[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

xorg-server: Changes to 'upstream-experimental'



 COPYING                                          |   24 
 Xext/dpms.c                                      |   10 
 Xext/dpmsstubs.c                                 |   10 
 Xext/panoramiX.c                                 |    2 
 Xext/panoramiX.h                                 |    2 
 Xext/panoramiXprocs.c                            |   16 
 Xext/saver.c                                     |   16 
 Xext/security.c                                  |    5 
 Xext/shm.c                                       |   21 
 Xext/sync.c                                      |    2 
 Xext/syncsrv.h                                   |    8 
 Xext/xcmisc.c                                    |    1 
 Xext/xres.c                                      |   12 
 Xext/xvdisp.c                                    |  126 -
 Xext/xvdix.h                                     |   45 
 Xext/xvmain.c                                    |  164 +-
 Xi/chgdctl.c                                     |    8 
 Xi/chgfctl.c                                     |    2 
 Xi/sendexev.c                                    |    3 
 Xi/xiallowev.c                                   |    2 
 Xi/xichangecursor.c                              |    2 
 Xi/xichangehierarchy.c                           |   35 
 Xi/xigetclientpointer.c                          |    1 
 Xi/xigrabdev.c                                   |    9 
 Xi/xipassivegrab.c                               |   12 
 Xi/xiproperty.c                                  |   14 
 Xi/xiquerydevice.c                               |    1 
 Xi/xiquerypointer.c                              |    2 
 Xi/xiselectev.c                                  |    8 
 Xi/xisetclientpointer.c                          |    3 
 Xi/xisetdevfocus.c                               |    4 
 Xi/xiwarppointer.c                               |    2 
 composite/compalloc.c                            |    8 
 composite/compext.c                              |    7 
 composite/compinit.c                             |   25 
 composite/compint.h                              |    3 
 composite/compoverlay.c                          |    4 
 composite/compwindow.c                           |    7 
 config/config.c                                  |  129 -
 config/udev.c                                    |   17 
 configure.ac                                     |  124 -
 dbe/dbe.c                                        |   33 
 dbe/dbestruct.h                                  |   12 
 dbe/midbe.c                                      |   14 
 dbe/midbe.h                                      |    8 
 dix/atom.c                                       |    8 
 dix/colormap.c                                   |   34 
 dix/cursor.c                                     |    8 
 dix/devices.c                                    |   63 
 dix/dispatch.c                                   |   75 -
 dix/dispatch.h                                   |    2 
 dix/dixfonts.c                                   |    6 
 dix/dixutils.c                                   |   12 
 dix/extension.c                                  |   10 
 dix/gc.c                                         |   25 
 dix/getevents.c                                  |   22 
 dix/globals.c                                    |    8 
 dix/glyphcurs.c                                  |    8 
 dix/grabs.c                                      |   16 
 dix/inpututils.c                                 |    2 
 dix/main.c                                       |   10 
 dix/pixmap.c                                     |   18 
 dix/property.c                                   |    8 
 dix/protocol.txt                                 |   30 
 dix/region.c                                     |   42 
 dix/registry.c                                   |   94 -
 dix/resource.c                                   |   18 
 dix/selection.c                                  |   10 
 dix/swaprep.c                                    |    8 
 dix/swapreq.c                                    |    8 
 dix/tables.c                                     |    8 
 dix/window.c                                     |  111 -
 doc/Xserver-spec.xml                             |    6 
 dri3/dri3.c                                      |   10 
 dri3/dri3.h                                      |    2 
 dri3/dri3_request.c                              |    6 
 exa/exa.c                                        |    2 
 exa/exa.h                                        |    8 
 exa/exa_accel.c                                  |   20 
 exa/exa_glyphs.c                                 |    8 
 exa/exa_priv.h                                   |   19 
 exa/exa_render.c                                 |    4 
 exa/exa_unaccel.c                                |   13 
 fb/Makefile.am                                   |    2 
 fb/fb.h                                          |  342 ----
 fb/fb24_32.c                                     |    2 
 fb/fb24_32.h                                     |    2 
 fb/fbbits.c                                      |   12 
 fb/fbblt.c                                       |  271 ---
 fb/fbbltone.c                                    |  320 +---
 fb/fbcopy.c                                      |    2 
 fb/fbfill.c                                      |   84 +
 fb/fbfillrect.c                                  |    2 
 fb/fbgc.c                                        |   85 -
 fb/fbglyph.c                                     |   10 
 fb/fbline.c                                      |    4 
 fb/fboverlay.c                                   |    7 
 fb/fboverlay.h                                   |    6 
 fb/fbpict.c                                      |   18 
 fb/fbpict.h                                      |    4 
 fb/fbpixmap.c                                    |    6 
 fb/fbpoint.c                                     |    2 
 fb/fbpush.c                                      |    4 
 fb/fbrop.h                                       |   12 
 fb/fbscreen.c                                    |    7 
 fb/fbseg.c                                       |   42 
 fb/fbstipple.c                                   |  264 ---
 fb/fbtile.c                                      |  163 --
 fb/fbutil.c                                      |  308 ----
 fb/fbwindow.c                                    |    6 
 fb/wfbrename.h                                   |   25 
 glamor/Makefile.am                               |   16 
 glamor/glamor.c                                  |   86 -
 glamor/glamor.h                                  |   25 
 glamor/glamor_copy.c                             |  747 ++++++++++
 glamor/glamor_copyarea.c                         |  626 --------
 glamor/glamor_copyplane.c                        |   75 -
 glamor/glamor_copywindow.c                       |   56 
 glamor/glamor_core.c                             |  202 +-
 glamor/glamor_dash.c                             |  370 ++++
 glamor/glamor_egl.c                              |   78 -
 glamor/glamor_egl_stubs.c                        |    2 
 glamor/glamor_eglmodule.c                        |    1 
 glamor/glamor_fbo.c                              |    4 
 glamor/glamor_fill.c                             |  356 ----
 glamor/glamor_font.c                             |    8 
 glamor/glamor_glyphblt.c                         |  154 --
 glamor/glamor_glyphs.c                           |   96 -
 glamor/glamor_gradient.c                         |   19 
 glamor/glamor_image.c                            |    3 
 glamor/glamor_largepixmap.c                      |  109 -
 glamor/glamor_lines.c                            |  187 ++
 glamor/glamor_picture.c                          |   20 
 glamor/glamor_pixmap.c                           |  580 -------
 glamor/glamor_points.c                           |    3 
 glamor/glamor_polylines.c                        |  136 -
 glamor/glamor_prepare.c                          |  271 +++
 glamor/glamor_prepare.h                          |   52 
 glamor/glamor_priv.h                             |  320 ++--
 glamor/glamor_program.c                          |   56 
 glamor/glamor_program.h                          |    6 
 glamor/glamor_render.c                           |  105 -
 glamor/glamor_segment.c                          |   44 
 glamor/glamor_segs.c                             |  188 ++
 glamor/glamor_spans.c                            |    3 
 glamor/glamor_sync.c                             |  117 +
 glamor/glamor_text.c                             |    6 
 glamor/glamor_tile.c                             |  293 ---
 glamor/glamor_transfer.c                         |   48 
 glamor/glamor_transform.c                        |   72 
 glamor/glamor_trapezoid.c                        | 1718 -----------------------
 glamor/glamor_utils.c                            |   79 +
 glamor/glamor_utils.h                            |  218 --
 glamor/glamor_vbo.c                              |    2 
 glamor/glamor_xv.c                               |  287 +--
 glx/clientinfo.c                                 |   20 
 glx/glxbyteorder.h                               |    8 
 glx/glxcmds.c                                    |  119 -
 glx/glxcmdsswap.c                                |    4 
 glx/glxdri2.c                                    |    6 
 glx/glxdriswrast.c                               |    2 
 glx/glxext.c                                     |    8 
 glx/glxext.h                                     |    1 
 glx/glxscreens.c                                 |    2 
 glx/glxscreens.h                                 |    2 
 glx/glxserver.h                                  |   43 
 glx/indirect_dispatch.c                          |   31 
 glx/indirect_dispatch.h                          |    6 
 glx/indirect_dispatch_swap.c                     |   32 
 glx/indirect_program.c                           |    8 
 glx/indirect_reqsize.c                           |  148 -
 glx/indirect_reqsize.h                           |  187 +-
 glx/indirect_size.h                              |    6 
 glx/indirect_size_get.c                          |    6 
 glx/indirect_size_get.h                          |    6 
 glx/indirect_table.c                             |    6 
 glx/indirect_table.h                             |    6 
 glx/indirect_texture_compression.c               |   10 
 glx/indirect_util.c                              |   17 
 glx/indirect_util.h                              |    6 
 glx/rensize.c                                    |  118 -
 glx/single2.c                                    |   23 
 glx/single2swap.c                                |   19 
 glx/singlepix.c                                  |   60 
 glx/singlepixswap.c                              |   50 
 glx/swap_interval.c                              |    2 
 glx/unpack.h                                     |    3 
 hw/dmx/config/Canvas.c                           |    2 
 hw/dmx/config/dmxprint.c                         |    2 
 hw/dmx/dmxgc.c                                   |   12 
 hw/dmx/dmxgcops.c                                |    8 
 hw/dmx/dmxpict.h                                 |    2 
 hw/dmx/dmxwindow.c                               |    4 
 hw/dmx/dmxwindow.h                               |    3 
 hw/dmx/glxProxy/glxcmds.c                        |   16 
 hw/dmx/glxProxy/glxsingle.c                      |    4 
 hw/dmx/glxProxy/glxvendor.c                      |    4 
 hw/dmx/input/ChkNotMaskEv.c                      |    2 
 hw/dmx/input/lnx-keyboard.c                      |   20 
 hw/dmx/input/lnx-ms.c                            |    2 
 hw/kdrive/Xkdrive.man                            |    7 
 hw/kdrive/ephyr/Makefile.am                      |    6 
 hw/kdrive/ephyr/ephyr.c                          |   46 
 hw/kdrive/ephyr/ephyr.h                          |   22 
 hw/kdrive/ephyr/ephyr_glamor_glx.c               |   24 
 hw/kdrive/ephyr/ephyr_glamor_xv.c                |  161 ++
 hw/kdrive/ephyr/ephyrcursor.c                    |  262 +++
 hw/kdrive/ephyr/ephyrdri.c                       |    4 
 hw/kdrive/ephyr/ephyrdri.h                       |    4 
 hw/kdrive/ephyr/ephyrdriext.c                    |    4 
 hw/kdrive/ephyr/ephyrdriext.h                    |    4 
 hw/kdrive/ephyr/ephyrglxext.c                    |    4 
 hw/kdrive/ephyr/ephyrglxext.h                    |    4 
 hw/kdrive/ephyr/ephyrhostglx.c                   |    4 
 hw/kdrive/ephyr/ephyrhostglx.h                   |    4 
 hw/kdrive/ephyr/ephyrinit.c                      |  122 -
 hw/kdrive/ephyr/ephyrlog.h                       |    4 
 hw/kdrive/ephyr/ephyrvideo.c                     |   38 
 hw/kdrive/ephyr/hostx.c                          |  241 ++-
 hw/kdrive/ephyr/hostx.h                          |   18 
 hw/kdrive/ephyr/man/Xephyr.man                   |    3 
 hw/kdrive/ephyr/os.c                             |    4 
 hw/kdrive/src/kdrive.c                           |   31 
 hw/kdrive/src/kdrive.h                           |   16 
 hw/kdrive/src/kxv.c                              |  359 ----
 hw/kdrive/src/kxv.h                              |   39 
 hw/vfb/InitOutput.c                              |   55 
 hw/xfree86/Makefile.am                           |    4 
 hw/xfree86/common/Makefile.am                    |    4 
 hw/xfree86/common/compiler.h                     |  663 --------
 hw/xfree86/common/xf86.h                         |    8 
 hw/xfree86/common/xf86AutoConfig.c               |   10 
 hw/xfree86/common/xf86Bus.c                      |    5 
 hw/xfree86/common/xf86Config.c                   |   71 
 hw/xfree86/common/xf86Configure.c                |    5 
 hw/xfree86/common/xf86Cursor.c                   |   19 
 hw/xfree86/common/xf86DPMS.c                     |    2 
 hw/xfree86/common/xf86Events.c                   |    1 
 hw/xfree86/common/xf86Globals.c                  |    1 
 hw/xfree86/common/xf86Init.c                     |   25 
 hw/xfree86/common/xf86Mode.c                     |    8 
 hw/xfree86/common/xf86Module.h                   |    4 
 hw/xfree86/common/xf86PciInfo.h                  |    2 
 hw/xfree86/common/xf86Privstr.h                  |    8 
 hw/xfree86/common/xf86RandR.c                    |   32 
 hw/xfree86/common/xf86VGAarbiterPriv.h           |   10 
 hw/xfree86/common/xf86Xinput.c                   |   16 
 hw/xfree86/common/xf86Xinput.h                   |   11 
 hw/xfree86/common/xf86cmap.c                     |   50 
 hw/xfree86/common/xf86fbman.c                    |    6 
 hw/xfree86/common/xf86pciBus.c                   |   63 
 hw/xfree86/common/xf86pciBus.h                   |    5 
 hw/xfree86/common/xf86platformBus.c              |  164 +-
 hw/xfree86/common/xf86platformBus.h              |  105 +
 hw/xfree86/common/xf86str.h                      |    4 
 hw/xfree86/common/xf86vmode.c                    |    8 
 hw/xfree86/common/xf86xv.c                       |  302 ----
 hw/xfree86/common/xf86xv.h                       |   41 
 hw/xfree86/common/xf86xvmc.h                     |   10 
 hw/xfree86/common/xf86xvpriv.h                   |    2 
 hw/xfree86/ddc/ddc.c                             |   68 
 hw/xfree86/ddc/edid.h                            |    8 
 hw/xfree86/ddc/print_edid.c                      |    2 
 hw/xfree86/ddc/xf86DDC.h                         |   11 
 hw/xfree86/dixmods/extmod/modinit.h              |   80 -
 hw/xfree86/dixmods/xkbKillSrv.c                  |   16 
 hw/xfree86/dixmods/xkbVT.c                       |   16 
 hw/xfree86/doc/README.DRIcomp                    |    3 
 hw/xfree86/doc/Registry                          |    1 
 hw/xfree86/doc/ddxDesign.xml                     |   35 
 hw/xfree86/dri/dri.c                             |   81 -
 hw/xfree86/dri/dri.h                             |   11 
 hw/xfree86/dri/sarea.h                           |   10 
 hw/xfree86/dri2/Makefile.am                      |    2 
 hw/xfree86/dri2/dri2.c                           |   98 +
 hw/xfree86/dri2/dri2ext.c                        |    3 
 hw/xfree86/dri2/pci_ids/Makefile.am              |   11 
 hw/xfree86/dri2/pci_ids/i810_pci_ids.h           |    4 
 hw/xfree86/dri2/pci_ids/i915_pci_ids.h           |   15 
 hw/xfree86/dri2/pci_ids/i965_pci_ids.h           |  115 +
 hw/xfree86/dri2/pci_ids/pci_id_driver_map.h      |   80 +
 hw/xfree86/dri2/pci_ids/r200_pci_ids.h           |   24 
 hw/xfree86/dri2/pci_ids/r300_pci_ids.h           |  227 +++
 hw/xfree86/dri2/pci_ids/r600_pci_ids.h           |  327 ++++
 hw/xfree86/dri2/pci_ids/radeon_pci_ids.h         |   23 
 hw/xfree86/dri2/pci_ids/radeonsi_pci_ids.h       |  157 ++
 hw/xfree86/dri2/pci_ids/vmwgfx_pci_ids.h         |    1 
 hw/xfree86/drivers/Makefile.am                   |    5 
 hw/xfree86/drivers/modesetting/Makefile.am       |   66 
 hw/xfree86/drivers/modesetting/dri2.c            |  863 +++++++++++
 hw/xfree86/drivers/modesetting/driver.c          | 1231 ++++++++++++++++
 hw/xfree86/drivers/modesetting/driver.h          |  123 +
 hw/xfree86/drivers/modesetting/drmmode_display.c | 1709 ++++++++++++++++++++++
 hw/xfree86/drivers/modesetting/drmmode_display.h |  164 ++
 hw/xfree86/drivers/modesetting/modesetting.man   |   57 
 hw/xfree86/drivers/modesetting/vblank.c          |  383 +++++
 hw/xfree86/fbdevhw/fbdevhw.c                     |    2 
 hw/xfree86/glamor_egl/Makefile.am                |    3 
 hw/xfree86/glamor_egl/glamor_xf86_xv.c           |  185 ++
 hw/xfree86/i2c/Makefile.am                       |   36 
 hw/xfree86/i2c/bt829.c                           |  822 -----------
 hw/xfree86/i2c/bt829.h                           |  103 -
 hw/xfree86/i2c/bt829_module.c                    |   20 
 hw/xfree86/i2c/fi1236.c                          |  686 ---------
 hw/xfree86/i2c/fi1236.h                          |  113 -
 hw/xfree86/i2c/fi1236_module.c                   |   24 
 hw/xfree86/i2c/msp3430.c                         |  779 ----------
 hw/xfree86/i2c/msp3430.h                         |  116 -
 hw/xfree86/i2c/msp3430_module.c                  |   24 
 hw/xfree86/i2c/tda8425.c                         |   83 -
 hw/xfree86/i2c/tda8425.h                         |   44 
 hw/xfree86/i2c/tda8425_module.c                  |   24 
 hw/xfree86/i2c/tda9850.c                         |  136 -
 hw/xfree86/i2c/tda9850.h                         |   43 
 hw/xfree86/i2c/tda9850_module.c                  |   24 
 hw/xfree86/i2c/tda9885.c                         |  100 -
 hw/xfree86/i2c/tda9885.h                         |   63 
 hw/xfree86/i2c/tda9885_module.c                  |   24 
 hw/xfree86/i2c/uda1380.c                         |  196 --
 hw/xfree86/i2c/uda1380.h                         |   81 -
 hw/xfree86/i2c/uda1380_module.c                  |   24 
 hw/xfree86/i2c/xf86i2c.c                         |   40 
 hw/xfree86/i2c/xf86i2c.h                         |    2 
 hw/xfree86/int10/generic.c                       |   52 
 hw/xfree86/loader/loader.c                       |   23 
 hw/xfree86/loader/loadmod.c                      |  164 --
 hw/xfree86/man/xorg.conf.man                     |   99 +
 hw/xfree86/modes/Makefile.am                     |    1 
 hw/xfree86/modes/xf86Crtc.c                      |    4 
 hw/xfree86/modes/xf86Crtc.h                      |   10 
 hw/xfree86/modes/xf86DisplayIDModes.c            |  444 -----
 hw/xfree86/modes/xf86RandR12.c                   |    4 
 hw/xfree86/modes/xf86Rotate.c                    |   21 
 hw/xfree86/modes/xf86cvt.c                       |    4 
 hw/xfree86/modes/xf86gtf.c                       |   10 
 hw/xfree86/os-support/bsd/Makefile.am            |    4 
 hw/xfree86/os-support/bsd/alpha_video.c          |  466 ------
 hw/xfree86/os-support/bsd/arm_video.c            |  451 ------
 hw/xfree86/os-support/bsd/bsd_apm.c              |    2 
 hw/xfree86/os-support/bsd/bsd_axp.c              |   71 
 hw/xfree86/os-support/bsd/bsd_bell.c             |   20 
 hw/xfree86/os-support/bsd/bsd_ev56.c             |   24 
 hw/xfree86/os-support/bsd/bsd_init.c             |   24 
 hw/xfree86/os-support/bsd/bsd_kqueue_apm.c       |   16 
 hw/xfree86/os-support/bsd/i386_video.c           |  584 -------
 hw/xfree86/os-support/bsd/ppc_video.c            |   76 -
 hw/xfree86/os-support/bsd/sparc64_video.c        |   60 
 hw/xfree86/os-support/bus/xf86Pci.h              |   21 
 hw/xfree86/os-support/hurd/Makefile.am           |    2 
 hw/xfree86/os-support/hurd/hurd_mmap.c           |   94 -
 hw/xfree86/os-support/hurd/hurd_video.c          |   69 
 hw/xfree86/os-support/linux/Makefile.am          |   10 
 hw/xfree86/os-support/linux/int10/linux.c        |   19 
 hw/xfree86/os-support/linux/lnx_agp.c            |    4 
 hw/xfree86/os-support/linux/lnx_axp.c            |  103 -
 hw/xfree86/os-support/linux/lnx_ev56.c           |   24 
 hw/xfree86/os-support/linux/lnx_init.c           |    6 
 hw/xfree86/os-support/linux/lnx_kmod.c           |    2 
 hw/xfree86/os-support/linux/lnx_platform.c       |   65 
 hw/xfree86/os-support/linux/lnx_video.c          |  688 ---------
 hw/xfree86/os-support/linux/systemd-logind.c     |    2 
 hw/xfree86/os-support/misc/SlowBcopy.c           |    8 
 hw/xfree86/os-support/shared/bios_mmap.c         |  135 -
 hw/xfree86/os-support/shared/ioperm_noop.c       |    2 
 hw/xfree86/os-support/shared/sigio.c             |    6 
 hw/xfree86/os-support/shared/vidmem.c            |  205 --
 hw/xfree86/os-support/shared/xf86Axp.c           |   60 
 hw/xfree86/os-support/shared/xf86Axp.h           |   33 
 hw/xfree86/os-support/solaris/sun_apm.c          |    2 
 hw/xfree86/os-support/solaris/sun_vid.c          |  140 -
 hw/xfree86/os-support/stub/Makefile.am           |    1 
 hw/xfree86/os-support/stub/stub_bios.c           |   12 
 hw/xfree86/os-support/xf86OSpriv.h               |   13 
 hw/xfree86/os-support/xf86_OSlib.h               |   34 
 hw/xfree86/os-support/xf86_OSproc.h              |   54 
 hw/xfree86/parser/Configint.h                    |   18 
 hw/xfree86/parser/DRI.c                          |    8 
 hw/xfree86/parser/Device.c                       |   26 
 hw/xfree86/parser/Files.c                        |   14 
 hw/xfree86/parser/Flags.c                        |   16 
 hw/xfree86/parser/Input.c                        |   16 
 hw/xfree86/parser/Layout.c                       |   16 
 hw/xfree86/parser/Makefile.am                    |    1 
 hw/xfree86/parser/Module.c                       |   16 
 hw/xfree86/parser/Monitor.c                      |   18 
 hw/xfree86/parser/OutputClass.c                  |  167 ++
 hw/xfree86/parser/Pointer.c                      |   16 
 hw/xfree86/parser/Screen.c                       |   16 
 hw/xfree86/parser/Vendor.c                       |   16 
 hw/xfree86/parser/Video.c                        |   16 
 hw/xfree86/parser/configProcs.h                  |    5 
 hw/xfree86/parser/read.c                         |   28 
 hw/xfree86/parser/scan.c                         |   36 
 hw/xfree86/parser/write.c                        |   16 
 hw/xfree86/parser/xf86Optrec.h                   |   18 
 hw/xfree86/parser/xf86Parser.h                   |   28 
 hw/xfree86/parser/xf86tokens.h                   |   19 
 hw/xfree86/ramdac/IBM.c                          |    4 
 hw/xfree86/ramdac/TI.c                           |    2 
 hw/xfree86/ramdac/xf86Cursor.c                   |    6 
 hw/xfree86/ramdac/xf86HWCurs.c                   |    2 
 hw/xfree86/ramdac/xf86RamDac.h                   |    4 
 hw/xfree86/ramdac/xf86RamDacCmap.c               |    1 
 hw/xfree86/sdksyms.sh                            |    3 
 hw/xfree86/shadowfb/shadowfb.h                   |    2 
 hw/xfree86/utils/gtf/gtf.c                       |   26 
 hw/xfree86/vbe/vbe.c                             |    4 
 hw/xfree86/vbe/vbe.h                             |    4 
 hw/xfree86/vgahw/Makefile.am                     |    2 
 hw/xfree86/vgahw/vgaCmap.c                       |  276 ---
 hw/xfree86/vgahw/vgaHW.c                         |    8 
 hw/xfree86/vgahw/vgaHW.h                         |    2 
 hw/xfree86/x86emu/debug.c                        |    4 
 hw/xfree86/x86emu/ops.c                          |   22 
 hw/xfree86/x86emu/prim_ops.c                     |   70 
 hw/xfree86/x86emu/sys.c                          |    6 
 hw/xfree86/x86emu/x86emu/regs.h                  |   10 
 hw/xfree86/x86emu/x86emu/x86emui.h               |    2 
 hw/xnest/Color.c                                 |    2 
 hw/xnest/GC.c                                    |   56 
 hw/xnest/Window.c                                |    4 
 hw/xnest/XNGC.h                                  |    1 
 hw/xnest/XNWindow.h                              |    3 
 hw/xnest/Xnest.h                                 |    2 
 hw/xquartz/darwin.c                              |    8 
 hw/xquartz/darwinEvents.c                        |    4 
 hw/xquartz/xpr/dri.c                             |   72 
 hw/xquartz/xpr/dri.h                             |   12 
 hw/xquartz/xpr/xprScreen.c                       |   23 
 hw/xwayland/Makefile.am                          |   31 
 hw/xwayland/drm.xml                              |  182 ++
 hw/xwayland/xwayland-glamor.c                    |  569 +++++++
 hw/xwayland/xwayland-input.c                     |   51 
 hw/xwayland/xwayland.c                           |   87 -
 hw/xwayland/xwayland.h                           |   19 
 hw/xwin/InitInput.c                              |    3 
 hw/xwin/InitOutput.c                             |   58 
 hw/xwin/Makefile.am                              |   71 
 hw/xwin/XWin.rc                                  |    1 
 hw/xwin/ddraw.h                                  |    6 
 hw/xwin/glx/.gitignore                           |    5 
 hw/xwin/glx/gen_gl_wrappers.py                   |   13 
 hw/xwin/glx/glshim.c                             |    3 
 hw/xwin/glx/glwindows.h                          |    5 
 hw/xwin/glx/indirect.c                           |   19 
 hw/xwin/glx/winpriv.c                            |    2 
 hw/xwin/man/XWin.man                             |   10 
 hw/xwin/win.h                                    |  186 --
 hw/xwin/winSetAppUserModelID.c                   |    2 
 hw/xwin/winclip.c                                |   42 
 hw/xwin/winclipboard.h                           |  126 -
 hw/xwin/winclipboard/Makefile.am                 |   25 
 hw/xwin/winclipboard/debug.c                     |   52 
 hw/xwin/winclipboard/internal.h                  |  117 +
 hw/xwin/winclipboard/textconv.c                  |  151 ++
 hw/xwin/winclipboard/thread.c                    |  504 ++++++
 hw/xwin/winclipboard/winclipboard.h              |   38 
 hw/xwin/winclipboard/wndproc.c                   |  596 +++++++
 hw/xwin/winclipboard/xevents.c                   |  864 +++++++++++
 hw/xwin/winclipboard/xwinclip.c                  |  134 +
 hw/xwin/winclipboard/xwinclip.man                |   64 
 hw/xwin/winclipboardinit.c                       |  150 +-
 hw/xwin/winclipboardtextconv.c                   |  147 -
 hw/xwin/winclipboardthread.c                     |  467 ------
 hw/xwin/winclipboardwndproc.c                    |  529 -------
 hw/xwin/winclipboardwrappers.c                   |  232 ---
 hw/xwin/winclipboardxevents.c                    |  703 ---------
 hw/xwin/wincmap.c                                |    2 
 hw/xwin/winconfig.c                              |   10 
 hw/xwin/winconfig.h                              |    1 
 hw/xwin/wincreatewnd.c                           |   26 
 hw/xwin/wincursor.c                              |   10 
 hw/xwin/windialogs.c                             |   19 
 hw/xwin/windisplay.c                             |   64 
 hw/xwin/windisplay.h                             |   34 
 hw/xwin/winengine.c                              |   23 
 hw/xwin/winfillsp.c                              |  842 -----------
 hw/xwin/winfont.c                                |   82 -
 hw/xwin/wingc.c                                  |  235 ---
 hw/xwin/wingetsp.c                               |  171 --
 hw/xwin/winglobals.c                             |   13 
 hw/xwin/winglobals.h                             |    4 
 hw/xwin/winlayouts.h                             |    2 
 hw/xwin/winmisc.c                                |   63 
 hw/xwin/winmsg.h                                 |    2 
 hw/xwin/winmsgwindow.c                           |    5 
 hw/xwin/winmultiwindowicons.c                    |    4 
 hw/xwin/winmultiwindowshape.c                    |    2 
 hw/xwin/winmultiwindowwindow.c                   |   20 
 hw/xwin/winmultiwindowwm.c                       |    9 
 hw/xwin/winmultiwindowwndproc.c                  |    4 
 hw/xwin/winnativegdi.c                           |  491 ------
 hw/xwin/winpfbdd.c                               |  620 --------
 hw/xwin/winpixmap.c                              |  223 --
 hw/xwin/winpolyline.c                            |   53 
 hw/xwin/winprefs.c                               |   10 
 hw/xwin/winprefslex.l                            |    2 
 hw/xwin/winprefsyacc.y                           |   11 
 hw/xwin/winprocarg.c                             |   27 
 hw/xwin/winresource.h                            |    1 
 hw/xwin/winrop.c                                 |  142 -
 hw/xwin/winscrinit.c                             |  143 -
 hw/xwin/winsetsp.c                               |  175 --
 hw/xwin/winshaddd.c                              |    8 
 hw/xwin/winshadddnl.c                            |   10 
 hw/xwin/winshadgdi.c                             |   10 
 hw/xwin/wintrayicon.c                            |   19 
 hw/xwin/winwin32rootlesswndproc.c                |    2 
 hw/xwin/winwindow.c                              |  219 --
 hw/xwin/winwindowswm.c                           |    2 
 hw/xwin/winwndproc.c                             |   29 
 include/callback.h                               |   18 
 include/closure.h                                |    8 
 include/colormap.h                               |   24 
 include/colormapst.h                             |    8 
 include/cursor.h                                 |   12 
 include/cursorstr.h                              |   10 
 include/dbus-core.h                              |    2 
 include/dix-config.h.in                          |   22 
 include/dix.h                                    |   90 -
 include/dixfont.h                                |   10 
 include/dixgrabs.h                               |    4 
 include/extension.h                              |    8 
 include/extnsionst.h                             |   10 
 include/gc.h                                     |   12 
 include/gcstruct.h                               |   63 
 include/hotplug.h                                |   67 
 include/input.h                                  |   19 
 include/inputstr.h                               |   14 
 include/list.h                                   |    2 
 include/misc.h                                   |   18 
 include/miscstruct.h                             |    8 
 include/os.h                                     |  100 -
 include/pixmap.h                                 |   28 
 include/pixmapstr.h                              |   11 
 include/property.h                               |   44 
 include/propertyst.h                             |   10 
 include/region.h                                 |    8 
 include/regionstr.h                              |   12 
 include/registry.h                               |   40 
 include/resource.h                               |   84 -
 include/rgb.h                                    |    8 
 include/screenint.h                              |    8 
 include/scrnintstr.h                             |  134 +
 include/selection.h                              |   10 
 include/servermd.h                               |  289 ---
 include/site.h                                   |   14 
 include/window.h                                 |   28 
 include/windowstr.h                              |   11 
 include/xkbfile.h                                |   18 
 include/xkbsrv.h                                 |   34 
 include/xkbstr.h                                 |   24 
 include/xorg-config.h.in                         |    6 
 include/xorg-server.h.in                         |    7 
 include/xsha1.h                                  |    2 
 man/Xserver.man                                  |   17 
 mi/Makefile.am                                   |   11 
 mi/mi.h                                          |  149 -
 mi/miarc.c                                       |  255 +++
 mi/mibitblt.c                                    |   48 
 mi/micmap.c                                      |   44 
 mi/micoord.h                                     |   20 
 mi/micopy.c                                      |    8 
 mi/micursor.c                                    |   68 
 mi/midash.c                                      |    9 
 mi/midispcur.c                                   |    4 
 mi/mieq.c                                        |    4 
 mi/miexpose.c                                    |  127 -
 mi/mifillarc.c                                   |  151 --
 mi/mifillarc.h                                   |    9 
 mi/mifillrct.c                                   |   10 
 mi/mifpoly.h                                     |   50 
 mi/mifpolycon.c                                  |  249 ---
 mi/migc.c                                        |   45 
 mi/miglblt.c                                     |    8 
 mi/miinitext.c                                   |    8 
 mi/mioverlay.c                                   |   72 
 mi/mipointer.c                                   |   19 
 mi/mipoly.c                                      |  627 ++++++++
 mi/mipoly.h                                      |   22 
 mi/mipolycon.c                                   |  235 ---
 mi/mipolygen.c                                   |  213 --
 mi/mipolypnt.c                                   |    8 
 mi/mipolyrect.c                                  |    8 
 mi/mipolyseg.c                                   |   10 
 mi/mipolytext.c                                  |    8 
 mi/mipolyutil.c                                  |  369 ----
 mi/mipushpxl.c                                   |    8 
 mi/miscrinit.c                                   |    5 
 mi/mispans.c                                     |  526 -------
 mi/mispans.h                                     |   87 -
 mi/misprite.c                                    |    4 
 mi/mistruct.h                                    |    8 
 mi/mivaltree.c                                   |   72 
 mi/miwideline.c                                  |  546 +++++++
 mi/miwideline.h                                  |   26 
 mi/miwindow.c                                    |   63 
 mi/mizerarc.c                                    |    2 
 mi/mizerclip.c                                   |    8 
 mi/mizerline.c                                   |   28 
 miext/damage/damage.c                            |    2 
 miext/rootless/rootless.h                        |    2 
 miext/rootless/rootlessGC.c                      |    2 
 miext/rootless/rootlessValTree.c                 |   97 -
 miext/rootless/rootlessWindow.c                  |    6 
 miext/shadow/shadow.c                            |   54 
 miext/shadow/shadow.h                            |    6 
 miext/shadow/shrotate.c                          |    2 
 miext/sync/misyncfd.c                            |    4 
 os/WaitFor.c                                     |   18 
 os/access.c                                      |   97 -
 os/busfault.c                                    |    2 
 os/connection.c                                  |   25 
 os/io.c                                          |   17 
 os/log.c                                         |   21 
 os/oscolor.c                                     | 1562 ++++++++++----------
 os/osdep.h                                       |    8 
 os/osinit.c                                      |   14 
 os/rpcauth.c                                     |    4 
 os/utils.c                                       |   84 -
 os/xdmcp.c                                       |    2 
 present/present.c                                |   81 -
 present/present.h                                |    1 
 present/present_event.c                          |    2 
 present/present_priv.h                           |    2 
 present/present_request.c                        |    6 
 present/present_screen.c                         |    1 
 randr/randrstr.h                                 |   20 
 randr/rrpointer.c                                |   11 
 randr/rrprovider.c                               |    2 
 randr/rrsdispatch.c                              |    4 
 randr/rrtransform.c                              |    2 
 randr/rrtransform.h                              |    2 
 randr/rrxinerama.c                               |    2 
 record/record.c                                  |   20 
 render/animcur.c                                 |    2 
 render/glyph.c                                   |    2 
 render/glyphstr.h                                |    2 
 render/mipict.c                                  |   34 
 render/mipict.h                                  |    2 
 render/mirect.c                                  |    2 
 render/picture.c                                 |  129 -
 render/picture.h                                 |    8 
 render/picturestr.h                              |    6 
 render/render.c                                  |   24 
 test/Makefile.am                                 |    7 
 test/list.c                                      |   24 
 test/misc.c                                      |   37 
 test/signal-logging.c                            |    7 
 test/xi1/Makefile.am                             |   34 
 test/xi1/protocol-xchangedevicecontrol.c         |  122 +
 test/xi2/protocol-common.c                       |   26 
 test/xi2/protocol-xigetclientpointer.c           |    5 
 test/xi2/protocol-xipassivegrabdevice.c          |    8 
 test/xi2/protocol-xiquerypointer.c               |    4 
 test/xi2/protocol-xiwarppointer.c                |    3 
 xfixes/cursor.c                                  |   22 
 xfixes/region.c                                  |   27 
 xfixes/select.c                                  |    1 
 xkb/XKBAlloc.c                                   |   16 
 xkb/XKBGAlloc.c                                  |   16 
 xkb/XKBMAlloc.c                                  |   18 
 xkb/XKBMisc.c                                    |   16 
 xkb/ddxBeep.c                                    |   16 
 xkb/ddxCtrls.c                                   |   16 
 xkb/ddxKillSrv.c                                 |   16 
 xkb/ddxLEDs.c                                    |   16 
 xkb/ddxLoad.c                                    |   16 
 xkb/ddxVT.c                                      |   16 
 xkb/maprules.c                                   |   18 
 xkb/xkb.c                                        |   18 
 xkb/xkbAccessX.c                                 |   18 
 xkb/xkbActions.c                                 |   16 
 xkb/xkbEvents.c                                  |   25 
 xkb/xkbInit.c                                    |   22 
 xkb/xkbLEDs.c                                    |   44 
 xkb/xkbPrKeyEv.c                                 |   16 
 xkb/xkbSwap.c                                    |   16 
 xkb/xkbUtils.c                                   |   16 
 xkb/xkbfmisc.c                                   |   18 
 xkb/xkbgeom.h                                    |   16 
 xkb/xkbout.c                                     |   18 
 xkb/xkbtext.c                                    |   18 
 xkb/xkmread.c                                    |   18 
 684 files changed, 20667 insertions(+), 29488 deletions(-)

New commits:
commit 91651e7c15892aa846fc406fbb13b37f094dd3f0
Author: Michel Dänzer <michel.daenzer@amd.com>
Date:   Wed Dec 10 16:21:44 2014 +0900

    glamor: Reinstate glamor_(egl_)destroy_textured_pixmap
    
    They are part of the ABI.
    
    Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
    Reviewed-by: Keith Packard <keithp@keithp.com>
    Signed-off-by: Keith Packard <keithp@keithp.com>

diff --git a/glamor/glamor.c b/glamor/glamor.c
index 6cf9bdf..b32cc16 100644
--- a/glamor/glamor.c
+++ b/glamor/glamor.c
@@ -216,8 +216,8 @@ glamor_create_pixmap(ScreenPtr screen, int w, int h, int depth,
     return pixmap;
 }
 
-Bool
-glamor_destroy_pixmap(PixmapPtr pixmap)
+void
+glamor_destroy_textured_pixmap(PixmapPtr pixmap)
 {
     if (pixmap->refcnt == 1) {
         glamor_pixmap_private *pixmap_priv = glamor_get_pixmap_private(pixmap);
@@ -227,6 +227,12 @@ glamor_destroy_pixmap(PixmapPtr pixmap)
         glamor_egl_destroy_pixmap_image(pixmap);
 #endif
     }
+}
+
+Bool
+glamor_destroy_pixmap(PixmapPtr pixmap)
+{
+    glamor_destroy_textured_pixmap(pixmap);
     return fbDestroyPixmap(pixmap);
 }
 
diff --git a/glamor/glamor.h b/glamor/glamor.h
index 1683414..95c4253 100644
--- a/glamor/glamor.h
+++ b/glamor/glamor.h
@@ -132,6 +132,7 @@ extern _X_EXPORT void glamor_set_pixmap_texture(PixmapPtr pixmap,
 
 extern _X_EXPORT void glamor_set_pixmap_type(PixmapPtr pixmap,
                                              glamor_pixmap_type_t type);
+extern _X_EXPORT void glamor_destroy_textured_pixmap(PixmapPtr pixmap);
 extern _X_EXPORT void glamor_block_handler(ScreenPtr screen);
 
 extern _X_EXPORT PixmapPtr glamor_create_pixmap(ScreenPtr screen, int w, int h,
diff --git a/glamor/glamor_egl.c b/glamor/glamor_egl.c
index e821601..898081a 100644
--- a/glamor/glamor_egl.c
+++ b/glamor/glamor_egl.c
@@ -558,6 +558,12 @@ glamor_egl_exchange_buffers(PixmapPtr front, PixmapPtr back)
 
 }
 
+void
+glamor_egl_destroy_textured_pixmap(PixmapPtr pixmap)
+{
+    glamor_destroy_textured_pixmap(pixmap);
+}
+
 static Bool
 glamor_egl_close_screen(ScreenPtr screen)
 {

commit c1455f76c6b1aa4ecaacb2221a687244285aa44b
Author: Neil Roberts <neil@linux.intel.com>
Date:   Mon Dec 1 16:06:17 2014 -0500

    glx: Add implementation of __GLXContext->loseCurrent for direct ctxts
    
    This adds a dummy implementation for the loseCurrent function in
    __GLXContext for direct contexts which just returns GL_TRUE. Without
    this then the X server can crash if receives a MakeCurrent message for
    a direct context because it will attempt to call loseCurrent when
    cleaning up the client in the callback for ClientStateGone.
    
    [ajax: added assumed s-o-b line]
    
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=86531
    Reviewed-by: Adam Jackson <ajax@redhat.com>
    Signed-off-by: Neil Roberts <neil@linux.intel.com>
    Signed-off-by: Keith Packard <keithp@keithp.com>

diff --git a/glx/glxcmds.c b/glx/glxcmds.c
index bd6cb8d..e836af8 100644
--- a/glx/glxcmds.c
+++ b/glx/glxcmds.c
@@ -198,6 +198,12 @@ __glXdirectContextDestroy(__GLXcontext * context)
     free(context);
 }
 
+static int
+__glXdirectContextLoseCurrent(__GLXcontext * context)
+{
+    return GL_TRUE;
+}
+
 _X_HIDDEN __GLXcontext *
 __glXdirectContextCreate(__GLXscreen * screen,
                          __GLXconfig * modes, __GLXcontext * shareContext)
@@ -209,6 +215,7 @@ __glXdirectContextCreate(__GLXscreen * screen,
         return NULL;
 
     context->destroy = __glXdirectContextDestroy;
+    context->loseCurrent = __glXdirectContextLoseCurrent;
 
     return context;
 }

commit 9b037af0410bb1f63d370d8b8be06135de7af600
Author: Julien Cristau <jcristau@debian.org>
Date:   Tue Dec 9 20:55:02 2014 +0100

    Bump to 1.16.2.901
    
    Signed-off-by: Julien Cristau <jcristau@debian.org>

diff --git a/configure.ac b/configure.ac
index 39bea68..9308912 100644
--- a/configure.ac
+++ b/configure.ac
@@ -26,8 +26,8 @@ dnl
 dnl Process this file with autoconf to create configure.
 
 AC_PREREQ(2.60)
-AC_INIT([xorg-server], 1.16.2, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
-RELEASE_DATE="2014-11-10"
+AC_INIT([xorg-server], 1.16.2.901, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
+RELEASE_DATE="2014-12-09"
 RELEASE_NAME="Marionberry Pie"
 AC_CONFIG_SRCDIR([Makefile.am])
 AC_CONFIG_MACRO_DIR([m4])

commit f7ff55a374d91f8b513159809ed41c3e029a6074
Author: Keith Packard <keithp@keithp.com>
Date:   Tue Dec 9 09:31:00 2014 -0800

    dix: GetHosts bounds check using wrong pointer value [CVE-2014-8092 pt. 6]
    
    GetHosts saves the pointer to allocated memory in *data, and then
    wants to bounds-check writes to that region, but was mistakenly using
    a bare 'data' instead of '*data'. Also, data is declared as void **,
    so we need a cast to turn it into a byte pointer so we can actually do
    pointer comparisons.
    
    Signed-off-by: Keith Packard <keithp@keithp.com>
    Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
    (cherry picked from commit 1559a94395258fd73e369f1a2c98a44bfe21a486)
    Signed-off-by: Julien Cristau <jcristau@debian.org>

diff --git a/os/access.c b/os/access.c
index e5a0672..61624fd 100644
--- a/os/access.c
+++ b/os/access.c
@@ -1335,7 +1335,7 @@ GetHosts(void **data, int *pnHosts, int *pLen, BOOL * pEnabled)
         }
         for (host = validhosts; host; host = host->next) {
             len = host->len;
-            if ((ptr + sizeof(xHostEntry) + len) > (data + n))
+            if ((ptr + sizeof(xHostEntry) + len) > ((unsigned char *) *data + n))
                 break;
             ((xHostEntry *) ptr)->family = host->family;
             ((xHostEntry *) ptr)->length = len;

commit 8e7c4380a56ab05412f630e9b6e02580cb04a804
Author: Keith Packard <keithp@keithp.com>
Date:   Tue Dec 9 09:30:59 2014 -0800

    Missing parens in REQUEST_FIXED_SIZE macro [CVE-2014-8092 pt. 5]
    
    The 'n' parameter must be surrounded by parens in both places to
    prevent precedence from mis-computing things.
    
    Signed-off-by: Keith Packard <keithp@keithp.com>
    Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
    (cherry picked from commit 9802a0162f738de03585ca3f3b8a8266494f7d45)
    Signed-off-by: Julien Cristau <jcristau@debian.org>

diff --git a/include/dix.h b/include/dix.h
index 4189286..c5c86b6 100644
--- a/include/dix.h
+++ b/include/dix.h
@@ -80,7 +80,7 @@ SOFTWARE.
 
 #define REQUEST_FIXED_SIZE(req, n)\
     if (((sizeof(req) >> 2) > client->req_len) || \
-        ((n >> 2) >= client->req_len) || \
+        (((n) >> 2) >= client->req_len) ||                              \
         ((((uint64_t) sizeof(req) + (n) + 3) >> 2) != (uint64_t) client->req_len))  \
          return(BadLength)
 

commit 1069ca99298bf1e85e001bfde90b00a42afdb5d8
Author: Keith Packard <keithp@keithp.com>
Date:   Tue Dec 9 09:30:58 2014 -0800

    glx: Can't mix declarations and code in X.org sources [CVE-2014-8098 pt. 9]
    
    We're using compiler compatibility settings which generate warnings
    when a variable is declared after the first statement.
    
    Signed-off-by: Keith Packard <keithp@keithp.com>
    Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
    (cherry picked from commit 61b17c0f10307e25e51e30e6fb1d3e3127f82d86)
    Signed-off-by: Julien Cristau <jcristau@debian.org>

diff --git a/glx/clientinfo.c b/glx/clientinfo.c
index c5fef30..74ad919 100644
--- a/glx/clientinfo.c
+++ b/glx/clientinfo.c
@@ -36,13 +36,14 @@ set_client_info(__GLXclientState * cl, xGLXSetClientInfoARBReq * req,
     ClientPtr client = cl->client;
     char *gl_extensions;
     char *glx_extensions;
+    int size;
 
     REQUEST_AT_LEAST_SIZE(xGLXSetClientInfoARBReq);
 
     /* Verify that the size of the packet matches the size inferred from the
      * sizes specified for the various fields.
      */
-    int size = sz_xGLXSetClientInfoARBReq;
+    size = sz_xGLXSetClientInfoARBReq;
     size = safe_add(size, safe_mul(req->numVersions, bytes_per_version));
     size = safe_add(size, safe_pad(req->numGLExtensionBytes));
     size = safe_add(size, safe_pad(req->numGLXExtensionBytes));

commit 044764b5c627d1a6e8ea1dd8cf741a26aeb4b2e7
Author: Keith Packard <keithp@keithp.com>
Date:   Tue Dec 9 09:30:57 2014 -0800

    dbe: Call to DDX SwapBuffers requires address of int, not unsigned int [CVE-2014-8097 pt. 2]
    
    When the local types used to walk the DBE request were changed, this
    changed the type of the parameter passed to the DDX SwapBuffers API,
    but there wasn't a matching change in the API definition.
    
    At this point, with the API frozen, I just stuck a new variable in
    with the correct type. Because we've already bounds-checked nStuff to
    be smaller than UINT32_MAX / sizeof(DbeSwapInfoRec), we know it will
    fit in a signed int without overflow.
    
    Signed-off-by: Keith Packard <keithp@keithp.com
    Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
    (cherry picked from commit b20912c3d45cbbde3c443e6c3d9e189092fe65e1)
    Signed-off-by: Julien Cristau <jcristau@debian.org>

diff --git a/dbe/dbe.c b/dbe/dbe.c
index 719e640..fc3d475 100644
--- a/dbe/dbe.c
+++ b/dbe/dbe.c
@@ -452,6 +452,7 @@ ProcDbeSwapBuffers(ClientPtr client)
     int error;
     unsigned int i, j;
     unsigned int nStuff;
+    int nStuff_i;       /* DDX API requires int for nStuff */
 
     REQUEST_AT_LEAST_SIZE(xDbeSwapBuffersReq);
     nStuff = stuff->n;          /* use local variable for performance. */
@@ -527,9 +528,10 @@ ProcDbeSwapBuffers(ClientPtr client)
      * could deal with cross-screen synchronization.
      */
 
-    while (nStuff > 0) {
+    nStuff_i = nStuff;
+    while (nStuff_i > 0) {
         pDbeScreenPriv = DBE_SCREEN_PRIV_FROM_WINDOW(swapInfo[0].pWindow);
-        error = (*pDbeScreenPriv->SwapBuffers) (client, &nStuff, swapInfo);
+        error = (*pDbeScreenPriv->SwapBuffers) (client, &nStuff_i, swapInfo);
         if (error != Success) {
             free(swapInfo);
             return error;

commit 1559a94395258fd73e369f1a2c98a44bfe21a486
Author: Keith Packard <keithp@keithp.com>
Date:   Tue Dec 9 09:31:00 2014 -0800

    dix: GetHosts bounds check using wrong pointer value [CVE-2014-8092 pt. 6]
    
    GetHosts saves the pointer to allocated memory in *data, and then
    wants to bounds-check writes to that region, but was mistakenly using
    a bare 'data' instead of '*data'. Also, data is declared as void **,
    so we need a cast to turn it into a byte pointer so we can actually do
    pointer comparisons.
    
    Signed-off-by: Keith Packard <keithp@keithp.com>
    Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>

diff --git a/os/access.c b/os/access.c
index f393c8d..28f2d32 100644
--- a/os/access.c
+++ b/os/access.c
@@ -1308,7 +1308,7 @@ GetHosts(void **data, int *pnHosts, int *pLen, BOOL * pEnabled)
         }
         for (host = validhosts; host; host = host->next) {
             len = host->len;
-            if ((ptr + sizeof(xHostEntry) + len) > (data + n))
+            if ((ptr + sizeof(xHostEntry) + len) > ((unsigned char *) *data + n))
                 break;
             ((xHostEntry *) ptr)->family = host->family;
             ((xHostEntry *) ptr)->length = len;


Reply to: