
-		(*prop = (unsigned char *) Xmalloc ((unsigned)rbytes)))
+	    if (rbytes > 0 && (*prop = Xmalloc (rbytes)))
 		_XRead16Pad (dpy, (short *) *prop, nbytes);
 	    break;
 
 	case 32:
 	    nbytes = rep.nItems << 2;
 	    rbytes = rep.nItems * sizeof (long) + 1;
-	    if (rbytes > 0 &&
-		(*prop = (unsigned char *) Xmalloc ((unsigned)rbytes)))
+	    if (rbytes > 0 && (*prop = Xmalloc (rbytes)))
 		_XRead32 (dpy, (long *) *prop, nbytes);
 	    break;
 

commit 289a1927949e6f278c18d115772e454837702e35
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date:   Sat May 4 21:37:49 2013 -0700

    integer overflow in XRRGetOutputProperty() [CVE-2013-1986 3/4]
    
    If the reported number of properties is too large, the calculations
    to allocate memory for them may overflow, leaving us returning less
    memory to the caller than implied by the value written to *nitems.
    
    (Same as reported against libX11 XGetWindowProperty by Ilja Van Sprundel)
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>

diff --git a/src/XrrProperty.c b/src/XrrProperty.c
index 50382bf..707a28d 100644
--- a/src/XrrProperty.c
+++ b/src/XrrProperty.c
@@ -257,7 +257,7 @@ XRRGetOutputProperty (Display *dpy, RROutput output,
     XExtDisplayInfo		*info = XRRFindDisplay(dpy);
     xRRGetOutputPropertyReply	rep;
     xRRGetOutputPropertyReq	*req;
-    long    			nbytes, rbytes;
+    unsigned long		nbytes, rbytes;
 
     RRCheckExtension (dpy, info, 1);
 
@@ -282,34 +282,40 @@ XRRGetOutputProperty (Display *dpy, RROutput output,
 
     *prop = (unsigned char *) NULL;
     if (rep.propertyType != None) {
+	int format = rep.format;
+
+	/*
+	 * Protect against both integer overflow and just plain oversized
+	 * memory allocation - no server should ever return this many props.
+	 */
+	if (rep.nItems >= (INT_MAX >> 4))
+	    format = -1;        /* fall through to default error case */
+
 	/*
 	 * One extra byte is malloced than is needed to contain the property
 	 * data, but this last byte is null terminated and convenient for
 	 * returning string properties, so the client doesn't then have to
 	 * recopy the string to make it null terminated.
 	 */
-	switch (rep.format) {
+	switch (format) {
 	case 8:
 	    nbytes = rep.nItems;
 	    rbytes = rep.nItems + 1;
-	    if (rbytes > 0 &&
-		(*prop = (unsigned char *) Xmalloc ((unsigned)rbytes)))
+	    if (rbytes > 0 && (*prop = Xmalloc (rbytes)))
 		_XReadPad (dpy, (char *) *prop, nbytes);
 	    break;
 
 	case 16:
 	    nbytes = rep.nItems << 1;
 	    rbytes = rep.nItems * sizeof (short) + 1;
-	    if (rbytes > 0 &&
-		(*prop = (unsigned char *) Xmalloc ((unsigned)rbytes)))
+	    if (rbytes > 0 && (*prop = Xmalloc (rbytes)))
 		_XRead16Pad (dpy, (short *) *prop, nbytes);
 	    break;
 
 	case 32:
 	    nbytes = rep.nItems << 2;
 	    rbytes = rep.nItems * sizeof (long) + 1;
-	    if (rbytes > 0 &&
-		(*prop = (unsigned char *) Xmalloc ((unsigned)rbytes)))
+	    if (rbytes > 0 && (*prop = Xmalloc (rbytes)))
 		_XRead32 (dpy, (long *) *prop, nbytes);
 	    break;
 

commit 1da5b838c2a8565d4d95a4e948f951ce6b466345
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date:   Fri Apr 12 21:44:59 2013 -0700

    integer overflow in XRRQueryProviderProperty() [CVE-2013-1986 2/4]
    
    Same problem as XRRQueryOutputProperty() that it was cloned from
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>

diff --git a/src/XrrProviderProperty.c b/src/XrrProviderProperty.c
index 2d90a0a..dc699f6 100644
--- a/src/XrrProviderProperty.c
+++ b/src/XrrProviderProperty.c
@@ -31,6 +31,7 @@
 #include <X11/extensions/render.h>
 #include <X11/extensions/Xrender.h>
 #include "Xrandrint.h"
+#include <limits.h>
 
 Atom *
 XRRListProviderProperties (Display *dpy, RRProvider provider, int *nprop)
@@ -84,7 +85,7 @@ XRRQueryProviderProperty (Display *dpy, RRProvider provider, Atom property)
     XExtDisplayInfo		*info = XRRFindDisplay(dpy);
     xRRQueryProviderPropertyReply rep;
     xRRQueryProviderPropertyReq	*req;
-    int				rbytes, nbytes;
+    unsigned int		rbytes, nbytes;
     XRRPropertyInfo		*prop_info;
 
     RRCheckExtension (dpy, info, NULL);
@@ -102,10 +103,14 @@ XRRQueryProviderProperty (Display *dpy, RRProvider provider, Atom property)
 	return NULL;
     }
 
-    rbytes = sizeof (XRRPropertyInfo) + rep.length * sizeof (long);
-    nbytes = rep.length << 2;
+    if (rep.length < ((INT_MAX / sizeof(long)) - sizeof (XRRPropertyInfo))) {
+        rbytes = sizeof (XRRPropertyInfo) + (rep.length * sizeof (long));
+        nbytes = rep.length << 2;
+
+        prop_info = Xmalloc (rbytes);
+    } else
+        prop_info = NULL;
 
-    prop_info = (XRRPropertyInfo *) Xmalloc (rbytes);
     if (prop_info == NULL) {
 	_XEatDataWords (dpy, rep.length);
 	UnlockDisplay (dpy);

commit 0e79d96c36aef5889ae2e2a3fc2e96e93f30dc21
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date:   Fri Apr 12 21:44:59 2013 -0700

    integer overflow in XRRQueryOutputProperty() [CVE-2013-1986 1/4]
    
    rep.length is a CARD32, while rbytes was a signed int, so
       rbytes = sizeof (XRRPropertyInfo) + rep.length * sizeof (long);
    could result in integer overflow, leading to an undersized malloc
    and reading data off the connection and writing it past the end of
    the allocated buffer.
    
    Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>

diff --git a/src/XrrProperty.c b/src/XrrProperty.c
index 2b065b2..50382bf 100644
--- a/src/XrrProperty.c
+++ b/src/XrrProperty.c
@@ -31,6 +31,7 @@
 #include <X11/extensions/render.h>
 #include <X11/extensions/Xrender.h>
 #include "Xrandrint.h"
+#include <limits.h>
 
 Atom *
 XRRListOutputProperties (Display *dpy, RROutput output, int *nprop)
@@ -84,7 +85,7 @@ XRRQueryOutputProperty (Display *dpy, RROutput output, Atom property)
     XExtDisplayInfo		*info = XRRFindDisplay(dpy);
     xRRQueryOutputPropertyReply rep;
     xRRQueryOutputPropertyReq	*req;
-    int				rbytes, nbytes;
+    unsigned int		rbytes, nbytes;
     XRRPropertyInfo		*prop_info;
 
     RRCheckExtension (dpy, info, NULL);
@@ -102,10 +103,14 @@ XRRQueryOutputProperty (Display *dpy, RROutput output, Atom property)
 	return NULL;
     }
 
-    rbytes = sizeof (XRRPropertyInfo) + rep.length * sizeof (long);
-    nbytes = rep.length << 2;
+    if (rep.length < ((INT_MAX / sizeof(long)) - sizeof (XRRPropertyInfo))) {
+        rbytes = sizeof (XRRPropertyInfo) + (rep.length * sizeof (long));
+        nbytes = rep.length << 2;
+
+        prop_info = Xmalloc (rbytes);
+    } else
+        prop_info = NULL;
 
-    prop_info = (XRRPropertyInfo *) Xmalloc (rbytes);
     if (prop_info == NULL) {
 	_XEatDataWords(dpy, rep.length);
 	UnlockDisplay (dpy);

commit 1c7ad6773ce6be00dcd6e51e9be08f203abe5071
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date:   Fri May 3 23:29:22 2013 -0700

    Use _XEatDataWords to avoid overflow of rep.length bit shifting
    
    rep.length is a CARD32, so rep.length << 2 could overflow in 32-bit builds
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>

diff --git a/configure.ac b/configure.ac
index 3f28bef..8466999 100644
--- a/configure.ac
+++ b/configure.ac
@@ -55,6 +55,12 @@ AC_SUBST(RANDR_VERSION)
 # Obtain compiler/linker options for depedencies
 PKG_CHECK_MODULES(RANDR, x11 randrproto >= $RANDR_VERSION xext xextproto xrender renderproto)
 
+# Check for _XEatDataWords function that may be patched into older Xlib release
+SAVE_LIBS="$LIBS"
+LIBS="$RANDR_LIBS"
+AC_CHECK_FUNCS([_XEatDataWords])
+LIBS="$SAVE_LIBS"
+
 AC_CONFIG_FILES([Makefile
 		src/Makefile
 		man/Makefile
diff --git a/src/Xrandrint.h b/src/Xrandrint.h
index aed10e4..1687c29 100644
--- a/src/Xrandrint.h
+++ b/src/Xrandrint.h
@@ -42,6 +42,19 @@ extern char XRRExtensionName[];
 
 XExtDisplayInfo *XRRFindDisplay (Display *dpy);
 
+#ifndef HAVE__XEATDATAWORDS
+#include <X11/Xmd.h>  /* for LONG64 on 64-bit platforms */
+#include <limits.h>
+
+static inline void _XEatDataWords(Display *dpy, unsigned long n)
+{
+# ifndef LONG64
+    if (n >= (ULONG_MAX >> 2))
+        _XIOError(dpy);
+# endif
+    _XEatData (dpy, n << 2);
+}
+#endif
 
 /* deliberately opaque internal data structure; can be extended,
    but not reordered */
diff --git a/src/XrrCrtc.c b/src/XrrCrtc.c
index 04087c5..a704a52 100644
--- a/src/XrrCrtc.c
+++ b/src/XrrCrtc.c
@@ -74,7 +74,7 @@ XRRGetCrtcInfo (Display *dpy, XRRScreenResources *resources, RRCrtc crtc)
 
     xci = (XRRCrtcInfo *) Xmalloc(rbytes);
     if (xci == NULL) {
-	_XEatData (dpy, (unsigned long) nbytes);
+	_XEatDataWords (dpy, rep.length);
 	UnlockDisplay (dpy);
 	SyncHandle ();
 	return NULL;
@@ -203,7 +203,7 @@ XRRGetCrtcGamma (Display *dpy, RRCrtc crtc)
 
     if (!crtc_gamma)
     {
-	_XEatData (dpy, (unsigned long) nbytes);
+	_XEatDataWords (dpy, rep.length);
 	goto out;
     }
     _XRead16 (dpy, crtc_gamma->red, rep.size * 2);
@@ -397,7 +397,7 @@ XRRGetCrtcTransform (Display	*dpy,
 	    int extraBytes = rep.length * 4 - CrtcTransformExtra;
 	    extra = Xmalloc (extraBytes);
 	    if (!extra) {
-		_XEatData (dpy, extraBytes);
+		_XEatDataWords (dpy, rep.length - (CrtcTransformExtra >> 2));
 		UnlockDisplay (dpy);
 		SyncHandle ();
 		return False;
diff --git a/src/XrrOutput.c b/src/XrrOutput.c
index f13a932..4df894e 100644
--- a/src/XrrOutput.c
+++ b/src/XrrOutput.c
@@ -81,7 +81,7 @@ XRRGetOutputInfo (Display *dpy, XRRScreenResources *resources, RROutput output)
 
     xoi = (XRROutputInfo *) Xmalloc(rbytes);
     if (xoi == NULL) {
-	_XEatData (dpy, (unsigned long) nbytes);
+	_XEatDataWords (dpy, rep.length - (OutputInfoExtra >> 2));
 	UnlockDisplay (dpy);
 	SyncHandle ();
 	return NULL;
diff --git a/src/XrrProperty.c b/src/XrrProperty.c
index 4c3fdb0..2b065b2 100644
--- a/src/XrrProperty.c
+++ b/src/XrrProperty.c
@@ -62,7 +62,7 @@ XRRListOutputProperties (Display *dpy, RROutput output, int *nprop)
 
 	props = (Atom *) Xmalloc (rbytes);
 	if (props == NULL) {
-	    _XEatData (dpy, nbytes);
+	    _XEatDataWords (dpy, rep.length);
 	    UnlockDisplay (dpy);
 	    SyncHandle ();
 	    *nprop = 0;
@@ -107,7 +107,7 @@ XRRQueryOutputProperty (Display *dpy, RROutput output, Atom property)
 
     prop_info = (XRRPropertyInfo *) Xmalloc (rbytes);
     if (prop_info == NULL) {
-	_XEatData (dpy, nbytes);
+	_XEatDataWords(dpy, rep.length);
 	UnlockDisplay (dpy);
 	SyncHandle ();
 	return NULL;
@@ -313,14 +313,13 @@ XRRGetOutputProperty (Display *dpy, RROutput output,
 	     * This part of the code should never be reached.  If it is,
 	     * the server sent back a property with an invalid format.
 	     */
-	    nbytes = rep.length << 2;
-	    _XEatData(dpy, (unsigned long) nbytes);
+	    _XEatDataWords(dpy, rep.length);
 	    UnlockDisplay(dpy);
 	    SyncHandle();
 	    return(BadImplementation);
 	}
 	if (! *prop) {
-	    _XEatData(dpy, (unsigned long) nbytes);
+	    _XEatDataWords(dpy, rep.length);
 	    UnlockDisplay(dpy);
 	    SyncHandle();
 	    return(BadAlloc);
diff --git a/src/XrrProvider.c b/src/XrrProvider.c
index fcd06ff..309e321 100644
--- a/src/XrrProvider.c
+++ b/src/XrrProvider.c
@@ -67,7 +67,7 @@ XRRGetProviderResources(Display *dpy, Window window)
     xrpr = (XRRProviderResources *) Xmalloc(rbytes);
 
     if (xrpr == NULL) {
-       _XEatData (dpy, (unsigned long) nbytes);
+       _XEatDataWords (dpy, rep.length);
        UnlockDisplay (dpy);
        SyncHandle ();
        return NULL;
@@ -136,7 +136,7 @@ XRRGetProviderInfo(Display *dpy, XRRScreenResources *resources, RRProvider provi
 
     xpi = (XRRProviderInfo *)Xmalloc(rbytes);
     if (xpi == NULL) {
-	_XEatData (dpy, (unsigned long) nbytes);
+	_XEatDataWords (dpy, rep.length - (ProviderInfoExtra >> 2));
 	UnlockDisplay (dpy);
 	SyncHandle ();
 	return NULL;
diff --git a/src/XrrProviderProperty.c b/src/XrrProviderProperty.c
index c8c08e9..2d90a0a 100644
--- a/src/XrrProviderProperty.c
+++ b/src/XrrProviderProperty.c
@@ -62,7 +62,7 @@ XRRListProviderProperties (Display *dpy, RRProvider provider, int *nprop)
 
 	props = (Atom *) Xmalloc (rbytes);
 	if (props == NULL) {
-	    _XEatData (dpy, nbytes);
+	    _XEatDataWords (dpy, rep.length);
 	    UnlockDisplay (dpy);
 	    SyncHandle ();
 	    *nprop = 0;
@@ -107,7 +107,7 @@ XRRQueryProviderProperty (Display *dpy, RRProvider provider, Atom property)
 
     prop_info = (XRRPropertyInfo *) Xmalloc (rbytes);
     if (prop_info == NULL) {
-	_XEatData (dpy, nbytes);
+	_XEatDataWords (dpy, rep.length);
 	UnlockDisplay (dpy);
 	SyncHandle ();
 	return NULL;
@@ -313,14 +313,13 @@ XRRGetProviderProperty (Display *dpy, RRProvider provider,
 	     * This part of the code should never be reached.  If it is,
 	     * the server sent back a property with an invalid format.
 	     */
-	    nbytes = rep.length << 2;
-	    _XEatData(dpy, (unsigned long) nbytes);
+	    _XEatDataWords(dpy, rep.length);
 	    UnlockDisplay(dpy);
 	    SyncHandle();
 	    return(BadImplementation);
 	}
 	if (! *prop) {
-	    _XEatData(dpy, (unsigned long) nbytes);
+	    _XEatDataWords(dpy, rep.length);
 	    UnlockDisplay(dpy);
 	    SyncHandle();
 	    return(BadAlloc);
diff --git a/src/XrrScreen.c b/src/XrrScreen.c
index f830913..08710b6 100644
--- a/src/XrrScreen.c
+++ b/src/XrrScreen.c
@@ -129,7 +129,7 @@ doGetScreenResources (Display *dpy, Window window, int poll)
     if (xrsr == NULL || wire_names == NULL) {
 	if (xrsr) Xfree (xrsr);
 	if (wire_names) Xfree (wire_names);
-	_XEatData (dpy, (unsigned long) nbytes);
+	_XEatDataWords (dpy, rep.length);
 	UnlockDisplay (dpy);
 	SyncHandle ();
 	return NULL;

commit 99a63d10cbbab7d69a52d25d78795a3278506ea9
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date:   Fri Jan 18 23:14:01 2013 -0800

    Replace deprecated Automake INCLUDES variable with AM_CPPFLAGS
    
    Excerpt https://lists.gnu.org/archive/html/automake/2012-12/msg00038.html
    
      - Support for the long-deprecated INCLUDES variable will be removed
        altogether in Automake 1.14.  The AM_CPPFLAGS variable should be
        used instead.
    
    This variable was deprecated in Automake releases prior to 1.10, which is
    the current minimum level required to build X.
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>

diff --git a/src/Makefile.am b/src/Makefile.am
index 7a47b9c..2113846 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -19,7 +19,7 @@ AM_CFLAGS = \
 	$(MALLOC_ZERO_CFLAGS) \
 	$(CWARNFLAGS)
 
-INCLUDES = -I$(top_srcdir)/include/X11/extensions
+AM_CPPFLAGS = -I$(top_srcdir)/include/X11/extensions
 
 libXrandr_la_LDFLAGS = -version-number 2:2:0 -no-undefined
 

commit 150cf8788a94fc5fb519764e1d46cb520c1d4043
Author: Colin Walters <walters@verbum.org>
Date:   Wed Jan 4 17:37:06 2012 -0500

    autogen.sh: Implement GNOME Build API
    
    http://people.gnome.org/~walters/docs/build-api.txt
    
    Signed-off-by: Adam Jackson <ajax@redhat.com>

diff --git a/autogen.sh b/autogen.sh
index 904cd67..fc34bd5 100755
--- a/autogen.sh
+++ b/autogen.sh
@@ -9,4 +9,6 @@ cd $srcdir
 autoreconf -v --install || exit 1
 cd $ORIGDIR || exit $?
 
-$srcdir/configure --enable-maintainer-mode "$@"
+if test -z "$NOCONFIGURE"; then
+    $srcdir/configure "$@"
+fi

commit c3486bccee2aaa2668f7d24d3e1bc01f3832f301
Author: Adam Jackson <ajax@redhat.com>
Date:   Tue Jan 15 14:28:48 2013 -0500

    configure: Remove AM_MAINTAINER_MODE
    
    Signed-off-by: Adam Jackson <ajax@redhat.com>

diff --git a/configure.ac b/configure.ac
index d89cc8b..3f28bef 100644
--- a/configure.ac
+++ b/configure.ac
@@ -36,7 +36,6 @@ AC_CONFIG_HEADERS([config.h])
 
 # Initialize Automake
 AM_INIT_AUTOMAKE([foreign dist-bzip2])
-AM_MAINTAINER_MODE
 
 # Initialize libtool
 AC_PROG_LIBTOOL

commit 6dfe7d4fa04a5054ee3daeb654ac5a763f37fed1
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date:   Fri Aug 31 21:39:10 2012 -0700

    Constify a couple string arguments that are just copied, not modified
    
    Fixes compiler warnings when building app/xrandr:
    
    xrandr.c: In function ‘crtc_set_transform’:
    xrandr.c:1459:9: warning: passing argument 4 of ‘XRRSetCrtcTransform’ discards qualifiers from pointer target type
    X11/extensions/Xrandr.h:419:1: note: expected ‘char *’ but argument is of type ‘const char *’
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
    Reviewed-by: Aaron Plattner <aplattner@nvidia.com>

diff --git a/include/X11/extensions/Xrandr.h b/include/X11/extensions/Xrandr.h
index b1baf8a..f394864 100644
--- a/include/X11/extensions/Xrandr.h
+++ b/include/X11/extensions/Xrandr.h
@@ -341,7 +341,7 @@ XRRGetOutputProperty (Display *dpy, RROutput output,
 		      unsigned char **prop);
 
 XRRModeInfo *
-XRRAllocModeInfo (char *name, int nameLength);
+XRRAllocModeInfo (_Xconst char *name, int nameLength);
 
 RRMode
 XRRCreateMode (Display *dpy, Window window, XRRModeInfo *modeInfo);
@@ -419,7 +419,7 @@ void
 XRRSetCrtcTransform (Display	*dpy,
 		     RRCrtc	crtc,
 		     XTransform	*transform,
-		     char	*filter,
+		     _Xconst char *filter,
 		     XFixed	*params,
 		     int	nparams);
 
diff --git a/src/XrrCrtc.c b/src/XrrCrtc.c
index 0762373..04087c5 100644
--- a/src/XrrCrtc.c
+++ b/src/XrrCrtc.c
@@ -306,7 +306,7 @@ void
 XRRSetCrtcTransform (Display	*dpy,
 		     RRCrtc	crtc,
 		     XTransform	*transform,
-		     char	*filter,
+		     _Xconst char *filter,
 		     XFixed	*params,
 		     int	nparams)
 {
diff --git a/src/XrrMode.c b/src/XrrMode.c
index 0b74a73..e605e8a 100644
--- a/src/XrrMode.c
+++ b/src/XrrMode.c
@@ -33,7 +33,7 @@
 #include "Xrandrint.h"
 
 XRRModeInfo *
-XRRAllocModeInfo (char *name, int nameLength)
+XRRAllocModeInfo (_Xconst char *name, int nameLength)
 {
     XRRModeInfo	*mode_info;
 

commit 39976a7d1cc9e737e662695ae5326af805c50a27
Author: Dave Airlie <airlied@redhat.com>
Date:   Thu Jul 26 14:15:18 2012 +1000

    libXrandr: bump to 1.4.0 for release
    
    This adds support for the provider queries and events.
    
    Signed-off-by: Dave Airlie <airlied@redhat.com>

diff --git a/configure.ac b/configure.ac
index cdfbf77..d89cc8b 100644
--- a/configure.ac
+++ b/configure.ac
@@ -29,7 +29,7 @@ AC_PREREQ([2.60])
 # digit in the version number to track changes which don't affect the
 # protocol, so Xrandr version l.n.m corresponds to protocol version l.n
 #
-AC_INIT([libXrandr], [1.3.2],
+AC_INIT([libXrandr], [1.4.0],
         [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], [libXrandr])
 AC_CONFIG_SRCDIR([Makefile.am])
 AC_CONFIG_HEADERS([config.h])

commit 5d2edde0bf8460aab250dd83743aedb5c66a243e
Author: Dave Airlie <airlied@redhat.com>
Date:   Fri Jan 20 17:40:10 2012 +0000

    libXrandr: add support for provider objects.
    
    This adds the client side libXrandr support for randr 1.4,
    and provider objects.
    
    Signed-off-by: Dave Airlie <airlied@redhat.com>

diff --git a/include/X11/extensions/Xrandr.h b/include/X11/extensions/Xrandr.h
index 4b29c3f..b1baf8a 100644
--- a/include/X11/extensions/Xrandr.h
+++ b/include/X11/extensions/Xrandr.h
@@ -39,6 +39,7 @@ _XFUNCPROTOBEGIN
 typedef XID RROutput;
 typedef XID RRCrtc;
 typedef XID RRMode;
+typedef XID RRProvider;
 
 typedef struct {
     int	width, height;
@@ -118,6 +119,41 @@ typedef struct {
     int state;			/* NewValue, Deleted */
 } XRROutputPropertyNotifyEvent;
 
+typedef struct {
+    int type;			/* event base */
+    unsigned long serial;	/* # of last request processed by server */
+    Bool send_event;		/* true if this came from a SendEvent request */
+    Display *display;		/* Display the event was read from */
+    Window window;		/* window which selected for this event */
+    int subtype;		/* RRNotify_ProviderChange */
+    RRProvider provider; 	/* current provider (or None) */
+    Time timestamp;		/* time of change */
+    unsigned int current_role;
+} XRRProviderChangeNotifyEvent;
+
+typedef struct {
+    int type;			/* event base */
+    unsigned long serial;	/* # of last request processed by server */
+    Bool send_event;		/* true if this came from a SendEvent request */
+    Display *display;		/* Display the event was read from */
+    Window window;		/* window which selected for this event */
+    int subtype;		/* RRNotify_ProviderProperty */
+    RRProvider provider;		/* related provider */
+    Atom property;		/* changed property */
+    Time timestamp;		/* time of change */
+    int state;			/* NewValue, Deleted */
+} XRRProviderPropertyNotifyEvent;
+
+typedef struct {
+    int type;			/* event base */
+    unsigned long serial;	/* # of last request processed by server */
+    Bool send_event;		/* true if this came from a SendEvent request */
+    Display *display;		/* Display the event was read from */
+    Window window;		/* window which selected for this event */
+    int subtype;		/* RRNotify_ResourceChange */
+    Time timestamp;		/* time of change */
+} XRRResourceChangeNotifyEvent;
+
 /* internal representation is private to the library */
 typedef struct _XRRScreenConfiguration XRRScreenConfiguration;
 
@@ -451,6 +487,71 @@ RROutput
 XRRGetOutputPrimary(Display *dpy,
 		    Window window);
 
+typedef struct _XRRProviderResources {
+    Time timestamp;
+    int nproviders;
+    RRProvider *providers;
+} XRRProviderResources;
+
+XRRProviderResources *
+XRRGetProviderResources(Display *dpy, Window window);
+
+void
+XRRFreeProviderResources(XRRProviderResources *resources);
+
+typedef struct _XRRProviderInfo {
+    unsigned int capabilities;
+    int ncrtcs;
+    RRCrtc	*crtcs;
+    int noutputs;
+    RROutput    *outputs;
+    char	    *name;
+    int nassociatedproviders;
+    RRProvider *associated_providers;
+    unsigned int *associated_capability;
+    int		    nameLen;
+} XRRProviderInfo;
+  
+XRRProviderInfo *
+XRRGetProviderInfo(Display *dpy, XRRScreenResources *resources, RRProvider provider);
+
+void
+XRRFreeProviderInfo(XRRProviderInfo *provider);
+
+int
+XRRSetProviderOutputSource(Display *dpy, XID provider, XID source_provider);
+
+int
+XRRSetProviderOffloadSink(Display *dpy, XID provider, XID sink_provider);
+
+Atom *
+XRRListProviderProperties (Display *dpy, RRProvider provider, int *nprop);
+
+XRRPropertyInfo *
+XRRQueryProviderProperty (Display *dpy, RRProvider provider, Atom property);
+
+void
+XRRConfigureProviderProperty (Display *dpy, RRProvider provider, Atom property,
+			    Bool pending, Bool range, int num_values,
+			    long *values);
+			
+void
+XRRChangeProviderProperty (Display *dpy, RRProvider provider,
+			 Atom property, Atom type,
+			 int format, int mode,
+			 _Xconst unsigned char *data, int nelements);
+
+void
+XRRDeleteProviderProperty (Display *dpy, RRProvider provider, Atom property);
+
+int
+XRRGetProviderProperty (Display *dpy, RRProvider provider,
+			Atom property, long offset, long length,
+			Bool _delete, Bool pending, Atom req_type,
+			Atom *actual_type, int *actual_format,
+			unsigned long *nitems, unsigned long *bytes_after,
+			unsigned char **prop);
+
 _XFUNCPROTOEND
 
 #endif /* _XRANDR_H_ */
diff --git a/src/Makefile.am b/src/Makefile.am
index d80a3c2..7a47b9c 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -8,7 +8,9 @@ libXrandr_la_SOURCES = 	\
 	XrrMode.c	\
 	XrrOutput.c	\
 	XrrProperty.c	\
-	XrrScreen.c
+	XrrScreen.c     \
+	XrrProvider.c   \
+	XrrProviderProperty.c
 
 libXrandr_la_LIBADD = @RANDR_LIBS@
 
diff --git a/src/Xrandr.c b/src/Xrandr.c
index 2bdbe97..b1e97ec 100644
--- a/src/Xrandr.c
+++ b/src/Xrandr.c
@@ -137,7 +137,46 @@ static Bool XRRWireToEvent(Display *dpy, XEvent *event, xEvent *wire)
 	    aevent->state = awire->state;
 	    return True;
 	}
-
+	case RRNotify_ProviderChange: {
+	    XRRProviderChangeNotifyEvent *aevent = (XRRProviderChangeNotifyEvent *) event;
+	    xRRProviderChangeNotifyEvent *awire = (xRRProviderChangeNotifyEvent *) wire;
+	    aevent->type = awire->type & 0x7F;
+	    aevent->serial = _XSetLastRequestRead(dpy, (xGenericReply *) wire);
+	    aevent->send_event = (awire->type & 0x80) != 0;
+	    aevent->display = dpy;
+	    aevent->window = awire->window;
+	    aevent->subtype = awire->subCode;
+	    aevent->provider = awire->provider;
+	    aevent->timestamp = awire->timestamp;
+	    return True;
+	}
+	case RRNotify_ProviderProperty: {
+	    XRRProviderPropertyNotifyEvent *aevent = (XRRProviderPropertyNotifyEvent *) event;
+	    xRRProviderPropertyNotifyEvent *awire = (xRRProviderPropertyNotifyEvent *) wire;
+	    aevent->type = awire->type & 0x7F;
+	    aevent->serial = _XSetLastRequestRead(dpy, (xGenericReply *) wire);
+	    aevent->send_event = (awire->type & 0x80) != 0;
+	    aevent->display = dpy;
+	    aevent->window = awire->window;
+	    aevent->subtype = awire->subCode;
+	    aevent->provider = awire->provider;
+	    aevent->property = awire->atom;
+	    aevent->timestamp = awire->timestamp;
+	    aevent->state = awire->state;
+	    return True;
+	}
+	case RRNotify_ResourceChange: {
+	    XRRResourceChangeNotifyEvent *aevent = (XRRResourceChangeNotifyEvent *) event;
+	    xRRResourceChangeNotifyEvent *awire = (xRRResourceChangeNotifyEvent *) wire;
+	    aevent->type = awire->type & 0x7F;
+	    aevent->serial = _XSetLastRequestRead(dpy, (xGenericReply *) wire);
+	    aevent->send_event = (awire->type & 0x80) != 0;
+	    aevent->display = dpy;
+	    aevent->window = awire->window;
+	    aevent->subtype = awire->subCode;
+	    aevent->timestamp = awire->timestamp;
+	    return True;
+	}
 	    break;
 	}
       }
@@ -214,6 +253,30 @@ static Status XRREventToWire(Display *dpy, XEvent *event, xEvent *wire)
 	    awire->state = aevent->state;
 	    return True;
 	}
+	case RRNotify_ProviderChange: {
+	    xRRProviderChangeNotifyEvent *awire = (xRRProviderChangeNotifyEvent *) wire;
+	    XRRProviderChangeNotifyEvent *aevent = (XRRProviderChangeNotifyEvent *) event;
+	    awire->window = aevent->window;
+	    awire->provider = aevent->provider;
+	    return True;
+	}
+	case RRNotify_ProviderProperty: {
+	    xRRProviderPropertyNotifyEvent *awire = (xRRProviderPropertyNotifyEvent *) wire;
+	    XRRProviderPropertyNotifyEvent *aevent = (XRRProviderPropertyNotifyEvent *) event;
+	    awire->window = aevent->window;
+	    awire->provider = aevent->provider;
+	    awire->atom = aevent->property;
+	    awire->timestamp = aevent->timestamp;
+	    awire->state = aevent->state;
+	    return True;
+	}
+	case RRNotify_ResourceChange: {
+	    xRRResourceChangeNotifyEvent *awire = (xRRResourceChangeNotifyEvent *) wire;
+	    XRRResourceChangeNotifyEvent *aevent = (XRRResourceChangeNotifyEvent *) event;
+	    awire->window = aevent->window;
+	    awire->timestamp = aevent->timestamp;
+	    return True;
+	}
 	}
       }
     }
diff --git a/src/XrrProvider.c b/src/XrrProvider.c
new file mode 100644
index 0000000..fcd06ff
--- /dev/null
+++ b/src/XrrProvider.c
@@ -0,0 +1,217 @@
+/*
+ * Copyright © 2011 Dave Airlie
+ *
+ * Permission to use, copy, modify, distribute, and sell this software and its
+ * documentation for any purpose is hereby granted without fee, provided that
+ * the above copyright notice appear in all copies and that both that copyright
+ * notice and this permission notice appear in supporting documentation, and
+ * that the name of the copyright holders not be used in advertising or
+ * publicity pertaining to distribution of the software without specific,
+ * written prior permission.  The copyright holders make no representations
+ * about the suitability of this software for any purpose.  It is provided "as
+ * is" without express or implied warranty.
+ *
+ * THE COPYRIGHT HOLDERS DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
+ * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
+ * EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE FOR ANY SPECIAL, INDIRECT OR
+ * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
+ * DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+ * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE


Reply to: