[gentoo-commits] gentoo-x86 commit in x11-base/xorg-server/files/1.4.0.90: 0001-Bug-13308-Verify-and-reject-obviously-broken-modes.patch 0002-bgPixel-unsigned-long-is-64-bit-on-x86_64-so-1.patch 0003-Xprint-Clean-up-generated-files.patch 0004-Config-D-Bus-Don-t-leak-timers.patch 0005-Config-HAL-Don-t-leak-options-on-failure-to-add-de.patch 0006-OS-Don-t-leak-connection-translation-table-on-regen.patch 0007-KDrive-Xephyr-Don-t-leak-screen-damage-structure.patch 0008-Input-Don-t-reinit-devices.patch 0009-include-never-overwrite-realInputProc-with-enqueueI.patch 0010-OS-IO-Zero-out-client-buffers.patch 0011-XKB-XkbCopyKeymap-Don-t-leak-all-the-sections.patch 0012-Xephyr-One-time-keyboard-leak-fix.patch 0013-Fix-for-CVE-2007-5760-XFree86-Misc-extension-out-o.patch 0014-Fix-for-CVE-2007-6428-TOG-cup-extension-memory-cor.patch 0015-Fix-for-CVE-2007-6427-Xinput-extension-memory-corr.patch 0016-Fix-for-CVE-2007-6429-MIT-SHM-and-EVI-extensions-i.patch 0017-Fix-for-CVE-2008-00 06-PCF-Font-parse r-buffer-overf.patch 0018-Fix-for-CVE-2007-5958-File-existence-disclosure.patch 0019-CVE-2007-6429-Don-t-spuriously-reject-8bpp-shm-pix.patch 0020-dix-set-the-correct-number-of-valuators-in-valuator.patch 0021-xkb-don-t-update-LEDs-if-they-don-t-exist.-Bug-13.patch 0022-security-Fix-for-Bug-14480-untrusted-access-broke.patch 0023-Resize-composite-overlay-window-when-the-root-window.patch 0024-Fix-rotation-for-multi-monitor-situation.patch 0025-Don-t-break-grab-and-focus-state-for-a-window-when-r.patch 0026-CVE-2007-6429-Always-test-for-size-offset-wrapping.patch 0027-Fix-context-sharing-between-direct-indirect-contexts.patch 0028-Add-some-more-support-for-DragonFly.-From-Joerg-Sonn.patch 0029-configure.ac-DragonFly-BSD-support.patch 0030-Fixed-configure.ac-for-autoconf-2.62.patch 0031-EXA-Fix-off-by-one-in-polyline-drawing.patch 0032-XKB-Fix-processInputProc-wrapping.patch 0033-xfree86-fix-AlwaysCore-handling.-Bug-14256.patch 0034-Ignore-not-just-block-SIGALRM-around-Popen-P cl.patch 0035-Fix-build-on-FreeBSD-after-Popen-changes.patch 0036-So-like-checking-return-codes-of-system-calls-sig.patch 0037-Check-for-sys-sdt.h-as-well-when-determining-to-en.patch 0038-dix-Always-add-valuator-information-if-present.patch 0039-Bug-10324-dix-Allow-arbitrary-value-ranges-in-Ge.patch 0040-Bug-10324-dix-Add-scaling-of-X-and-Y-on-the-repo.patch 0041-dix-Skip-call-to-clipAxis-for-relative-core-events.patch 0042-dix-Move-motion-history-update-until-after-screen-c.patch 0043-XKB-Actually-explain-keymap-failures.patch

[Donnie Berkholz (dberkholz)]

dberkholz    08/05/08 08:20:44

  Added:               
                        0001-Bug-13308-Verify-and-reject-obviously-broken-modes.patch
                        0002-bgPixel-unsigned-long-is-64-bit-on-x86_64-so-1.patch
                        0003-Xprint-Clean-up-generated-files.patch
                        0004-Config-D-Bus-Don-t-leak-timers.patch
                        0005-Config-HAL-Don-t-leak-options-on-failure-to-add-de.patch
                        0006-OS-Don-t-leak-connection-translation-table-on-regen.patch
                        0007-KDrive-Xephyr-Don-t-leak-screen-damage-structure.patch
                        0008-Input-Don-t-reinit-devices.patch
                        0009-include-never-overwrite-realInputProc-with-enqueueI.patch
                        0010-OS-IO-Zero-out-client-buffers.patch
                        0011-XKB-XkbCopyKeymap-Don-t-leak-all-the-sections.patch
                        0012-Xephyr-One-time-keyboard-leak-fix.patch
                        0013-Fix-for-CVE-2007-5760-XFree86-Misc-extension-out-o.patch
                        0014-Fix-for-CVE-2007-6428-TOG-cup-extension-memory-cor.patch
                        0015-Fix-for-CVE-2007-6427-Xinput-extension-memory-corr.patch
                        0016-Fix-for-CVE-2007-6429-MIT-SHM-and-EVI-extensions-i.patch
                        0017-Fix-for-CVE-2008-0006-PCF-Font-parser-buffer-overf.patch
                        0018-Fix-for-CVE-2007-5958-File-existence-disclosure.patch
                        0019-CVE-2007-6429-Don-t-spuriously-reject-8bpp-shm-pix.patch
                        0020-dix-set-the-correct-number-of-valuators-in-valuator.patch
                        0021-xkb-don-t-update-LEDs-if-they-don-t-exist.-Bug-13.patch
                        0022-security-Fix-for-Bug-14480-untrusted-access-broke.patch
                        0023-Resize-composite-overlay-window-when-the-root-window.patch
                        0024-Fix-rotation-for-multi-monitor-situation.patch
                        0025-Don-t-break-grab-and-focus-state-for-a-window-when-r.patch
                        0026-CVE-2007-6429-Always-test-for-size-offset-wrapping.patch
                        0027-Fix-context-sharing-between-direct-indirect-contexts.patch
                        0028-Add-some-more-support-for-DragonFly.-From-Joerg-Sonn.patch
                        0029-configure.ac-DragonFly-BSD-support.patch
                        0030-Fixed-configure.ac-for-autoconf-2.62.patch
                        0031-EXA-Fix-off-by-one-in-polyline-drawing.patch
                        0032-XKB-Fix-processInputProc-wrapping.patch
                        0033-xfree86-fix-AlwaysCore-handling.-Bug-14256.patch
                        0034-Ignore-not-just-block-SIGALRM-around-Popen-Pcl.patch
                        0035-Fix-build-on-FreeBSD-after-Popen-changes.patch
                        0036-So-like-checking-return-codes-of-system-calls-sig.patch
                        0037-Check-for-sys-sdt.h-as-well-when-determining-to-en.patch
                        0038-dix-Always-add-valuator-information-if-present.patch
                        0039-Bug-10324-dix-Allow-arbitrary-value-ranges-in-Ge.patch
                        0040-Bug-10324-dix-Add-scaling-of-X-and-Y-on-the-repo.patch
                        0041-dix-Skip-call-to-clipAxis-for-relative-core-events.patch
                        0042-dix-Move-motion-history-update-until-after-screen-c.patch
                        0043-XKB-Actually-explain-keymap-failures.patch
  Log:
  Add an unkeyworded new revision with tons of fixes from upstream's 1.4 branch. More patches may be coming soon, and rekeywording is pending on that. I expect this to be a candidate for stable.
  (Portage version: 2.1.5_rc7)
   (Signed Manifest commit)

Revision  Changes    Path
1.1                  x11-base/xorg-server/files/1.4.0.90/0001-Bug-13308-Verify-and-reject-obviously-broken-modes.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0001-Bug-13308-Verify-and-reject-obviously-broken-modes.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0001-Bug-13308-Verify-and-reject-obviously-broken-modes.patch?rev=1.1&content-type=text/plain

Index: 0001-Bug-13308-Verify-and-reject-obviously-broken-modes.patch
===================================================================
From f4bcb53e86bb103b6bcf8a3a170a36137c34d272 Mon Sep 17 00:00:00 2001
From: Hong Liu <hong.liu@×××××.com>
Date: Wed, 5 Dec 2007 17:48:28 +0100
Subject: [PATCH] Bug 13308: Verify and reject obviously broken modes.
 (cherry picked from commit c6cfcd408df3e44d0094946c0a7d2fa944b4d2d1)

---
 hw/xfree86/modes/xf86EdidModes.c |    6 ++++++
 1 files changed, 6 insertions(+), 0 deletions(-)

diff --git a/hw/xfree86/modes/xf86EdidModes.c b/hw/xfree86/modes/xf86EdidModes.c
index 8b5e69d..e2ae665 100644
--- a/hw/xfree86/modes/xf86EdidModes.c
+++ b/hw/xfree86/modes/xf86EdidModes.c
@@ -239,6 +239,12 @@ DDCModeFromDetailedTiming(int scrnIndex, struct detailed_timings *timing,
     Mode->VSyncEnd = Mode->VSyncStart + timing->v_sync_width;
     Mode->VTotal = timing->v_active + timing->v_blanking;
 
+    /* perform basic check on the detail timing */
+    if (Mode->HSyncEnd > Mode->HTotal || Mode->VSyncEnd > Mode->VTotal) {
+	xfree(Mode);
+	return NULL;
+    }
+
     xf86SetModeDefaultName(Mode);
 
     /* We ignore h/v_size and h/v_border for now. */
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0002-bgPixel-unsigned-long-is-64-bit-on-x86_64-so-1.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0002-bgPixel-unsigned-long-is-64-bit-on-x86_64-so-1.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0002-bgPixel-unsigned-long-is-64-bit-on-x86_64-so-1.patch?rev=1.1&content-type=text/plain

Index: 0002-bgPixel-unsigned-long-is-64-bit-on-x86_64-so-1.patch
===================================================================
From 41f735fbe02f59bc7bcca335c6e743c72c2fc44c Mon Sep 17 00:00:00 2001
From: Hong Liu <hong.liu@×××××.com>
Date: Tue, 4 Sep 2007 08:46:46 +0100
Subject: [PATCH] bgPixel (unsigned long) is 64-bit on x86_64, so -1 != 0xffffffff

This patch should fix bug 8080.
(cherry picked from commit 9adea807038b64292403ede982075fe1dcfd4c9a)
---
 hw/xfree86/xaa/xaaGC.c |    9 +++++----
 1 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/hw/xfree86/xaa/xaaGC.c b/hw/xfree86/xaa/xaaGC.c
index f3434c9..b3dc83a 100644
--- a/hw/xfree86/xaa/xaaGC.c
+++ b/hw/xfree86/xaa/xaaGC.c
@@ -80,10 +80,11 @@ XAAValidateGC(
     }
 
     if(pGC->depth != 32) {
-	if(pGC->bgPixel == -1) /* -1 is reserved for transparency */
-	    pGC->bgPixel = 0x7fffffff; 
-	if(pGC->fgPixel == -1) /* -1 is reserved for transparency */
-	    pGC->fgPixel = 0x7fffffff; 
+	/* 0xffffffff is reserved for transparency */
+	if(pGC->bgPixel == 0xffffffff)
+	    pGC->bgPixel = 0x7fffffff;
+	if(pGC->fgPixel == 0xffffffff)
+	    pGC->fgPixel = 0x7fffffff;
     }
 
     if((pDraw->type == DRAWABLE_PIXMAP) && !IS_OFFSCREEN_PIXMAP(pDraw)){
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0003-Xprint-Clean-up-generated-files.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0003-Xprint-Clean-up-generated-files.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0003-Xprint-Clean-up-generated-files.patch?rev=1.1&content-type=text/plain

Index: 0003-Xprint-Clean-up-generated-files.patch
===================================================================
From d988da6eee8422774dff364050bf431b843a714a Mon Sep 17 00:00:00 2001
From: Arkadiusz Miskiewicz <arekm@×××××.pl>
Date: Thu, 13 Dec 2007 00:09:08 +0200
Subject: [PATCH] Xprint: Clean up generated files

Remember to clean generated wrapper files.
(cherry picked from commit 977fcdea8198906936a64b8117e6a6d027c617e3)
---
 hw/xprint/Makefile.am |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/hw/xprint/Makefile.am b/hw/xprint/Makefile.am
index dc8764a..f834966 100644
--- a/hw/xprint/Makefile.am
+++ b/hw/xprint/Makefile.am
@@ -41,3 +41,5 @@ Xprt_SOURCES =			\
         $(top_srcdir)/fb/fbcmap_mi.c
 
 EXTRA_DIST = ValTree.c
+
+CLEANFILES = miinitext-wrapper.c dpmsstubs-wrapper.c
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0004-Config-D-Bus-Don-t-leak-timers.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0004-Config-D-Bus-Don-t-leak-timers.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0004-Config-D-Bus-Don-t-leak-timers.patch?rev=1.1&content-type=text/plain

Index: 0004-Config-D-Bus-Don-t-leak-timers.patch
===================================================================
From 81c5950d0af8d5859f850b98c98a532784e9a757 Mon Sep 17 00:00:00 2001
From: Daniel Stone <daniel@×××××××××.org>
Date: Fri, 28 Dec 2007 15:47:21 +0200
Subject: [PATCH] Config: D-Bus: Don't leak timers

TimerCancel doesn't free the timer: you need TimerFree for that.
(cherry picked from commit 25deaa7e6b29b3913b35efa39b9c8b25de5e6d95)
---
 config/dbus-core.c |    5 ++++-
 1 files changed, 4 insertions(+), 1 deletions(-)

diff --git a/config/dbus-core.c b/config/dbus-core.c
index eab72a5..9cf1530 100644
--- a/config/dbus-core.c
+++ b/config/dbus-core.c
@@ -76,7 +76,7 @@ teardown(void)
     struct config_dbus_core_hook *hook;
 
     if (bus_info.timer) {
-        TimerCancel(bus_info.timer);
+        TimerFree(bus_info.timer);
         bus_info.timer = NULL;
     }
 
@@ -116,6 +116,8 @@ message_filter(DBusConnection *connection, DBusMessage *message, void *data)
         bus_info.connection = NULL;
         teardown();
 
+        if (bus_info.timer)
+            TimerFree(bus_info.timer);
         bus_info.timer = TimerSet(NULL, 0, 1, reconnect_timer, NULL);
 
         return DBUS_HANDLER_RESULT_HANDLED;
@@ -186,6 +188,7 @@ static CARD32
 reconnect_timer(OsTimerPtr timer, CARD32 time, pointer arg)
 {
     if (connect_to_bus()) {
+        TimerFree(bus_info.timer);
         bus_info.timer = NULL;
         return 0;
     }
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0005-Config-HAL-Don-t-leak-options-on-failure-to-add-de.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0005-Config-HAL-Don-t-leak-options-on-failure-to-add-de.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0005-Config-HAL-Don-t-leak-options-on-failure-to-add-de.patch?rev=1.1&content-type=text/plain

Index: 0005-Config-HAL-Don-t-leak-options-on-failure-to-add-de.patch
===================================================================
From 30fc8053a5e734c3b70156bdae94fd7d5d7865a5 Mon Sep 17 00:00:00 2001
From: Daniel Stone <daniel@×××××××××.org>
Date: Fri, 28 Dec 2007 15:47:57 +0200
Subject: [PATCH] Config: HAL: Don't leak options on failure to add device

This showed up in Xephyr in particular, which denies new device requests.
(cherry picked from commit 2bb199056edf6c63cf978d1a8ad49a57ce1938f3)
---
 config/hal.c |   11 ++++++++++-
 1 files changed, 10 insertions(+), 1 deletions(-)

diff --git a/config/hal.c b/config/hal.c
index 4427deb..16f16ec 100644
--- a/config/hal.c
+++ b/config/hal.c
@@ -92,6 +92,8 @@ add_option(InputOption **options, const char *key, const char *value)
     for (; *options; options = &(*options)->next)
         ;
     *options = xcalloc(sizeof(**options), 1);
+    if (!*options) /* Yeesh. */
+        return;
     (*options)->key = xstrdup(key);
     (*options)->value = xstrdup(value);
     (*options)->next = NULL;
@@ -156,7 +158,7 @@ device_added(LibHalContext *hal_ctx, const char *udi)
     char *path = NULL, *driver = NULL, *name = NULL, *xkb_rules = NULL;
     char *xkb_model = NULL, *xkb_layout = NULL, *xkb_variant = NULL;
     char *xkb_options = NULL, *config_info = NULL;
-    InputOption *options = NULL;
+    InputOption *options = NULL, *tmpo = NULL;
     DeviceIntPtr dev;
     DBusError error;
     int type = TYPE_NONE;
@@ -232,6 +234,7 @@ device_added(LibHalContext *hal_ctx, const char *udi)
 
     if (NewInputDeviceRequest(options, &dev) != Success) {
         DebugF("[config/hal] NewInputDeviceRequest failed\n");
+        dev = NULL;
         goto unwind;
     }
 
@@ -255,6 +258,12 @@ unwind:
         xfree(xkb_options);
     if (config_info)
         xfree(config_info);
+    while (!dev && (tmpo = options)) {
+        options = tmpo->next;
+        xfree(tmpo->key);
+        xfree(tmpo->value);
+        xfree(tmpo);
+    }
 
 out_error:
     dbus_error_free(&error);
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0006-OS-Don-t-leak-connection-translation-table-on-regen.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0006-OS-Don-t-leak-connection-translation-table-on-regen.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0006-OS-Don-t-leak-connection-translation-table-on-regen.patch?rev=1.1&content-type=text/plain

Index: 0006-OS-Don-t-leak-connection-translation-table-on-regen.patch
===================================================================
From 38d8cfaaff0ae6273d9e921aae08b2706355f0d2 Mon Sep 17 00:00:00 2001
From: Daniel Stone <daniel@×××××××××.org>
Date: Fri, 28 Dec 2007 15:48:25 +0200
Subject: [PATCH] OS: Don't leak connection translation table on regeneration
 (cherry picked from commit e868e0bc0d2318e62707d3ae68532b0029959154)

---
 os/connection.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/os/connection.c b/os/connection.c
index b944593..d1ba845 100644
--- a/os/connection.c
+++ b/os/connection.c
@@ -353,7 +353,8 @@ InitConnectionLimits(void)
 #endif
 
 #if !defined(WIN32)
-    ConnectionTranslation = (int *)xnfalloc(sizeof(int)*(lastfdesc + 1));
+    if (!ConnectionTranslation)
+        ConnectionTranslation = (int *)xnfalloc(sizeof(int)*(lastfdesc + 1));
 #else
     InitConnectionTranslation();
 #endif
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0007-KDrive-Xephyr-Don-t-leak-screen-damage-structure.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0007-KDrive-Xephyr-Don-t-leak-screen-damage-structure.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0007-KDrive-Xephyr-Don-t-leak-screen-damage-structure.patch?rev=1.1&content-type=text/plain

Index: 0007-KDrive-Xephyr-Don-t-leak-screen-damage-structure.patch
===================================================================
From a304fc1d4a7062f65161ef8748fd358639ec73de Mon Sep 17 00:00:00 2001
From: Daniel Stone <daniel@×××××××××.org>
Date: Fri, 28 Dec 2007 15:48:57 +0200
Subject: [PATCH] KDrive: Xephyr: Don't leak screen damage structure
 (cherry picked from commit 0b03d97a244540824c922c300adbc3d3ae4855d5)

---
 hw/kdrive/ephyr/ephyr.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/hw/kdrive/ephyr/ephyr.c b/hw/kdrive/ephyr/ephyr.c
index e8001df..27165a5 100644
--- a/hw/kdrive/ephyr/ephyr.c
+++ b/hw/kdrive/ephyr/ephyr.c
@@ -394,6 +394,7 @@ ephyrUnsetInternalDamage (ScreenPtr pScreen)
   
   pPixmap = (*pScreen->GetScreenPixmap) (pScreen);
   DamageUnregister (&pPixmap->drawable, scrpriv->pDamage);
+  DamageDestroy (scrpriv->pDamage);
   
   RemoveBlockAndWakeupHandlers (ephyrInternalDamageBlockHandler,
 				ephyrInternalDamageWakeupHandler,
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0008-Input-Don-t-reinit-devices.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0008-Input-Don-t-reinit-devices.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0008-Input-Don-t-reinit-devices.patch?rev=1.1&content-type=text/plain

Index: 0008-Input-Don-t-reinit-devices.patch
===================================================================
From 102c012c206cbb3bbf0fa5b0c8f0ce2ce9bba72a Mon Sep 17 00:00:00 2001
From: Daniel Stone <daniel@×××××××××.org>
Date: Fri, 28 Dec 2007 15:49:50 +0200
Subject: [PATCH] Input: Don't reinit devices

If a device is already initialised (i.e. the virtual core devices) during
IASD, don't init them again.  This fixes a leak.
(cherry picked from commit 1f6015c8fe62c28cfaa82cc855b5b9c28fd34607)
---
 dix/devices.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/dix/devices.c b/dix/devices.c
index 287d730..f6f3c8e 100644
--- a/dix/devices.c
+++ b/dix/devices.c
@@ -473,7 +473,8 @@ InitAndStartDevices(void)
 
     for (dev = inputInfo.off_devices; dev; dev = dev->next) {
         DebugF("(dix) initialising device %d\n", dev->id);
-	ActivateDevice(dev);
+        if (!dev->inited)
+            ActivateDevice(dev);
     }
     for (dev = inputInfo.off_devices; dev; dev = next)
     {
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0009-include-never-overwrite-realInputProc-with-enqueueI.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0009-include-never-overwrite-realInputProc-with-enqueueI.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0009-include-never-overwrite-realInputProc-with-enqueueI.patch?rev=1.1&content-type=text/plain

Index: 0009-include-never-overwrite-realInputProc-with-enqueueI.patch
===================================================================
From 60144ac814ee26e151186f7c93cb1a273468d497 Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter@××××××××××××.au>
Date: Wed, 19 Dec 2007 16:20:36 +1030
Subject: [PATCH] include: never overwrite realInputProc with enqueueInputProc. Bug #13511

In some cases (triggered by a key repeat during a sync grab) XKB unwrapping
can overwrite the device's realInputProc with the enqueueInputProc. When the
grab is released and the events are replayed, we end up in an infinite loop.
Each event is replayed and in replaying pushed to the end of the queue again.

This fix is a hack only. It ensures that the realInputProc is never
overwritten with the enqueueInputProc.

This fixes Bug #13511 (https://bugs.freedesktop.org/show_bug.cgi?id=13511)
(cherry picked from commit eace88989c3b65d5c20e9f37ea9b23c7c8e19335)
(cherry picked from commit 50e80c39870adfdc84fdbc00dddf1362117ad443)
---
 include/xkbsrv.h |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/include/xkbsrv.h b/include/xkbsrv.h
index 167dbec..9174eb6 100644
--- a/include/xkbsrv.h
+++ b/include/xkbsrv.h
@@ -258,7 +258,8 @@ typedef struct
 	    device->public.processInputProc = proc; \
 	oldprocs->processInputProc = \
 	oldprocs->realInputProc = device->public.realInputProc; \
-	device->public.realInputProc = proc; \
+	if (proc != device->public.enqueueInputProc) \
+		device->public.realInputProc = proc; \
 	oldprocs->unwrapProc = device->unwrapProc; \
 	device->unwrapProc = unwrapproc;
 
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0010-OS-IO-Zero-out-client-buffers.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0010-OS-IO-Zero-out-client-buffers.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0010-OS-IO-Zero-out-client-buffers.patch?rev=1.1&content-type=text/plain

Index: 0010-OS-IO-Zero-out-client-buffers.patch
===================================================================
From 02e805f0ff4b6af551372ba5fc5fb369c8834d1d Mon Sep 17 00:00:00 2001
From: Daniel Stone <daniel@×××××××××.org>
Date: Sat, 5 Jan 2008 10:38:16 +0200
Subject: [PATCH] OS: IO: Zero out client buffers

For alignment reasons, we can write out uninitialised bytes, so allocate
the whole thing with xcalloc.
(cherry picked from commit b99a43dfe97c1813e1c61f298b1c83c5d5ca88a2)
---
 os/io.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/os/io.c b/os/io.c
index 9de75ee..a8b84fb 100644
--- a/os/io.c
+++ b/os/io.c
@@ -1197,7 +1197,7 @@ AllocateOutputBuffer(void)
     oco = (ConnectionOutputPtr)xalloc(sizeof(ConnectionOutput));
     if (!oco)
 	return (ConnectionOutputPtr)NULL;
-    oco->buf = (unsigned char *) xalloc(BUFSIZE);
+    oco->buf = (unsigned char *) xcalloc(1, BUFSIZE);
     if (!oco->buf)
     {
 	xfree(oco);
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0011-XKB-XkbCopyKeymap-Don-t-leak-all-the-sections.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0011-XKB-XkbCopyKeymap-Don-t-leak-all-the-sections.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0011-XKB-XkbCopyKeymap-Don-t-leak-all-the-sections.patch?rev=1.1&content-type=text/plain

Index: 0011-XKB-XkbCopyKeymap-Don-t-leak-all-the-sections.patch
===================================================================
From 8a3acd3ec41b887b4aeaa0b2932265522c1e2836 Mon Sep 17 00:00:00 2001
From: Daniel Stone <daniel@×××××××××.org>
Date: Sat, 5 Jan 2008 10:43:53 +0200
Subject: [PATCH] XKB: XkbCopyKeymap: Don't leak all the sections

Previously, we'd just keep num_sections at 0, which would break the
geometry and lead us to leak sections.  Don't do that.
(cherry picked from commit 0137b0394a248f694448a7d97c9a1a3efcf24e81)
---
 xkb/xkbUtils.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/xkb/xkbUtils.c b/xkb/xkbUtils.c
index c7f9a26..e90df0d 100644
--- a/xkb/xkbUtils.c
+++ b/xkb/xkbUtils.c
@@ -1770,6 +1770,7 @@ XkbCopyKeymap(XkbDescPtr src, XkbDescPtr dst, Bool sendNotifies)
             if (!tmp)
                 return FALSE;
             dst->geom->sections = tmp;
+            dst->geom->num_sections = src->geom->num_sections;
 
             for (i = 0,
                   ssection = src->geom->sections,
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0012-Xephyr-One-time-keyboard-leak-fix.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0012-Xephyr-One-time-keyboard-leak-fix.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0012-Xephyr-One-time-keyboard-leak-fix.patch?rev=1.1&content-type=text/plain

Index: 0012-Xephyr-One-time-keyboard-leak-fix.patch
===================================================================
From 636aa9e7be2822a0148067a11499ad48fe682cd9 Mon Sep 17 00:00:00 2001
From: Daniel Stone <daniel@×××××××××.org>
Date: Sat, 5 Jan 2008 10:47:39 +0200
Subject: [PATCH] Xephyr: One-time keyboard leak fix

Don't leak the originally-allocated keysym map.
(cherry picked from commit e85130c85f727466fc27be1cfa46c88b257499fb)
---
 hw/kdrive/ephyr/ephyr.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/hw/kdrive/ephyr/ephyr.c b/hw/kdrive/ephyr/ephyr.c
index 27165a5..86e8f1f 100644
--- a/hw/kdrive/ephyr/ephyr.c
+++ b/hw/kdrive/ephyr/ephyr.c
@@ -915,6 +915,7 @@ EphyrKeyboardInit (KdKeyboardInfo *ki)
   ki->minScanCode = ki->keySyms.minKeyCode;
   ki->maxScanCode = ki->keySyms.maxKeyCode;
   ki->keySyms.mapWidth = ephyrKeySyms.mapWidth;
+  xfree(ki->keySyms.map);
   ki->keySyms.map = ephyrKeySyms.map;
   ki->name = KdSaveString("Xephyr virtual keyboard");
   ephyrKbd = ki;
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0013-Fix-for-CVE-2007-5760-XFree86-Misc-extension-out-o.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0013-Fix-for-CVE-2007-5760-XFree86-Misc-extension-out-o.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0013-Fix-for-CVE-2007-5760-XFree86-Misc-extension-out-o.patch?rev=1.1&content-type=text/plain

Index: 0013-Fix-for-CVE-2007-5760-XFree86-Misc-extension-out-o.patch
===================================================================
From 59a3b83922c810316a374a19484b24901c7437ae Mon Sep 17 00:00:00 2001
From: Matthieu Herrb <matthieu@××××××××××××××.com>
Date: Thu, 17 Jan 2008 15:26:41 +0100
Subject: [PATCH] Fix for CVE-2007-5760 - XFree86 Misc extension out of bounds array index

---
 hw/xfree86/common/xf86MiscExt.c |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

diff --git a/hw/xfree86/common/xf86MiscExt.c b/hw/xfree86/common/xf86MiscExt.c
index c1b9c60..40c196a 100644
--- a/hw/xfree86/common/xf86MiscExt.c
+++ b/hw/xfree86/common/xf86MiscExt.c
@@ -548,6 +548,10 @@ MiscExtPassMessage(int scrnIndex, const char *msgtype, const char *msgval,
 {
     ScrnInfoPtr pScr = xf86Screens[scrnIndex];
 
+    /* should check this in the protocol, but xf86NumScreens isn't exported */
+    if (scrnIndex >= xf86NumScreens)
+	return BadValue;
+
     if (*pScr->HandleMessage == NULL)
 	    return BadImplementation;
     return (*pScr->HandleMessage)(scrnIndex, msgtype, msgval, retstr);
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0014-Fix-for-CVE-2007-6428-TOG-cup-extension-memory-cor.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0014-Fix-for-CVE-2007-6428-TOG-cup-extension-memory-cor.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0014-Fix-for-CVE-2007-6428-TOG-cup-extension-memory-cor.patch?rev=1.1&content-type=text/plain

Index: 0014-Fix-for-CVE-2007-6428-TOG-cup-extension-memory-cor.patch
===================================================================
From 4848d49d05a318559afe7a17a19ba055947ee1f5 Mon Sep 17 00:00:00 2001
From: Matthieu Herrb <matthieu@××××××××××××××.com>
Date: Thu, 17 Jan 2008 15:28:03 +0100
Subject: [PATCH] Fix for CVE-2007-6428 - TOG-cup extension memory corruption.

---
 Xext/cup.c |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)

diff --git a/Xext/cup.c b/Xext/cup.c
index 6bfa278..781b9ce 100644
--- a/Xext/cup.c
+++ b/Xext/cup.c
@@ -196,6 +196,9 @@ int ProcGetReservedColormapEntries(
 
     REQUEST_SIZE_MATCH (xXcupGetReservedColormapEntriesReq);
 
+    if (stuff->screen >= screenInfo.numScreens)
+	return BadValue;
+
 #ifndef HAVE_SPECIAL_DESKTOP_COLORS
     citems[CUP_BLACK_PIXEL].pixel = 
 	screenInfo.screens[stuff->screen]->blackPixel;
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0015-Fix-for-CVE-2007-6427-Xinput-extension-memory-corr.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0015-Fix-for-CVE-2007-6427-Xinput-extension-memory-corr.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0015-Fix-for-CVE-2007-6427-Xinput-extension-memory-corr.patch?rev=1.1&content-type=text/plain

Index: 0015-Fix-for-CVE-2007-6427-Xinput-extension-memory-corr.patch
===================================================================
From d244c8272e0ac47c41a9416e37293903b842a78b Mon Sep 17 00:00:00 2001
From: Matthieu Herrb <matthieu@××××××××××××××.com>
Date: Thu, 17 Jan 2008 15:27:34 +0100
Subject: [PATCH] Fix for CVE-2007-6427 - Xinput extension memory corruption.

---
 Xi/chgfctl.c  |    7 +------
 Xi/chgkmap.c  |   13 ++++++-------
 Xi/chgprop.c  |   10 +++-------
 Xi/grabdev.c  |   12 +++++-------
 Xi/grabdevb.c |   10 +++-------
 Xi/grabdevk.c |    9 ++-------
 Xi/selectev.c |   11 ++++-------
 Xi/sendexev.c |   14 ++++++++------
 8 files changed, 32 insertions(+), 54 deletions(-)

diff --git a/Xi/chgfctl.c b/Xi/chgfctl.c
index 2e0e13c..235d659 100644
--- a/Xi/chgfctl.c
+++ b/Xi/chgfctl.c
@@ -327,18 +327,13 @@ ChangeStringFeedback(ClientPtr client, DeviceIntPtr dev,
 		     xStringFeedbackCtl * f)
 {
     char n;
-    long *p;
     int i, j;
     KeySym *syms, *sup_syms;
 
     syms = (KeySym *) (f + 1);
     if (client->swapped) {
 	swaps(&f->length, n);	/* swapped num_keysyms in calling proc */
-	p = (long *)(syms);
-	for (i = 0; i < f->num_keysyms; i++) {
-	    swapl(p, n);
-	    p++;
-	}
+	SwapLongs((CARD32 *) syms, f->num_keysyms);
     }
 
     if (f->num_keysyms > s->ctrl.max_symbols) {
diff --git a/Xi/chgkmap.c b/Xi/chgkmap.c
index eac520f..f8f85bc 100644
--- a/Xi/chgkmap.c
+++ b/Xi/chgkmap.c
@@ -79,18 +79,14 @@ int
 SProcXChangeDeviceKeyMapping(ClientPtr client)
 {
     char n;
-    long *p;
-    int i, count;
+    unsigned int count;
 
     REQUEST(xChangeDeviceKeyMappingReq);
     swaps(&stuff->length, n);
     REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq);
-    p = (long *)&stuff[1];
     count = stuff->keyCodes * stuff->keySymsPerKeyCode;
-    for (i = 0; i < count; i++) {
-	swapl(p, n);
-	p++;
-    }
+    REQUEST_FIXED_SIZE(xChangeDeviceKeyMappingReq, count * sizeof(CARD32));
+    SwapLongs((CARD32 *) (&stuff[1]), count);
     return (ProcXChangeDeviceKeyMapping(client));
 }
 
@@ -106,10 +102,13 @@ ProcXChangeDeviceKeyMapping(ClientPtr client)
     int ret;
     unsigned len;
     DeviceIntPtr dev;
+    unsigned int count;
 
     REQUEST(xChangeDeviceKeyMappingReq);
     REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq);
 
+    count = stuff->keyCodes * stuff->keySymsPerKeyCode;
+    REQUEST_FIXED_SIZE(xChangeDeviceKeyMappingReq, count * sizeof(CARD32));
     dev = LookupDeviceIntRec(stuff->deviceid);
     if (dev == NULL) {
 	SendErrorToClient(client, IReqCode, X_ChangeDeviceKeyMapping, 0,
diff --git a/Xi/chgprop.c b/Xi/chgprop.c
index 59a93c6..21bda5b 100644
--- a/Xi/chgprop.c
+++ b/Xi/chgprop.c
@@ -81,19 +81,15 @@ int
 SProcXChangeDeviceDontPropagateList(ClientPtr client)
 {
     char n;
-    long *p;
-    int i;
 
     REQUEST(xChangeDeviceDontPropagateListReq);
     swaps(&stuff->length, n);
     REQUEST_AT_LEAST_SIZE(xChangeDeviceDontPropagateListReq);
     swapl(&stuff->window, n);
     swaps(&stuff->count, n);
-    p = (long *)&stuff[1];
-    for (i = 0; i < stuff->count; i++) {
-	swapl(p, n);
-	p++;
-    }
+    REQUEST_FIXED_SIZE(xChangeDeviceDontPropagateListReq,
+                      stuff->count * sizeof(CARD32));
+    SwapLongs((CARD32 *) (&stuff[1]), stuff->count);
     return (ProcXChangeDeviceDontPropagateList(client));
 }
 
diff --git a/Xi/grabdev.c b/Xi/grabdev.c
index e2809ef..d0b4ae7 100644
--- a/Xi/grabdev.c
+++ b/Xi/grabdev.c
@@ -82,8 +82,6 @@ int
 SProcXGrabDevice(ClientPtr client)
 {
     char n;
-    long *p;
-    int i;
 
     REQUEST(xGrabDeviceReq);
     swaps(&stuff->length, n);
@@ -91,11 +89,11 @@ SProcXGrabDevice(ClientPtr client)
     swapl(&stuff->grabWindow, n);
     swapl(&stuff->time, n);
     swaps(&stuff->event_count, n);
-    p = (long *)&stuff[1];
-    for (i = 0; i < stuff->event_count; i++) {
-	swapl(p, n);
-	p++;
-    }
+
+    if (stuff->length != (sizeof(xGrabDeviceReq) >> 2) + stuff->event_count)
+       return BadLength;
+    
+    SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);
 
     return (ProcXGrabDevice(client));
 }
diff --git a/Xi/grabdevb.c b/Xi/grabdevb.c
index df62d0c..18db1f7 100644
--- a/Xi/grabdevb.c
+++ b/Xi/grabdevb.c
@@ -80,8 +80,6 @@ int
 SProcXGrabDeviceButton(ClientPtr client)
 {
     char n;
-    long *p;
-    int i;
 
     REQUEST(xGrabDeviceButtonReq);
     swaps(&stuff->length, n);
@@ -89,11 +87,9 @@ SProcXGrabDeviceButton(ClientPtr client)
     swapl(&stuff->grabWindow, n);
     swaps(&stuff->modifiers, n);
     swaps(&stuff->event_count, n);
-    p = (long *)&stuff[1];
-    for (i = 0; i < stuff->event_count; i++) {
-	swapl(p, n);
-	p++;
-    }
+    REQUEST_FIXED_SIZE(xGrabDeviceButtonReq,
+                      stuff->event_count * sizeof(CARD32));
+    SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);
 
     return (ProcXGrabDeviceButton(client));
 }
diff --git a/Xi/grabdevk.c b/Xi/grabdevk.c
index b74592f..429b2f7 100644
--- a/Xi/grabdevk.c
+++ b/Xi/grabdevk.c
@@ -80,8 +80,6 @@ int
 SProcXGrabDeviceKey(ClientPtr client)
 {
     char n;
-    long *p;
-    int i;
 
     REQUEST(xGrabDeviceKeyReq);
     swaps(&stuff->length, n);
@@ -89,11 +87,8 @@ SProcXGrabDeviceKey(ClientPtr client)
     swapl(&stuff->grabWindow, n);
     swaps(&stuff->modifiers, n);
     swaps(&stuff->event_count, n);
-    p = (long *)&stuff[1];
-    for (i = 0; i < stuff->event_count; i++) {
-	swapl(p, n);
-	p++;
-    }
+    REQUEST_FIXED_SIZE(xGrabDeviceKeyReq, stuff->event_count * sizeof(CARD32));
+    SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);
     return (ProcXGrabDeviceKey(client));
 }
 
diff --git a/Xi/selectev.c b/Xi/selectev.c
index d52db1b..19415c5 100644
--- a/Xi/selectev.c
+++ b/Xi/selectev.c
@@ -131,19 +131,16 @@ int
 SProcXSelectExtensionEvent(ClientPtr client)
 {
     char n;
-    long *p;
-    int i;
 
     REQUEST(xSelectExtensionEventReq);
     swaps(&stuff->length, n);
     REQUEST_AT_LEAST_SIZE(xSelectExtensionEventReq);
     swapl(&stuff->window, n);
     swaps(&stuff->count, n);
-    p = (long *)&stuff[1];
-    for (i = 0; i < stuff->count; i++) {
-	swapl(p, n);
-	p++;
-    }
+    REQUEST_FIXED_SIZE(xSelectExtensionEventReq,
+                      stuff->count * sizeof(CARD32));
+    SwapLongs((CARD32 *) (&stuff[1]), stuff->count);
+
     return (ProcXSelectExtensionEvent(client));
 }
 
diff --git a/Xi/sendexev.c b/Xi/sendexev.c
index eac9abe..9803cf3 100644
--- a/Xi/sendexev.c
+++ b/Xi/sendexev.c
@@ -83,7 +83,7 @@ int
 SProcXSendExtensionEvent(ClientPtr client)
 {
     char n;
-    long *p;
+    CARD32 *p;
     int i;
     xEvent eventT;
     xEvent *eventP;
@@ -94,6 +94,11 @@ SProcXSendExtensionEvent(ClientPtr client)
     REQUEST_AT_LEAST_SIZE(xSendExtensionEventReq);
     swapl(&stuff->destination, n);
     swaps(&stuff->count, n);
+
+    if (stuff->length != (sizeof(xSendExtensionEventReq) >> 2) + stuff->count +
+       (stuff->num_events * (sizeof(xEvent) >> 2)))
+       return BadLength;
+
     eventP = (xEvent *) & stuff[1];
     for (i = 0; i < stuff->num_events; i++, eventP++) {
 	proc = EventSwapVector[eventP->u.u.type & 0177];
@@ -103,11 +108,8 @@ SProcXSendExtensionEvent(ClientPtr client)
 	*eventP = eventT;
     }
 
-    p = (long *)(((xEvent *) & stuff[1]) + stuff->num_events);
-    for (i = 0; i < stuff->count; i++) {
-	swapl(p, n);
-	p++;
-    }
+    p = (CARD32 *)(((xEvent *) & stuff[1]) + stuff->num_events);
+    SwapLongs(p, stuff->count);
     return (ProcXSendExtensionEvent(client));
 }
 
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0016-Fix-for-CVE-2007-6429-MIT-SHM-and-EVI-extensions-i.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0016-Fix-for-CVE-2007-6429-MIT-SHM-and-EVI-extensions-i.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0016-Fix-for-CVE-2007-6429-MIT-SHM-and-EVI-extensions-i.patch?rev=1.1&content-type=text/plain

Index: 0016-Fix-for-CVE-2007-6429-MIT-SHM-and-EVI-extensions-i.patch
===================================================================
From 8b14f7b74284900b95a319ec80c4333e63af2296 Mon Sep 17 00:00:00 2001
From: Matthieu Herrb <matthieu@××××××××××××××.com>
Date: Thu, 17 Jan 2008 15:28:42 +0100
Subject: [PATCH] Fix for CVE-2007-6429 - MIT-SHM and EVI extensions integer overflows.

---
 Xext/EVI.c       |   15 ++++++++++++++-
 Xext/sampleEVI.c |   29 ++++++++++++++++++++++++-----
 Xext/shm.c       |   46 ++++++++++++++++++++++++++++++++++++++--------
 3 files changed, 76 insertions(+), 14 deletions(-)

diff --git a/Xext/EVI.c b/Xext/EVI.c
index 8fe3481..13bd32a 100644
--- a/Xext/EVI.c
+++ b/Xext/EVI.c
@@ -34,6 +34,7 @@ THE USE OR PERFORMANCE OF THIS SOFTWARE.
 #include <X11/extensions/XEVIstr.h>
 #include "EVIstruct.h"
 #include "modinit.h"
+#include "scrnintstr.h"
 
 #if 0
 static unsigned char XEVIReqCode = 0;
@@ -87,10 +88,22 @@ ProcEVIGetVisualInfo(ClientPtr client)
 {
     REQUEST(xEVIGetVisualInfoReq);
     xEVIGetVisualInfoReply rep;
-    int n, n_conflict, n_info, sz_info, sz_conflict;
+    int i, n, n_conflict, n_info, sz_info, sz_conflict;
     VisualID32 *conflict;
+    unsigned int total_visuals = 0;
     xExtendedVisualInfo *eviInfo;
     int status;
+
+    /*
+     * do this first, otherwise REQUEST_FIXED_SIZE can overflow.  we assume
+     * here that you don't have more than 2^32 visuals over all your screens;
+     * this seems like a safe assumption.
+     */
+    for (i = 0; i < screenInfo.numScreens; i++)
+	total_visuals += screenInfo.screens[i]->numVisuals;
+    if (stuff->n_visual > total_visuals)
+	return BadValue;
+
     REQUEST_FIXED_SIZE(xEVIGetVisualInfoReq, stuff->n_visual * sz_VisualID32);
     status = eviPriv->getVisualInfo((VisualID32 *)&stuff[1], (int)stuff->n_visual,
 		&eviInfo, &n_info, &conflict, &n_conflict);
diff --git a/Xext/sampleEVI.c b/Xext/sampleEVI.c
index 7508aa7..b871bfd 100644
--- a/Xext/sampleEVI.c
+++ b/Xext/sampleEVI.c
@@ -34,6 +34,13 @@ THE USE OR PERFORMANCE OF THIS SOFTWARE.
 #include <X11/extensions/XEVIstr.h>
 #include "EVIstruct.h"
 #include "scrnintstr.h"
+
+#if HAVE_STDINT_H
+#include <stdint.h>
+#elif !defined(UINT32_MAX)
+#define UINT32_MAX 0xffffffffU
+#endif
+
 static int sampleGetVisualInfo(
     VisualID32 *visual,
     int n_visual,
@@ -42,24 +49,36 @@ static int sampleGetVisualInfo(
     VisualID32 **conflict_rn,
     int *n_conflict_rn)
 {
-    int max_sz_evi = n_visual * sz_xExtendedVisualInfo * screenInfo.numScreens;
+    unsigned int max_sz_evi;
     VisualID32 *temp_conflict;
     xExtendedVisualInfo *evi;
-    int max_visuals = 0, max_sz_conflict, sz_conflict = 0;
+    unsigned int max_visuals = 0, max_sz_conflict, sz_conflict = 0;
     register int visualI, scrI, sz_evi = 0, conflictI, n_conflict;
-    *evi_rn = evi = (xExtendedVisualInfo *)xalloc(max_sz_evi);
-    if (!*evi_rn)
-         return BadAlloc;
+
+    if (n_visual > UINT32_MAX/(sz_xExtendedVisualInfo * screenInfo.numScreens))
+	return BadAlloc;
+    max_sz_evi = n_visual * sz_xExtendedVisualInfo * screenInfo.numScreens;
+    
     for (scrI = 0; scrI < screenInfo.numScreens; scrI++) {
         if (screenInfo.screens[scrI]->numVisuals > max_visuals)
             max_visuals = screenInfo.screens[scrI]->numVisuals;
     }
+
+    if (n_visual > UINT32_MAX/(sz_VisualID32 * screenInfo.numScreens 
+			       * max_visuals)) 
+	return BadAlloc;
     max_sz_conflict = n_visual * sz_VisualID32 * screenInfo.numScreens * max_visuals;
+
+    *evi_rn = evi = (xExtendedVisualInfo *)xalloc(max_sz_evi);
+    if (!*evi_rn)
+         return BadAlloc;
+
     temp_conflict = (VisualID32 *)xalloc(max_sz_conflict);
     if (!temp_conflict) {
         xfree(*evi_rn);
         return BadAlloc;
     }
+
     for (scrI = 0; scrI < screenInfo.numScreens; scrI++) {
         for (visualI = 0; visualI < n_visual; visualI++) {
 	    evi[sz_evi].core_visual_id = visual[visualI];
diff --git a/Xext/shm.c b/Xext/shm.c
index ac587be..5633be9 100644
--- a/Xext/shm.c
+++ b/Xext/shm.c
@@ -711,6 +711,8 @@ ProcPanoramiXShmCreatePixmap(
     int i, j, result, rc;
     ShmDescPtr shmdesc;
     REQUEST(xShmCreatePixmapReq);
+    unsigned int width, height, depth;
+    unsigned long size;
     PanoramiXRes *newPix;
 
     REQUEST_SIZE_MATCH(xShmCreatePixmapReq);
@@ -724,11 +726,26 @@ ProcPanoramiXShmCreatePixmap(
 	return rc;
 
     VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client);
-    if (!stuff->width || !stuff->height)
+
+    width = stuff->width;
+    height = stuff->height;
+    depth = stuff->depth;
+    if (!width || !height || !depth)
     {
 	client->errorValue = 0;
         return BadValue;
     }
+    if (width > 32767 || height > 32767)
+        return BadAlloc;
+    size = PixmapBytePad(width, depth) * height;
+    if (sizeof(size) == 4) {
+        if (size < width * height)
+            return BadAlloc;
+        /* thankfully, offset is unsigned */
+        if (stuff->offset + size < size)
+            return BadAlloc;
+    }
+
     if (stuff->depth != 1)
     {
         pDepth = pDraw->pScreen->allowedDepths;
@@ -739,9 +756,7 @@ ProcPanoramiXShmCreatePixmap(
         return BadValue;
     }
 CreatePmap:
-    VERIFY_SHMSIZE(shmdesc, stuff->offset,
-		   PixmapBytePad(stuff->width, stuff->depth) * stuff->height,
-		   client);
+    VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
 
     if(!(newPix = (PanoramiXRes *) xalloc(sizeof(PanoramiXRes))))
 	return BadAlloc;
@@ -1040,6 +1055,8 @@ ProcShmCreatePixmap(client)
     register int i, rc;
     ShmDescPtr shmdesc;
     REQUEST(xShmCreatePixmapReq);
+    unsigned int width, height, depth;
+    unsigned long size;
 
     REQUEST_SIZE_MATCH(xShmCreatePixmapReq);
     client->errorValue = stuff->pid;
@@ -1052,11 +1069,26 @@ ProcShmCreatePixmap(client)
 	return rc;
 
     VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client);
-    if (!stuff->width || !stuff->height)
+    
+    width = stuff->width;
+    height = stuff->height;
+    depth = stuff->depth;
+    if (!width || !height || !depth)
     {
 	client->errorValue = 0;
         return BadValue;
     }
+    if (width > 32767 || height > 32767)
+	return BadAlloc;
+    size = PixmapBytePad(width, depth) * height;
+    if (sizeof(size) == 4) {
+	if (size < width * height)
+	    return BadAlloc;
+	/* thankfully, offset is unsigned */
+	if (stuff->offset + size < size)
+	    return BadAlloc;
+    }
+
     if (stuff->depth != 1)
     {
         pDepth = pDraw->pScreen->allowedDepths;
@@ -1067,9 +1099,7 @@ ProcShmCreatePixmap(client)
         return BadValue;
     }
 CreatePmap:
-    VERIFY_SHMSIZE(shmdesc, stuff->offset,
-		   PixmapBytePad(stuff->width, stuff->depth) * stuff->height,
-		   client);
+    VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
     pMap = (*shmFuncs[pDraw->pScreen->myNum]->CreatePixmap)(
 			    pDraw->pScreen, stuff->width,
 			    stuff->height, stuff->depth,
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0017-Fix-for-CVE-2008-0006-PCF-Font-parser-buffer-overf.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0017-Fix-for-CVE-2008-0006-PCF-Font-parser-buffer-overf.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0017-Fix-for-CVE-2008-0006-PCF-Font-parser-buffer-overf.patch?rev=1.1&content-type=text/plain

Index: 0017-Fix-for-CVE-2008-0006-PCF-Font-parser-buffer-overf.patch
===================================================================
From f09b8007e7f6e60e0b9c9665ec632b578ae08b6f Mon Sep 17 00:00:00 2001
From: Matthieu Herrb <matthieu@××××××××××××××.com>
Date: Thu, 17 Jan 2008 15:29:06 +0100
Subject: [PATCH] Fix for CVE-2008-0006 - PCF Font parser buffer overflow.

---
 dix/dixfonts.c |    7 +++++++
 1 files changed, 7 insertions(+), 0 deletions(-)

diff --git a/dix/dixfonts.c b/dix/dixfonts.c
index c21b3ec..7bb2404 100644
--- a/dix/dixfonts.c
+++ b/dix/dixfonts.c
@@ -325,6 +325,13 @@ doOpenFont(ClientPtr client, OFclosurePtr c)
 	err = BadFontName;
 	goto bail;
     }
+    /* check values for firstCol, lastCol, firstRow, and lastRow */
+    if (pfont->info.firstCol > pfont->info.lastCol ||
+       pfont->info.firstRow > pfont->info.lastRow ||
+       pfont->info.lastCol - pfont->info.firstCol > 255) {
+       err = AllocError;
+       goto bail;
+    }
     if (!pfont->fpe)
 	pfont->fpe = fpe;
     pfont->refcnt++;
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0018-Fix-for-CVE-2007-5958-File-existence-disclosure.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0018-Fix-for-CVE-2007-5958-File-existence-disclosure.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0018-Fix-for-CVE-2007-5958-File-existence-disclosure.patch?rev=1.1&content-type=text/plain

Index: 0018-Fix-for-CVE-2007-5958-File-existence-disclosure.patch
===================================================================
From 19b95cdd1d14a1e7d1abba1880ab023c96f19bf5 Mon Sep 17 00:00:00 2001
From: Matthieu Herrb <matthieu@××××××××××××××.com>
Date: Thu, 17 Jan 2008 17:03:39 +0100
Subject: [PATCH] Fix for CVE-2007-5958 - File existence disclosure.

---
 Xext/security.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Xext/security.c b/Xext/security.c
index ba057de..e9d48c9 100644
--- a/Xext/security.c
+++ b/Xext/security.c
@@ -1563,7 +1563,7 @@ SecurityLoadPropertyAccessList(void)
     if (!SecurityPolicyFile)
 	return;
 
-    f = fopen(SecurityPolicyFile, "r");
+    f = Fopen(SecurityPolicyFile, "r");
     if (!f)
     {
 	ErrorF("error opening security policy file %s\n",
@@ -1646,7 +1646,7 @@ SecurityLoadPropertyAccessList(void)
     }
 #endif /* PROPDEBUG */
 
-    fclose(f);
+    Fclose(f);
 } /* SecurityLoadPropertyAccessList */
 
 
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0019-CVE-2007-6429-Don-t-spuriously-reject-8bpp-shm-pix.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0019-CVE-2007-6429-Don-t-spuriously-reject-8bpp-shm-pix.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0019-CVE-2007-6429-Don-t-spuriously-reject-8bpp-shm-pix.patch?rev=1.1&content-type=text/plain

Index: 0019-CVE-2007-6429-Don-t-spuriously-reject-8bpp-shm-pix.patch
===================================================================
From b6d4cdf64f43ae805beada6122c8be2ed138742c Mon Sep 17 00:00:00 2001
From: Adam Jackson <ajax@××××××.com>
Date: Fri, 18 Jan 2008 14:41:20 -0500
Subject: [PATCH] CVE-2007-6429: Don't spuriously reject <8bpp shm pixmaps.

Move size validation after depth validation, and only validate size if
the bpp of the pixmap format is > 8.  If bpp < 8 then we're already
protected from overflow by the width and height checks.
(cherry picked from commit e9fa7c1c88a8130a48f772c92b186b8b777986b5)
---
 Xext/shm.c |   36 ++++++++++++++++++++----------------
 1 files changed, 20 insertions(+), 16 deletions(-)

diff --git a/Xext/shm.c b/Xext/shm.c
index 5633be9..6f99e90 100644
--- a/Xext/shm.c
+++ b/Xext/shm.c
@@ -737,14 +737,6 @@ ProcPanoramiXShmCreatePixmap(
     }
     if (width > 32767 || height > 32767)
         return BadAlloc;
-    size = PixmapBytePad(width, depth) * height;
-    if (sizeof(size) == 4) {
-        if (size < width * height)
-            return BadAlloc;
-        /* thankfully, offset is unsigned */
-        if (stuff->offset + size < size)
-            return BadAlloc;
-    }
 
     if (stuff->depth != 1)
     {
@@ -755,7 +747,17 @@ ProcPanoramiXShmCreatePixmap(
 	client->errorValue = stuff->depth;
         return BadValue;
     }
+
 CreatePmap:
+    size = PixmapBytePad(width, depth) * height;
+    if (sizeof(size) == 4 && BitsPerPixel(depth) > 8) {
+        if (size < width * height)
+            return BadAlloc;
+        /* thankfully, offset is unsigned */
+        if (stuff->offset + size < size)
+            return BadAlloc;
+    }
+
     VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
 
     if(!(newPix = (PanoramiXRes *) xalloc(sizeof(PanoramiXRes))))
@@ -1080,14 +1082,6 @@ ProcShmCreatePixmap(client)
     }
     if (width > 32767 || height > 32767)
 	return BadAlloc;
-    size = PixmapBytePad(width, depth) * height;
-    if (sizeof(size) == 4) {
-	if (size < width * height)
-	    return BadAlloc;
-	/* thankfully, offset is unsigned */
-	if (stuff->offset + size < size)
-	    return BadAlloc;
-    }
 
     if (stuff->depth != 1)
     {
@@ -1098,7 +1092,17 @@ ProcShmCreatePixmap(client)
 	client->errorValue = stuff->depth;
         return BadValue;
     }
+
 CreatePmap:
+    size = PixmapBytePad(width, depth) * height;
+    if (sizeof(size) == 4 && BitsPerPixel(depth) > 8) {
+	if (size < width * height)
+	    return BadAlloc;
+	/* thankfully, offset is unsigned */
+	if (stuff->offset + size < size)
+	    return BadAlloc;
+    }
+
     VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
     pMap = (*shmFuncs[pDraw->pScreen->myNum]->CreatePixmap)(
 			    pDraw->pScreen, stuff->width,
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0020-dix-set-the-correct-number-of-valuators-in-valuator.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0020-dix-set-the-correct-number-of-valuators-in-valuator.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0020-dix-set-the-correct-number-of-valuators-in-valuator.patch?rev=1.1&content-type=text/plain

Index: 0020-dix-set-the-correct-number-of-valuators-in-valuator.patch
===================================================================
From e98027c3ac7195fec665ef393d980b02870ca1b8 Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter@××××××××××××.au>
Date: Tue, 18 Dec 2007 13:57:07 +1030
Subject: [PATCH] dix: set the correct number of valuators in valuator events.

(first_valuator + num_valuators) must never be larger than the number of axes,
otherwise DIX freaks out. And from looking at libXI, anything larger than 6 is
wrong too.
(cherry picked from commit 9f6ae61ad12cc2813d04405458e1ca5aed8a539e)
---
 dix/getevents.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/dix/getevents.c b/dix/getevents.c
index 12d8189..b7ba69b 100644
--- a/dix/getevents.c
+++ b/dix/getevents.c
@@ -344,7 +344,7 @@ getValuatorEvents(xEvent *events, DeviceIntPtr pDev, int first_valuator,
     for (i = first_valuator; i < final_valuator; i += 6, xv++, events++) {
         xv->type = DeviceValuator;
         xv->first_valuator = i;
-        xv->num_valuators = num_valuators;
+        xv->num_valuators = ((num_valuators - i) > 6) ? 6 : (num_valuators - i);
         xv->deviceid = pDev->id;
         switch (final_valuator - i) {
         case 6:
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0021-xkb-don-t-update-LEDs-if-they-don-t-exist.-Bug-13.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0021-xkb-don-t-update-LEDs-if-they-don-t-exist.-Bug-13.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0021-xkb-don-t-update-LEDs-if-they-don-t-exist.-Bug-13.patch?rev=1.1&content-type=text/plain

Index: 0021-xkb-don-t-update-LEDs-if-they-don-t-exist.-Bug-13.patch
===================================================================
From bc72ef3a159efd67067322c043bba444869dc356 Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter@××××××××××××.au>
Date: Wed, 30 Jan 2008 10:39:54 +1030
Subject: [PATCH] xkb: don't update LEDs if they don't exist. (Bug #13961)

In some weird cases we call this function when there is no SrvLedInfo on the
device. And it turns out null-pointer dereferences are bad.

X.Org Bug 13961 <http://bugs.freedesktop.org/show_bug.cgi?id=13961>
(cherry picked from commit d954f9c80348de294602d931d387e5cd1ef4b9a5)
---
 xkb/xkbLEDs.c |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)

diff --git a/xkb/xkbLEDs.c b/xkb/xkbLEDs.c
index d607d90..d28973c 100644
--- a/xkb/xkbLEDs.c
+++ b/xkb/xkbLEDs.c
@@ -63,6 +63,9 @@ XkbSrvLedInfoPtr	sli;
 
     sli= XkbFindSrvLedInfo(dev,XkbDfltXIClass,XkbDfltXIId,0);
 
+    if (!sli)
+        return update;
+
     if (state_changes&(XkbModifierStateMask|XkbGroupStateMask))
 	update|= sli->usesEffective;
     if (state_changes&(XkbModifierBaseMask|XkbGroupBaseMask))
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0022-security-Fix-for-Bug-14480-untrusted-access-broke.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0022-security-Fix-for-Bug-14480-untrusted-access-broke.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0022-security-Fix-for-Bug-14480-untrusted-access-broke.patch?rev=1.1&content-type=text/plain

Index: 0022-security-Fix-for-Bug-14480-untrusted-access-broke.patch
===================================================================
From 74b40bba327a2e97780e8e3f995f784add2d6231 Mon Sep 17 00:00:00 2001
From: Eamon Walsh <ewalsh@×××××××××.gov>
Date: Thu, 14 Feb 2008 19:47:44 -0500
Subject: [PATCH] security: Fix for Bug #14480: untrusted access broken in 7.3.

---
 Xext/security.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/Xext/security.c b/Xext/security.c
index e9d48c9..14ad354 100644
--- a/Xext/security.c
+++ b/Xext/security.c
@@ -1014,7 +1014,7 @@ CALLBACK(SecurityCheckResourceIDAccess)
     }
     else /* server-owned resource - probably a default colormap or root window */
     {
-	if (RT_WINDOW == rtype || RC_DRAWABLE == rtype)
+	if (RC_DRAWABLE & rtype)
 	{
 	    switch (reqtype)
 	    {   /* the following operations are allowed on root windows */
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0023-Resize-composite-overlay-window-when-the-root-window.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0023-Resize-composite-overlay-window-when-the-root-window.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0023-Resize-composite-overlay-window-when-the-root-window.patch?rev=1.1&content-type=text/plain

Index: 0023-Resize-composite-overlay-window-when-the-root-window.patch
===================================================================
From 3db5930c61aeb849de3b21e7ba0d86d3c0cf72bb Mon Sep 17 00:00:00 2001
From: Maarten Maathuis <madman2003@×××××.com>
Date: Sun, 17 Feb 2008 11:21:01 +0100
Subject: [PATCH] Resize composite overlay window when the root window changes.

- This allows some compositing managers to work, even after randr12 has changed the root window size.
- Thanks to ajax for figuring out the best place to put this.
- Example:
	- xf86RandR12SetMode() calls EnableDisableFBAccess().
	- That calls xf86SetRootClip() which in turn calls ResizeChildrenWinSize().
	- The final step is the call to PositionWindow().
(cherry picked from commit 70c0592a97c7dc9db0576d32b3bdbe4766520509)
---
 composite/compwindow.c |   25 +++++++++++++++++++++++++
 1 files changed, 25 insertions(+), 0 deletions(-)

diff --git a/composite/compwindow.c b/composite/compwindow.c
index bfd2946..33192ad 100644
--- a/composite/compwindow.c
+++ b/composite/compwindow.c
@@ -165,6 +165,29 @@ compCheckRedirect (WindowPtr pWin)
     return TRUE;
 }
 
+static int
+updateOverlayWindow(ScreenPtr pScreen)
+{
+	CompScreenPtr cs;
+	WindowPtr pWin; /* overlay window */
+	XID vlist[2];
+
+	cs = GetCompScreen(pScreen);
+	if ((pWin = cs->pOverlayWin) != NULL) {
+		if ((pWin->drawable.width == pScreen->width) &&
+			(pWin->drawable.height == pScreen->height))
+			return Success;
+
+		/* Let's resize the overlay window. */
+		vlist[0] = pScreen->width;
+		vlist[1] = pScreen->height;
+		return ConfigureWindow(pWin, CWWidth | CWHeight, vlist, wClient(pWin));
+	}
+
+	/* Let's be on the safe side and not assume an overlay window is always allocated. */
+	return Success;
+}
+
 Bool
 compPositionWindow (WindowPtr pWin, int x, int y)
 {
@@ -203,6 +226,8 @@ compPositionWindow (WindowPtr pWin, int x, int y)
     cs->PositionWindow = pScreen->PositionWindow;
     pScreen->PositionWindow = compPositionWindow;
     compCheckTree (pWin->drawable.pScreen);
+    if (updateOverlayWindow(pScreen) != Success)
+	ret = FALSE;
     return ret;
 }
 
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0024-Fix-rotation-for-multi-monitor-situation.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0024-Fix-rotation-for-multi-monitor-situation.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0024-Fix-rotation-for-multi-monitor-situation.patch?rev=1.1&content-type=text/plain

Index: 0024-Fix-rotation-for-multi-monitor-situation.patch
===================================================================
From dc30ade6496c7cc24e38c419e229159525fe042f Mon Sep 17 00:00:00 2001
From: Maarten Maathuis <madman2003@×××××.com>
Date: Sun, 17 Feb 2008 18:47:28 +0100
Subject: [PATCH] Fix rotation for multi-monitor situation.

- The (x,y)-coordinates of the crtc were not being passed as xFixed values, which made it an obscure bug to find.
- Fix bug #13787.
(cherry picked from commit a48cc88ea2674c28b69b8d738b168cbafcf4001f)
---
 hw/xfree86/modes/xf86Rotate.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/xfree86/modes/xf86Rotate.c b/hw/xfree86/modes/xf86Rotate.c
index 380478f..dd0e659 100644
--- a/hw/xfree86/modes/xf86Rotate.c
+++ b/hw/xfree86/modes/xf86Rotate.c
@@ -579,9 +579,9 @@ xf86CrtcRotate (xf86CrtcPtr crtc, DisplayModePtr mode, Rotation rotation)
     }
     else
     {
-	PictureTransformTranslate (&crtc_to_fb, &fb_to_crtc, crtc->x, crtc->y);
+	PictureTransformTranslate (&crtc_to_fb, &fb_to_crtc, F(crtc->x), F(crtc->y));
 	PictureTransformIsInverse ("offset", &crtc_to_fb, &fb_to_crtc);
-	
+
 	/* 
 	 * these are the size of the shadow pixmap, which
 	 * matches the mode, not the pre-rotated copy in the
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0025-Don-t-break-grab-and-focus-state-for-a-window-when-r.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0025-Don-t-break-grab-and-focus-state-for-a-window-when-r.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0025-Don-t-break-grab-and-focus-state-for-a-window-when-r.patch?rev=1.1&content-type=text/plain

Index: 0025-Don-t-break-grab-and-focus-state-for-a-window-when-r.patch
===================================================================
From bcbfd619f8da888224afd80ee3a2db7d500523eb Mon Sep 17 00:00:00 2001
From: =?utf-8?q?Kristian=20H=C3=B8gsberg?= <krh@××××××.com>
Date: Wed, 16 Jan 2008 20:24:11 -0500
Subject: [PATCH] Don't break grab and focus state for a window when redirecting it.

Composite uses an unmap/map cycle to trigger backing pixmap allocation
and cliprect recomputation when a window is redirected or unredirected.
To avoid protocol visible side effects, map and unmap events are
disabled temporarily.  However, when a window is unmapped it is also
removed from grabs and loses focus, but these state changes are not
disabled.

This change supresses the unmap side effects during the composite
unmap/map cycle and fixes this bug:

  http://bugzilla.gnome.org/show_bug.cgi?id=488264

where compiz would cause gnome-screensaver to lose its grab when
compiz unredirects the fullscreen lock window.
---
 dix/window.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/dix/window.c b/dix/window.c
index be4ea2c..961c02a 100644
--- a/dix/window.c
+++ b/dix/window.c
@@ -3023,7 +3023,8 @@ UnrealizeTree(
 	    } 
 #endif
 	    (* Unrealize)(pChild);
-	    DeleteWindowFromAnyEvents(pChild, FALSE);
+	    if (MapUnmapEventsEnabled(pWin))
+		DeleteWindowFromAnyEvents(pChild, FALSE);
 	    if (pChild->viewable)
 	    {
 #ifdef DO_SAVE_UNDERS
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0026-CVE-2007-6429-Always-test-for-size-offset-wrapping.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0026-CVE-2007-6429-Always-test-for-size-offset-wrapping.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0026-CVE-2007-6429-Always-test-for-size-offset-wrapping.patch?rev=1.1&content-type=text/plain

Index: 0026-CVE-2007-6429-Always-test-for-size-offset-wrapping.patch
===================================================================
From 44f46bfb981ca69515dafc520f62f33654711194 Mon Sep 17 00:00:00 2001
From: Matthias Hopf <mhopf@××××.de>
Date: Mon, 21 Jan 2008 16:13:21 +0100
Subject: [PATCH] CVE-2007-6429: Always test for size+offset wrapping.

---
 Xext/shm.c |   12 ++++++------
 1 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/Xext/shm.c b/Xext/shm.c
index 6f99e90..376f123 100644
--- a/Xext/shm.c
+++ b/Xext/shm.c
@@ -753,10 +753,10 @@ CreatePmap:
     if (sizeof(size) == 4 && BitsPerPixel(depth) > 8) {
         if (size < width * height)
             return BadAlloc;
-        /* thankfully, offset is unsigned */
-        if (stuff->offset + size < size)
-            return BadAlloc;
     }
+    /* thankfully, offset is unsigned */
+    if (stuff->offset + size < size)
+	return BadAlloc;
 
     VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
 
@@ -1098,10 +1098,10 @@ CreatePmap:
     if (sizeof(size) == 4 && BitsPerPixel(depth) > 8) {
 	if (size < width * height)
 	    return BadAlloc;
-	/* thankfully, offset is unsigned */
-	if (stuff->offset + size < size)
-	    return BadAlloc;
     }
+    /* thankfully, offset is unsigned */
+    if (stuff->offset + size < size)
+	return BadAlloc;
 
     VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
     pMap = (*shmFuncs[pDraw->pScreen->myNum]->CreatePixmap)(
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0027-Fix-context-sharing-between-direct-indirect-contexts.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0027-Fix-context-sharing-between-direct-indirect-contexts.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0027-Fix-context-sharing-between-direct-indirect-contexts.patch?rev=1.1&content-type=text/plain

Index: 0027-Fix-context-sharing-between-direct-indirect-contexts.patch
===================================================================
From a65d4aed06acd839fb21153f74144498abda3e18 Mon Sep 17 00:00:00 2001
From: Alan Hourihane <alanh@××××××××××××××××.com>
Date: Wed, 27 Feb 2008 16:49:34 +0000
Subject: [PATCH] Fix context sharing between direct/indirect contexts

---
 GL/glx/glxdri.c |    8 ++++++++
 1 files changed, 8 insertions(+), 0 deletions(-)

diff --git a/GL/glx/glxdri.c b/GL/glx/glxdri.c
index 685683d..09abca3 100644
--- a/GL/glx/glxdri.c
+++ b/GL/glx/glxdri.c
@@ -598,6 +598,9 @@ __glXDRIscreenCreateContext(__GLXscreen *baseScreen,
     else
 	sharePrivate = NULL;
 
+    if (baseShareContext && baseShareContext->isDirect)
+        return NULL;
+
     context = xalloc(sizeof *context);
     if (context == NULL)
 	return NULL;
@@ -617,6 +620,11 @@ __glXDRIscreenCreateContext(__GLXscreen *baseScreen,
 					   0, /* render type */
 					   sharePrivate,
 					   &context->driContext);
+    
+    if (!context->driContext.private) {
+    	xfree(context);
+    	return NULL;
+    }
 
     context->driContext.mode = modes;
 
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0028-Add-some-more-support-for-DragonFly.-From-Joerg-Sonn.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0028-Add-some-more-support-for-DragonFly.-From-Joerg-Sonn.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0028-Add-some-more-support-for-DragonFly.-From-Joerg-Sonn.patch?rev=1.1&content-type=text/plain

Index: 0028-Add-some-more-support-for-DragonFly.-From-Joerg-Sonn.patch
===================================================================
From 76b950cd6e03f0060afe463871de4570fca90213 Mon Sep 17 00:00:00 2001
From: Jeremy C. Reed <reed@×××××××××××××××××.net>
Date: Thu, 16 Aug 2007 11:20:12 -0500
Subject: [PATCH] Add some more support for DragonFly. From Joerg Sonnenberger
 and pkgsrc.
 (cherry picked from commit 1d4bea6106d7a1c83e1dfe37fad8268589feaa0b)

---
 Xext/shm.c                             |    2 +-
 Xext/xf86bigfont.c                     |    2 +-
 hw/xfree86/loader/os.c                 |    2 ++
 hw/xfree86/os-support/bus/Pci.h        |    2 +-
 hw/xfree86/os-support/bus/freebsdPci.c |    2 +-
 5 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/Xext/shm.c b/Xext/shm.c
index 376f123..3c0d1ee 100644
--- a/Xext/shm.c
+++ b/Xext/shm.c
@@ -154,7 +154,7 @@ static ShmFuncs fbFuncs = {fbShmCreatePixmap, fbShmPutImage};
 }
 
 
-#if defined(__FreeBSD__) || defined(__NetBSD__) || defined(__OpenBSD__) || defined(__CYGWIN__)
+#if defined(__FreeBSD__) || defined(__NetBSD__) || defined(__OpenBSD__) || defined(__CYGWIN__) || defined(__DragonFly__)
 #include <sys/signal.h>
 
 static Bool badSysCall = FALSE;
diff --git a/Xext/xf86bigfont.c b/Xext/xf86bigfont.c
index f50481f..c2f891a 100644
--- a/Xext/xf86bigfont.c
+++ b/Xext/xf86bigfont.c
@@ -104,7 +104,7 @@ static unsigned int pagesize;
 
 static Bool badSysCall = FALSE;
 
-#if defined(__FreeBSD__) || defined(__NetBSD__) || defined(__OpenBSD__) || defined(__CYGWIN__)
+#if defined(__FreeBSD__) || defined(__NetBSD__) || defined(__OpenBSD__) || defined(__CYGWIN__) || defined(__DragonFly__)
 
 #include <sys/signal.h>
 
diff --git a/hw/xfree86/loader/os.c b/hw/xfree86/loader/os.c
index fdddce8..12cf3d8 100644
--- a/hw/xfree86/loader/os.c
+++ b/hw/xfree86/loader/os.c
@@ -42,6 +42,8 @@
 #define OSNAME "linux"
 #elif defined(__FreeBSD__)
 #define OSNAME "freebsd"
+#elif defined(__DragonFly__)
+#define OSNAME "dragonfly"
 #elif defined(__NetBSD__)
 #define OSNAME "netbsd"
 #elif defined(__OpenBSD__)
diff --git a/hw/xfree86/os-support/bus/Pci.h b/hw/xfree86/os-support/bus/Pci.h
index f0cb916..5ebbdd5 100644
--- a/hw/xfree86/os-support/bus/Pci.h
+++ b/hw/xfree86/os-support/bus/Pci.h
@@ -235,7 +235,7 @@
 # if defined(linux)
 #  define ARCH_PCI_INIT axpPciInit
 #  define INCLUDE_XF86_MAP_PCI_MEM
-# elif defined(__FreeBSD__) || defined(__OpenBSD__)
+# elif defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__DragonFly__)
 #  define ARCH_PCI_INIT freebsdPciInit
 #  define INCLUDE_XF86_MAP_PCI_MEM
 #  define INCLUDE_XF86_NO_DOMAIN
diff --git a/hw/xfree86/os-support/bus/freebsdPci.c b/hw/xfree86/os-support/bus/freebsdPci.c
index 61cb405..63c00b2 100644
--- a/hw/xfree86/os-support/bus/freebsdPci.c
+++ b/hw/xfree86/os-support/bus/freebsdPci.c
@@ -83,7 +83,7 @@ static pciBusInfo_t freebsdPci0 = {
 /* bridge      */	NULL
 };
 
-#if !defined(__OpenBSD__) && !defined(__FreeBSD__)
+#if !defined(__OpenBSD__) && !defined(__FreeBSD__) && !defined(__DragonFly__)
 #if X_BYTE_ORDER == X_BIG_ENDIAN
 #ifdef __sparc__
 #ifndef ASI_PL
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0029-configure.ac-DragonFly-BSD-support.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0029-configure.ac-DragonFly-BSD-support.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0029-configure.ac-DragonFly-BSD-support.patch?rev=1.1&content-type=text/plain

Index: 0029-configure.ac-DragonFly-BSD-support.patch
===================================================================
From dd6b0de38d649617600a8357e576955c9b831328 Mon Sep 17 00:00:00 2001
From: Hasso Tepper <hasso@××××××.ee>
Date: Mon, 7 Apr 2008 14:09:04 +0300
Subject: [PATCH] configure.ac: DragonFly BSD support

Add support for DragonFly BSD, which is just the same as FreeBSD for all
of these cases.
(cherry picked from commit 0f87b41a432a6472a15ec0c9dee997e3bddbd0f2)
---
 configure.ac |    6 ++++--
 1 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/configure.ac b/configure.ac
index 72d9819..dfb2950 100644
--- a/configure.ac
+++ b/configure.ac
@@ -291,6 +291,7 @@ case $host_cpu in
 	        darwin*)	use_x86_asm="no" ;;
 		*linux*)	DEFAULT_INT10=vm86 ;;
 		*freebsd*)	AC_DEFINE(USE_DEV_IO) ;;
+		*dragonfly*)	AC_DEFINE(USE_DEV_IO) ;;
 		*netbsd*)	AC_DEFINE(USE_I386_IOPL)
 				SYS_LIBS=-li386
 				;;
@@ -316,6 +317,7 @@ case $host_cpu in
 	case $host_os in
 	        darwin*)	use_x86_asm="no" ;;
 		*freebsd*)	AC_DEFINE(USE_DEV_IO, 1, [BSD /dev/io]) ;;
+		*dragonfly*)	AC_DEFINE(USE_DEV_IO, 1, [BSD /dev/io]) ;;
 		*netbsd*)	AC_DEFINE(USE_I386_IOPL, 1, [BSD i386 iopl])
 				SYS_LIBS=-lx86_64
 				;;
@@ -337,7 +339,7 @@ DRI=no
 KDRIVE_HW=no
 dnl it would be nice to autodetect these *CONS_SUPPORTs
 case $host_os in
-  *freebsd*)
+  *freebsd* | *dragonfly*)
 	case $host_os in
 		kfreebsd*-gnu) ;;
 		*) AC_DEFINE(CSRG_BASED, 1, [System is BSD-like]) ;;
@@ -1363,7 +1365,7 @@ return 0;}
 			;;
 		esac
 		;;
-	  freebsd* | kfreebsd*-gnu)
+	  freebsd* | kfreebsd*-gnu | dragonfly*)
 	  	XORG_OS="freebsd"
 		XORG_OS_SUBDIR="bsd"
 		case $host_cpu in
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0030-Fixed-configure.ac-for-autoconf-2.62.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0030-Fixed-configure.ac-for-autoconf-2.62.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0030-Fixed-configure.ac-for-autoconf-2.62.patch?rev=1.1&content-type=text/plain

Index: 0030-Fixed-configure.ac-for-autoconf-2.62.patch
===================================================================
From 9e9eeca2b094fa9edb9c20002d42aeafb14ad1e4 Mon Sep 17 00:00:00 2001
From: Tilman Sauerbeck <tilman@×××××××××××.de>
Date: Thu, 10 Apr 2008 21:36:19 +0200
Subject: [PATCH] Fixed configure.ac for autoconf 2.62.
 (cherry picked from commit 3c337e18b933881e22b0d03312511f1d23a8640b)

---
 configure.ac |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

diff --git a/configure.ac b/configure.ac
index dfb2950..4841d26 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1964,7 +1964,9 @@ DIX_CFLAGS="-DHAVE_DIX_CONFIG_H $XSERVER_CFLAGS"
 
 AC_SUBST([DIX_CFLAGS])
 
-AC_SUBST([libdir exec_prefix prefix])
+AC_SUBST([libdir])
+AC_SUBST([exec_prefix])
+AC_SUBST([prefix])
 
 # Man page sections - used in config utils & generating man pages
 XORG_MANPAGE_SECTIONS
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0031-EXA-Fix-off-by-one-in-polyline-drawing.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0031-EXA-Fix-off-by-one-in-polyline-drawing.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0031-EXA-Fix-off-by-one-in-polyline-drawing.patch?rev=1.1&content-type=text/plain

Index: 0031-EXA-Fix-off-by-one-in-polyline-drawing.patch
===================================================================
From 6afcf996cade0c9464d6af9b04b177b1de138cfd Mon Sep 17 00:00:00 2001
From: Pierre Willenbrock <pierre@××××××××××××××××.org>
Date: Tue, 23 Oct 2007 16:45:13 +0200
Subject: [PATCH] EXA: Fix off-by-one in polyline drawing.
 (cherry picked from commit d502521c3669f3f22b94c39a64ab63bfd92c6a97)

---
 exa/exa_accel.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/exa/exa_accel.c b/exa/exa_accel.c
index aed4e42..e8444c6 100644
--- a/exa/exa_accel.c
+++ b/exa/exa_accel.c
@@ -535,7 +535,7 @@ exaPolylines(DrawablePtr pDrawable, GCPtr pGC, int mode, int npt,
     x1 = ppt[0].x;
     y1 = ppt[0].y;
     /* If we have any non-horizontal/vertical, fall back. */
-    for (i = 0; i < npt; i++) {
+    for (i = 0; i < npt - 1; i++) {
 	if (mode == CoordModePrevious) {
 	    x2 = x1 + ppt[i + 1].x;
 	    y2 = y1 + ppt[i + 1].y;
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0032-XKB-Fix-processInputProc-wrapping.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0032-XKB-Fix-processInputProc-wrapping.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0032-XKB-Fix-processInputProc-wrapping.patch?rev=1.1&content-type=text/plain

Index: 0032-XKB-Fix-processInputProc-wrapping.patch
===================================================================
From fdfb57d342da0ace14eed635804ebc31441240c5 Mon Sep 17 00:00:00 2001
From: Thomas Jaeger <thjaeger@×××××.com>
Date: Tue, 1 Apr 2008 15:27:06 +0300
Subject: [PATCH] XKB: Fix processInputProc wrapping

If input processing is frozen, only wrap realInputProc: don't smash
processInputProc as well.  When input processing is thawed, pIP will be
rewrapped correctly.

This supersedes the previous workaround in 50e80c9.

Signed-off-by: Daniel Stone <daniel@×××××××××.org>
(cherry picked from commit 37b1258f0a288a79ce6a3eef3559e17a67c4dd96)
---
 include/xkbsrv.h |   16 ++++++++++++----
 xkb/xkbActions.c |    9 ++++-----
 2 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/include/xkbsrv.h b/include/xkbsrv.h
index 9174eb6..acf3bb0 100644
--- a/include/xkbsrv.h
+++ b/include/xkbsrv.h
@@ -241,6 +241,14 @@ typedef struct	_XkbSrvLedInfo {
 typedef struct
 {
     ProcessInputProc processInputProc;
+    /* If processInputProc is set to something different than realInputProc,
+     * UNWRAP and COND_WRAP will not touch processInputProc and update only
+     * realInputProc.  This ensures that
+     *   processInputProc == (frozen ? EnqueueEvent : realInputProc)
+     *
+     * WRAP_PROCESS_INPUT_PROC should only be called during initialization,
+     * since it may destroy this invariant.
+     */
     ProcessInputProc realInputProc;
     DeviceUnwrapProc unwrapProc;
 } xkbDeviceInfoRec, *xkbDeviceInfoPtr;
@@ -258,14 +266,14 @@ typedef struct
 	    device->public.processInputProc = proc; \
 	oldprocs->processInputProc = \
 	oldprocs->realInputProc = device->public.realInputProc; \
-	if (proc != device->public.enqueueInputProc) \
-		device->public.realInputProc = proc; \
+	device->public.realInputProc = proc; \
 	oldprocs->unwrapProc = device->unwrapProc; \
 	device->unwrapProc = unwrapproc;
 
 #define UNWRAP_PROCESS_INPUT_PROC(device, oldprocs, backupproc) \
-        backupproc = device->public.processInputProc; \
-	device->public.processInputProc = oldprocs->processInputProc; \
+        backupproc = device->public.realInputProc; \
+	if (device->public.processInputProc == device->public.realInputProc)\
+	    device->public.processInputProc = oldprocs->realInputProc; \
 	device->public.realInputProc = oldprocs->realInputProc; \
 	device->unwrapProc = oldprocs->unwrapProc;
 
diff --git a/xkb/xkbActions.c b/xkb/xkbActions.c
index 6edac29..59d34c5 100644
--- a/xkb/xkbActions.c
+++ b/xkb/xkbActions.c
@@ -50,15 +50,14 @@ xkbUnwrapProc(DeviceIntPtr device, DeviceHandleProc proc,
                    pointer data)
 {
     xkbDeviceInfoPtr xkbPrivPtr = XKBDEVICEINFO(device);
-    ProcessInputProc tmp = device->public.processInputProc;
-    ProcessInputProc dummy; /* unused, but neede for macro */
+    ProcessInputProc backupproc;
     if(xkbPrivPtr->unwrapProc)
 	xkbPrivPtr->unwrapProc = NULL;
 
-    UNWRAP_PROCESS_INPUT_PROC(device,xkbPrivPtr, dummy);
+    UNWRAP_PROCESS_INPUT_PROC(device,xkbPrivPtr, backupproc);
     proc(device,data);
-    WRAP_PROCESS_INPUT_PROC(device,xkbPrivPtr,
-			    tmp,xkbUnwrapProc);
+    COND_WRAP_PROCESS_INPUT_PROC(device,xkbPrivPtr,
+				 backupproc,xkbUnwrapProc);
 }
 
 
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0033-xfree86-fix-AlwaysCore-handling.-Bug-14256.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0033-xfree86-fix-AlwaysCore-handling.-Bug-14256.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0033-xfree86-fix-AlwaysCore-handling.-Bug-14256.patch?rev=1.1&content-type=text/plain

Index: 0033-xfree86-fix-AlwaysCore-handling.-Bug-14256.patch
===================================================================
From ff4006bd5a71d39cc5655679447c5c47a99a2751 Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter@××××××××××××.au>
Date: Tue, 29 Jan 2008 10:01:37 +1030
Subject: [PATCH] xfree86: fix AlwaysCore handling. (Bug #14256)

Assume AlwaysCore being set by default, just like the other options.

X.Org Bug 14256 <http://bugs.freedesktop.org/show_bug.cgi?id=14256>
(cherry picked from commit 5b8641a5fdc112c19e78ca2954878712e328d403)
---
 hw/xfree86/common/xf86Xinput.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/hw/xfree86/common/xf86Xinput.c b/hw/xfree86/common/xf86Xinput.c
index b939fb7..ca2be5c 100644
--- a/hw/xfree86/common/xf86Xinput.c
+++ b/hw/xfree86/common/xf86Xinput.c
@@ -116,7 +116,7 @@ _X_EXPORT void
 xf86ProcessCommonOptions(LocalDevicePtr local,
                          pointer	list)
 {
-    if (xf86SetBoolOption(list, "AlwaysCore", 0) ||
+    if (!xf86SetBoolOption(list, "AlwaysCore", 1) ||
         !xf86SetBoolOption(list, "SendCoreEvents", 1) ||
         !xf86SetBoolOption(list, "CorePointer", 1) ||
         !xf86SetBoolOption(list, "CoreKeyboard", 1)) {
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0034-Ignore-not-just-block-SIGALRM-around-Popen-Pcl.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0034-Ignore-not-just-block-SIGALRM-around-Popen-Pcl.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0034-Ignore-not-just-block-SIGALRM-around-Popen-Pcl.patch?rev=1.1&content-type=text/plain

Index: 0034-Ignore-not-just-block-SIGALRM-around-Popen-Pcl.patch
===================================================================
From 6a5066c2e9e872d4ef85ec70745c34d93580177e Mon Sep 17 00:00:00 2001
From: Adam Jackson <ajax@×××××××××××××××.net>
Date: Tue, 11 Sep 2007 11:37:06 -0400
Subject: [PATCH] Ignore - not just block - SIGALRM around Popen()/Pclose().

Because our "popen" implementation uses stdio, and because nobody's stdio
library is capable of surviving signals, we need to make absolutely sure
that we hide the SIGALRM from the smart scheduler.  Otherwise, when you
open a menu in openoffice, and it recompiles XKB to deal with the
accelerators, and you popen xkbcomp because we suck, then the scheduler
will tell you you're taking forever doing something stupid, and the
wait() code will get confused, and input will hang and your CPU usage
slams to 100%.  Down, not across.
---
 os/utils.c |    8 ++++++++
 1 files changed, 8 insertions(+), 0 deletions(-)

diff --git a/os/utils.c b/os/utils.c
index 3bb7dbe..afcaae4 100644
--- a/os/utils.c
+++ b/os/utils.c
@@ -1720,6 +1720,8 @@ static struct pid {
     int pid;
 } *pidlist;
 
+static sighandler_t old_alarm = NULL; /* XXX horrible awful hack */
+
 pointer
 Popen(char *command, char *type)
 {
@@ -1741,11 +1743,15 @@ Popen(char *command, char *type)
 	return NULL;
     }
 
+    /* Ignore the smart scheduler while this is going on */
+    old_alarm = signal(SIGALRM, SIG_IGN);
+
     switch (pid = fork()) {
     case -1: 	/* error */
 	close(pdes[0]);
 	close(pdes[1]);
 	xfree(cur);
+	signal(SIGALRM, old_alarm);
 	return NULL;
     case 0:	/* child */
 	if (setgid(getgid()) == -1)
@@ -1921,6 +1927,8 @@ Pclose(pointer iop)
     /* allow EINTR again */
     OsReleaseSignals ();
     
+    signal(SIGALRM, old_alarm);
+
     return pid == -1 ? -1 : pstat;
 }
 
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0035-Fix-build-on-FreeBSD-after-Popen-changes.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0035-Fix-build-on-FreeBSD-after-Popen-changes.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0035-Fix-build-on-FreeBSD-after-Popen-changes.patch?rev=1.1&content-type=text/plain

Index: 0035-Fix-build-on-FreeBSD-after-Popen-changes.patch
===================================================================
From a02b989c68864a7388553fb96e4fbaf91f941c4a Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@××××××.net>
Date: Wed, 12 Sep 2007 13:23:13 +0000
Subject: [PATCH] Fix build on FreeBSD after Popen changes.

---
 os/utils.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/os/utils.c b/os/utils.c
index afcaae4..144098b 100644
--- a/os/utils.c
+++ b/os/utils.c
@@ -1720,7 +1720,7 @@ static struct pid {
     int pid;
 } *pidlist;
 
-static sighandler_t old_alarm = NULL; /* XXX horrible awful hack */
+void (*old_alarm)(int) = NULL; /* XXX horrible awful hack */
 
 pointer
 Popen(char *command, char *type)
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0036-So-like-checking-return-codes-of-system-calls-sig.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0036-So-like-checking-return-codes-of-system-calls-sig.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0036-So-like-checking-return-codes-of-system-calls-sig.patch?rev=1.1&content-type=text/plain

Index: 0036-So-like-checking-return-codes-of-system-calls-sig.patch
===================================================================
From 0fab9843c7b553bb59d57e68d9c3ea2d754bf809 Mon Sep 17 00:00:00 2001
From: Ben Byer <bbyer@×××××××××××.com>
Date: Fri, 21 Sep 2007 17:07:36 -0700
Subject: [PATCH] So, like, checking return codes of system calls (signal, etc) is good.
 Also, only restore an old signal handler if one was actually set
 (prevents the server from dying on OS X).

---
 os/utils.c |   24 ++++++++++++++++++++----
 1 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/os/utils.c b/os/utils.c
index 144098b..36c8dfe 100644
--- a/os/utils.c
+++ b/os/utils.c
@@ -285,7 +285,8 @@ OsSignal(sig, handler)
 	sigaddset(&act.sa_mask, sig);
     act.sa_flags = 0;
     act.sa_handler = handler;
-    sigaction(sig, &act, &oact);
+    if (sigaction(sig, &act, &oact))
+      perror("sigaction");
     return oact.sa_handler;
 #endif
 }
@@ -1684,6 +1685,10 @@ System(char *command)
 
 #ifdef SIGCHLD
     csig = signal(SIGCHLD, SIG_DFL);
+    if (csig == SIG_ERR) {
+      perror("signal");
+      return -1;
+    }
 #endif
 
 #ifdef DEBUG
@@ -1708,7 +1713,10 @@ System(char *command)
     }
 
 #ifdef SIGCHLD
-    signal(SIGCHLD, csig);
+    if (signal(SIGCHLD, csig) == SIG_ERR) {
+      perror("signal");
+      return -1;
+    }
 #endif
 
     return p == -1 ? -1 : status;
@@ -1745,13 +1753,18 @@ Popen(char *command, char *type)
 
     /* Ignore the smart scheduler while this is going on */
     old_alarm = signal(SIGALRM, SIG_IGN);
+    if (old_alarm == SIG_ERR) {
+      perror("signal");
+      return NULL;
+    }
 
     switch (pid = fork()) {
     case -1: 	/* error */
 	close(pdes[0]);
 	close(pdes[1]);
 	xfree(cur);
-	signal(SIGALRM, old_alarm);
+	if (signal(SIGALRM, old_alarm) == SIG_ERR)
+	  perror("signal");
 	return NULL;
     case 0:	/* child */
 	if (setgid(getgid()) == -1)
@@ -1927,7 +1940,10 @@ Pclose(pointer iop)
     /* allow EINTR again */
     OsReleaseSignals ();
     
-    signal(SIGALRM, old_alarm);
+    if (old_alarm && signal(SIGALRM, old_alarm) == SIG_ERR) {
+      perror("signal");
+      return -1;
+    }
 
     return pid == -1 ? -1 : pstat;
 }
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0037-Check-for-sys-sdt.h-as-well-when-determining-to-en.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0037-Check-for-sys-sdt.h-as-well-when-determining-to-en.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0037-Check-for-sys-sdt.h-as-well-when-determining-to-en.patch?rev=1.1&content-type=text/plain

Index: 0037-Check-for-sys-sdt.h-as-well-when-determining-to-en.patch
===================================================================
From b95befdfd2c9bcb6b0cd896f2b8dfaaeb129dbff Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@×××.com>
Date: Fri, 7 Dec 2007 17:28:37 -0800
Subject: [PATCH] Check for <sys/sdt.h> as well when determining to enable dtrace probes

Avoids auto-detecting dtrace is present on systems with the ISDN trace tool
named dtrace installed, but not the dynamic tracing facility named dtrace
---
 configure.ac |    7 +++++++
 1 files changed, 7 insertions(+), 0 deletions(-)

diff --git a/configure.ac b/configure.ac
index 4841d26..c73f4a7 100644
--- a/configure.ac
+++ b/configure.ac
@@ -66,6 +66,8 @@ AC_SYS_LARGEFILE
 XORG_PROG_RAWCPP
 
 dnl Check for dtrace program (needed to build Xserver dtrace probes)
+dnl Also checks for <sys/sdt.h>, since some Linux distros have an 
+dnl ISDN trace program named dtrace
 AC_ARG_WITH(dtrace, AS_HELP_STRING([--with-dtrace=PATH],
 	     [Enable dtrace probes (default: enabled if dtrace found)]),
 	     [WDTRACE=$withval], [WDTRACE=auto])
@@ -76,6 +78,11 @@ if test "x$WDTRACE" = "xyes" -o "x$WDTRACE" = "xauto" ; then
 			AC_MSG_FAILURE([dtrace requested but not found])
 		fi
 		WDTRACE="no"
+	else
+		AC_CHECK_HEADER(sys/sdt.h, [HAS_SDT_H="yes"], [HAS_SDT_H="no"])
+		if test "x$WDTRACE" = "xauto" -a "x$HAS_SDT_H" = "xno" ; then
+			WDTRACE="no"
+		fi
 	fi
 fi
 if test "x$WDTRACE" != "xno" ; then
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0038-dix-Always-add-valuator-information-if-present.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0038-dix-Always-add-valuator-information-if-present.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0038-dix-Always-add-valuator-information-if-present.patch?rev=1.1&content-type=text/plain

Index: 0038-dix-Always-add-valuator-information-if-present.patch
===================================================================
From 7fa7031cfa9145f55881b87bc39f6e2c8a49ff76 Mon Sep 17 00:00:00 2001
From: =?utf-8?q?Magnus=20Vigerl=C3=B6f?= <Magnus.Vigerlof@××××.se>
Date: Sat, 2 Feb 2008 22:44:31 +0100
Subject: [PATCH] dix: Always add valuator information if present

Send valuator information for all event types, not only for
MotionEvents and absolute button events.
(cherry picked from commit 12e532403210c15a25200ef448bfe9701735ab20)
---
 dix/getevents.c |    7 ++-----
 1 files changed, 2 insertions(+), 5 deletions(-)

diff --git a/dix/getevents.c b/dix/getevents.c
index b7ba69b..36c1bcf 100644
--- a/dix/getevents.c
+++ b/dix/getevents.c
@@ -523,9 +523,6 @@ GetPointerEvents(xEvent *events, DeviceIntPtr pDev, int type, int buttons,
     int num_events = 0, final_valuator = 0;
     CARD32 ms = 0;
     deviceKeyButtonPointer *kbp = NULL;
-    /* Thanks to a broken lib, we _always_ have to chase DeviceMotionNotifies
-     * with DeviceValuators. */
-    Bool sendValuators = (type == MotionNotify || flags & POINTER_ABSOLUTE);
     DeviceIntPtr cp = inputInfo.pointer;
     int x = 0, y = 0;
     Bool coreOnly = (pDev == inputInfo.pointer);
@@ -551,7 +548,7 @@ GetPointerEvents(xEvent *events, DeviceIntPtr pDev, int type, int buttons,
         return 0;
 
     /* Do we need to send a DeviceValuator event? */
-    if (!coreOnly && sendValuators) {
+    if (!coreOnly && num_valuators) {
         if ((((num_valuators - 1) / 6) + 1) > MAX_VALUATOR_EVENTS)
             num_valuators = MAX_VALUATOR_EVENTS * 6;
         num_events += ((num_valuators - 1) / 6) + 1;
@@ -682,7 +679,7 @@ GetPointerEvents(xEvent *events, DeviceIntPtr pDev, int type, int buttons,
         kbp->root_y = y;
 
         events++;
-        if (sendValuators) {
+        if (num_valuators) {
             kbp->deviceid |= MORE_EVENTS;
             clipValuators(pDev, first_valuator, num_valuators, valuators);
             events = getValuatorEvents(events, pDev, first_valuator,
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0039-Bug-10324-dix-Allow-arbitrary-value-ranges-in-Ge.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0039-Bug-10324-dix-Allow-arbitrary-value-ranges-in-Ge.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0039-Bug-10324-dix-Allow-arbitrary-value-ranges-in-Ge.patch?rev=1.1&content-type=text/plain

Index: 0039-Bug-10324-dix-Allow-arbitrary-value-ranges-in-Ge.patch
===================================================================
From 1d79ba8193e9584370ffaaa8dffb4db604125dea Mon Sep 17 00:00:00 2001
From: =?utf-8?q?Magnus=20Vigerl=C3=B6f?= <Magnus.Vigerlof@××××.se>
Date: Sat, 2 Feb 2008 22:45:31 +0100
Subject: [PATCH] Bug # 10324: dix: Allow arbitrary value ranges in GetPointerEvents

Don't use a possitive value as a marker for if a max-value
is defined on the valuators. Use the existence of a valid
value range instead. This will also make it possible to
define arbitrary start and end-values for min and max as
long as min < max.
(cherry picked from commit f04c0838699f1a733735838e74cfbb1677b15dc4)
---
 dix/getevents.c |   11 +++++++----
 1 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/dix/getevents.c b/dix/getevents.c
index 36c1bcf..8595eaf 100644
--- a/dix/getevents.c
+++ b/dix/getevents.c
@@ -306,10 +306,13 @@ clipAxis(DeviceIntPtr pDev, int axisNum, int *val)
 {
     AxisInfoPtr axes = pDev->valuator->axes + axisNum;
 
-    if (*val < axes->min_value)
-        *val = axes->min_value;
-    if (axes->max_value >= 0 && *val > axes->max_value)
-        *val = axes->max_value;
+    /* No clipping if the value-range <= 0 */
+    if(axes->min_value < axes->min_value) {
+        if (*val < axes->min_value)
+            *val = axes->min_value;
+        if (*val > axes->max_value)
+            *val = axes->max_value;
+    }
 }
 
 /**
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0040-Bug-10324-dix-Add-scaling-of-X-and-Y-on-the-repo.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0040-Bug-10324-dix-Add-scaling-of-X-and-Y-on-the-repo.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0040-Bug-10324-dix-Add-scaling-of-X-and-Y-on-the-repo.patch?rev=1.1&content-type=text/plain

Index: 0040-Bug-10324-dix-Add-scaling-of-X-and-Y-on-the-repo.patch
===================================================================
From b51ca35a7578b64190f663dc825d7fb551b92e73 Mon Sep 17 00:00:00 2001
From: =?utf-8?q?Magnus=20Vigerl=C3=B6f?= <Magnus.Vigerlof@××××.se>
Date: Sat, 2 Feb 2008 22:57:32 +0100
Subject: [PATCH] Bug # 10324: dix: Add scaling of X and Y on the reported pointer-events

Restore the rescaling code for x and y axis when generating
motion events.
(cherry picked from commit d9e23c4ff1607a62164b34717ef9afd352ce2b94)
---
 dix/getevents.c |   97 +++++++++++++++++++++++++++++++++++++++++++------------
 1 files changed, 76 insertions(+), 21 deletions(-)

diff --git a/dix/getevents.c b/dix/getevents.c
index 8595eaf..e0bc326 100644
--- a/dix/getevents.c
+++ b/dix/getevents.c
@@ -529,6 +529,7 @@ GetPointerEvents(xEvent *events, DeviceIntPtr pDev, int type, int buttons,
     DeviceIntPtr cp = inputInfo.pointer;
     int x = 0, y = 0;
     Bool coreOnly = (pDev == inputInfo.pointer);
+    ScreenPtr scr = miPointerGetScreen(pDev);
 
     /* Sanity checks. */
     if (type != MotionNotify && type != ButtonPress && type != ButtonRelease)
@@ -572,20 +573,39 @@ GetPointerEvents(xEvent *events, DeviceIntPtr pDev, int type, int buttons,
             x = valuators[0];
         }
         else {
-            if (pDev->coreEvents)
-                x = cp->valuator->lastx;
-            else
-                x = pDev->valuator->lastx;
+            /* If we're sending core events but didn't provide a value,
+             * translate the core value (but use the device coord if
+             * it translates to the same coord to preserve sub-pixel
+             * coord information). If we're not sending core events use
+             * whatever value we have */
+            x = pDev->valuator->lastx;
+            if(pDev->coreEvents) {
+                int min = pDev->valuator->axes[0].min_value;
+                int max = pDev->valuator->axes[0].max_value;
+                if(min < max) {
+                    if((int)((float)(x-min)*scr->width/(max-min+1)) != cp->valuator->lastx)
+                        x = (int)((float)(cp->valuator->lastx)*(max-min+1)/scr->width)+min;
+                }
+                else
+                    x = cp->valuator->lastx;
+            }
         }
 
         if (first_valuator <= 1 && num_valuators >= (2 - first_valuator)) {
             y = valuators[1 - first_valuator];
         }
         else {
-            if (pDev->coreEvents)
-                y = cp->valuator->lasty;
-            else
-                y = pDev->valuator->lasty;
+            y = pDev->valuator->lasty;
+            if(pDev->coreEvents) {
+                int min = pDev->valuator->axes[1].min_value;
+                int max = pDev->valuator->axes[1].max_value;
+                if(min < max) {
+                    if((int)((float)(y-min)*scr->height/(max-min+1)) != cp->valuator->lasty)
+                        y = (int)((float)(cp->valuator->lasty)*(max-min+1)/scr->height)+min;
+                }
+                else
+                    y = cp->valuator->lasty;
+            }
         }
     }
     else {
@@ -594,15 +614,35 @@ GetPointerEvents(xEvent *events, DeviceIntPtr pDev, int type, int buttons,
                               valuators);
 
         if (pDev->coreEvents) {
-            if (first_valuator == 0 && num_valuators >= 1)
-                x = cp->valuator->lastx + valuators[0];
+            /* Get and convert the core pointer coordinate space into
+             * device coordinates. Use the device coords if it translates
+             * into the same position as the core to preserve relative sub-
+             * pixel movements from the device. */
+            int min = pDev->valuator->axes[0].min_value;
+            int max = pDev->valuator->axes[0].max_value;
+            if(min < max) {
+                x = pDev->valuator->lastx;
+                if((int)((float)(x-min)*scr->width/(max-min+1)) != cp->valuator->lastx)
+                    x = (int)((float)(cp->valuator->lastx)*(max-min+1)/scr->width)+min;
+            }
             else
                 x = cp->valuator->lastx;
 
-            if (first_valuator <= 1 && num_valuators >= (2 - first_valuator))
-                y = cp->valuator->lasty + valuators[1 - first_valuator];
+            min = pDev->valuator->axes[1].min_value;
+            max = pDev->valuator->axes[1].max_value;
+            if(min < max) {
+                y = pDev->valuator->lasty;
+                if((int)((float)(y-min)*scr->height/(max-min+1)) != cp->valuator->lasty)
+                    y = (int)((float)(cp->valuator->lasty)*(max-min+1)/scr->height)+min;
+            }
             else
                 y = cp->valuator->lasty;
+
+            /* Add relative movement */
+            if (first_valuator == 0 && num_valuators >= 1)
+                x += valuators[0];
+            if (first_valuator <= 1 && num_valuators >= (2 - first_valuator))
+                y += valuators[1 - first_valuator];
         }
         else {
             if (first_valuator == 0 && num_valuators >= 1)
@@ -621,11 +661,6 @@ GetPointerEvents(xEvent *events, DeviceIntPtr pDev, int type, int buttons,
     clipAxis(pDev, 0, &x);
     clipAxis(pDev, 1, &y);
 
-    /* This takes care of crossing screens for us, as well as clipping
-     * to the current screen.  Right now, we only have one history buffer,
-     * so we don't set this for both the device and core.*/
-    miPointerSetPosition(pDev, &x, &y, ms);
-
     /* Drop x and y back into the valuators list, if they were originally
      * present. */
     if (first_valuator == 0 && num_valuators >= 1)
@@ -635,12 +670,32 @@ GetPointerEvents(xEvent *events, DeviceIntPtr pDev, int type, int buttons,
 
     updateMotionHistory(pDev, ms, first_valuator, num_valuators, valuators);
 
+    pDev->valuator->lastx = x;
+    pDev->valuator->lasty = y;
+    /* Convert the dev coord back to screen coord if we're
+     * sending core events */
+    if (pDev->coreEvents) {
+        int min = pDev->valuator->axes[0].min_value;
+        int max = pDev->valuator->axes[0].max_value;
+        if(min < max)
+            x = (int)((float)(x-min)*scr->width/(max-min+1));
+        cp->valuator->lastx = x;
+        min = pDev->valuator->axes[1].min_value;
+        max = pDev->valuator->axes[1].max_value;
+        if(min < max)
+            y = (int)((float)(y-min)*scr->height/(max-min+1));
+        cp->valuator->lasty = y;
+    }
+
+    /* This takes care of crossing screens for us, as well as clipping
+     * to the current screen.  Right now, we only have one history buffer,
+     * so we don't set this for both the device and core.*/
+    miPointerSetPosition(pDev, &x, &y, ms);
+
     if (pDev->coreEvents) {
         cp->valuator->lastx = x;
         cp->valuator->lasty = y;
     }
-    pDev->valuator->lastx = x;
-    pDev->valuator->lasty = y;
 
     /* for some reason inputInfo.pointer does not have coreEvents set */
     if (coreOnly || pDev->coreEvents) {
@@ -678,8 +733,8 @@ GetPointerEvents(xEvent *events, DeviceIntPtr pDev, int type, int buttons,
             kbp->detail = pDev->button->map[buttons];
         }
 
-        kbp->root_x = x;
-        kbp->root_y = y;
+        kbp->root_x = pDev->valuator->lastx;
+        kbp->root_y = pDev->valuator->lasty;
 
         events++;
         if (num_valuators) {
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0041-dix-Skip-call-to-clipAxis-for-relative-core-events.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0041-dix-Skip-call-to-clipAxis-for-relative-core-events.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0041-dix-Skip-call-to-clipAxis-for-relative-core-events.patch?rev=1.1&content-type=text/plain

Index: 0041-dix-Skip-call-to-clipAxis-for-relative-core-events.patch
===================================================================
From a68d0ef4a65bcd52c52ba54e6925082a9145fad3 Mon Sep 17 00:00:00 2001
From: =?utf-8?q?Magnus=20Vigerl=C3=B6f?= <Magnus.Vigerlof@××××.se>
Date: Sat, 2 Feb 2008 23:03:51 +0100
Subject: [PATCH] dix: Skip call to clipAxis for relative core-events

Relative events that generates both core and extention
events will have its axis cliped and screen changed by
miPointerSetPosition when the events are processed. For
absolute and non core-generating relative events the
axis must be clipped if we shouldn't end up completely
outside the defined ranges (if any).
(cherry picked from commit a0284d577aabea8406b72dd63773e341430ebe56)
---
 dix/getevents.c |   44 +++++++++++++++++++++++++++++++++-----------
 1 files changed, 33 insertions(+), 11 deletions(-)

diff --git a/dix/getevents.c b/dix/getevents.c
index e0bc326..c33371b 100644
--- a/dix/getevents.c
+++ b/dix/getevents.c
@@ -607,6 +607,10 @@ GetPointerEvents(xEvent *events, DeviceIntPtr pDev, int type, int buttons,
                     y = cp->valuator->lasty;
             }
         }
+
+        /* Clip both x and y to the defined limits (usually co-ord space limit). */
+        clipAxis(pDev, 0, &x);
+        clipAxis(pDev, 1, &y);
     }
     else {
         if (flags & POINTER_ACCELERATE)
@@ -645,22 +649,22 @@ GetPointerEvents(xEvent *events, DeviceIntPtr pDev, int type, int buttons,
                 y += valuators[1 - first_valuator];
         }
         else {
+            x = pDev->valuator->lastx;
+            y = pDev->valuator->lasty;
             if (first_valuator == 0 && num_valuators >= 1)
-                x = pDev->valuator->lastx + valuators[0];
-            else
-                x = pDev->valuator->lastx;
-
+                x += valuators[0];
             if (first_valuator <= 1 && num_valuators >= (2 - first_valuator))
-                y = pDev->valuator->lasty + valuators[1 - first_valuator];
-            else
-                y = pDev->valuator->lasty;
+                y += valuators[1 - first_valuator];
+
+            if(!coreOnly) {
+                /* Since we're not sending core-events we must clip both x and y
+                 * to the defined limits so we don't run outside the box. */
+                clipAxis(pDev, 0, &x);
+                clipAxis(pDev, 1, &y);
+            }
         }
     }
 
-    /* Clip both x and y to the defined limits (usually co-ord space limit). */
-    clipAxis(pDev, 0, &x);
-    clipAxis(pDev, 1, &y);
-
     /* Drop x and y back into the valuators list, if they were originally
      * present. */
     if (first_valuator == 0 && num_valuators >= 1)
@@ -693,6 +697,24 @@ GetPointerEvents(xEvent *events, DeviceIntPtr pDev, int type, int buttons,
     miPointerSetPosition(pDev, &x, &y, ms);
 
     if (pDev->coreEvents) {
+        /* miPointerSetPosition may have changed screen */
+        scr = miPointerGetScreen(pDev);
+        if(x != cp->valuator->lastx) {
+            int min = pDev->valuator->axes[0].min_value;
+            int max = pDev->valuator->axes[0].max_value;
+            cp->valuator->lastx = pDev->valuator->lastx = x;
+            if(min < max)
+                pDev->valuator->lastx = (int)((float)(x)*(max-min+1)/scr->width)+min;
+        }
+        if(y != cp->valuator->lasty) {
+            int min = pDev->valuator->axes[1].min_value;
+            int max = pDev->valuator->axes[1].max_value;
+            cp->valuator->lasty = pDev->valuator->lasty = y;
+            if(min < max)
+                pDev->valuator->lasty = (int)((float)(y)*(max-min+1)/scr->height)+min;
+        }
+    }
+    else if (coreOnly) {
         cp->valuator->lastx = x;
         cp->valuator->lasty = y;
     }
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0042-dix-Move-motion-history-update-until-after-screen-c.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0042-dix-Move-motion-history-update-until-after-screen-c.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0042-dix-Move-motion-history-update-until-after-screen-c.patch?rev=1.1&content-type=text/plain

Index: 0042-dix-Move-motion-history-update-until-after-screen-c.patch
===================================================================
From b1145a6b428db2037c79ffb36116e7183f30829f Mon Sep 17 00:00:00 2001
From: =?utf-8?q?Magnus=20Vigerl=C3=B6f?= <Magnus.Vigerlof@××××.se>
Date: Sat, 2 Feb 2008 23:04:46 +0100
Subject: [PATCH] dix: Move motion history update until after screen crossing and clipping

Cross screen and clip the coordinates before updating the motion history
so that it will have the same contents as the events that are reported.
(cherry picked from commit a56ef7aaa4b6ac13c8181f68fc7dad3ca89e6973)
---
 dix/getevents.c |   18 +++++++++---------
 1 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/dix/getevents.c b/dix/getevents.c
index c33371b..d0fe2db 100644
--- a/dix/getevents.c
+++ b/dix/getevents.c
@@ -665,15 +665,6 @@ GetPointerEvents(xEvent *events, DeviceIntPtr pDev, int type, int buttons,
         }
     }
 
-    /* Drop x and y back into the valuators list, if they were originally
-     * present. */
-    if (first_valuator == 0 && num_valuators >= 1)
-        valuators[0] = x;
-    if (first_valuator <= 1 && num_valuators >= (2 - first_valuator))
-        valuators[1 - first_valuator] = y;
-
-    updateMotionHistory(pDev, ms, first_valuator, num_valuators, valuators);
-
     pDev->valuator->lastx = x;
     pDev->valuator->lasty = y;
     /* Convert the dev coord back to screen coord if we're
@@ -719,6 +710,15 @@ GetPointerEvents(xEvent *events, DeviceIntPtr pDev, int type, int buttons,
         cp->valuator->lasty = y;
     }
 
+    /* Drop x and y back into the valuators list, if they were originally
+     * present. */
+    if (first_valuator == 0 && num_valuators >= 1)
+        valuators[0] = pDev->valuator->lastx;
+    if (first_valuator <= 1 && num_valuators >= (2 - first_valuator))
+        valuators[1 - first_valuator] = pDev->valuator->lasty;
+
+    updateMotionHistory(pDev, ms, first_valuator, num_valuators, valuators);
+
     /* for some reason inputInfo.pointer does not have coreEvents set */
     if (coreOnly || pDev->coreEvents) {
         events->u.u.type = type;
-- 
1.5.5.1




1.1                  x11-base/xorg-server/files/1.4.0.90/0043-XKB-Actually-explain-keymap-failures.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0043-XKB-Actually-explain-keymap-failures.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4.0.90/0043-XKB-Actually-explain-keymap-failures.patch?rev=1.1&content-type=text/plain

Index: 0043-XKB-Actually-explain-keymap-failures.patch
===================================================================
From 104048501f37b139d4113562ef1711978cc76018 Mon Sep 17 00:00:00 2001
From: Daniel Stone <daniel@×××××××××.org>
Date: Wed, 7 May 2008 23:11:31 +0300
Subject: [PATCH] XKB: Actually explain keymap failures

When something went wrong building a keymap, try to explain to the user
what it actually was, instead of the dreaded 'Failed to load XKB keymap'
catch-all.
(cherry picked from commit cf20df39cc78203d17b99223908af388ecbf7d0e)

Conflicts:
	xkb/ddxLoad.c
---
 xkb/ddxLoad.c |   69 ++++++++++++++++++++++++++++-----------------------------
 1 files changed, 34 insertions(+), 35 deletions(-)

diff --git a/xkb/ddxLoad.c b/xkb/ddxLoad.c
index d79ae7a..ea9c3ff 100644
--- a/xkb/ddxLoad.c
+++ b/xkb/ddxLoad.c
@@ -385,24 +385,20 @@ char tmpname[PATH_MAX];
                 xfree (buf);
 	    return True;
 	}
-#ifdef DEBUG
 	else
-	    ErrorF("Error compiling keymap (%s)\n",keymap);
-#endif
+	    LogMessage(X_ERROR, "Error compiling keymap (%s)\n", keymap);
 #ifdef WIN32
         /* remove the temporary file */
         unlink(tmpname);
 #endif
     }
-#ifdef DEBUG
     else {
 #ifndef WIN32
-	ErrorF("Could not invoke keymap compiler\n");
+	LogMessage(X_ERROR, "XKB: Could not invoke xkbcomp\n");
 #else
-	ErrorF("Could not open file %s\n", tmpname);
+	LogMessage(X_ERROR, "Could not open file %s\n", tmpname);
 #endif
     }
-#endif
     if (nameRtrn)
 	nameRtrn[0]= '\0';
     if (buf != NULL)
@@ -477,17 +473,14 @@ unsigned	missing;
 	    return 0;
 	}
 	else if (!XkbDDXCompileNamedKeymap(xkb,names,nameRtrn,nameRtrnLen)) {
-#ifdef NOISY
-	    ErrorF("Couldn't compile keymap file\n");
-#endif
+            LogMessage(X_ERROR, "Couldn't compile keymap file %s\n",
+                       names->keymap);
 	    return 0;
 	}
     }
     else if (!XkbDDXCompileKeymapByNames(xkb,names,want,need,
-						nameRtrn,nameRtrnLen)){
-#ifdef NOISY
-	ErrorF("Couldn't compile keymap file\n");
-#endif
+                                         nameRtrn,nameRtrnLen)){
+	LogMessage(X_ERROR, "XKB: Couldn't compile keymap\n");
 	return 0;
     }
     file= XkbDDXOpenConfigFile(nameRtrn,fileName,PATH_MAX);
@@ -502,11 +495,9 @@ unsigned	missing;
 	(void) unlink (fileName);
 	return 0;
     }
-#ifdef DEBUG
-    else if (xkbDebugFlags) {
-	ErrorF("Loaded %s, defined=0x%x\n",fileName,finfoRtrn->defined);
+    else {
+	DebugF("XKB: Loaded %s, defined=0x%x\n",fileName,finfoRtrn->defined);
     }
-#endif
     fclose(file);
     (void) unlink (fileName);
     return (need|want)&(~missing);
@@ -525,32 +516,40 @@ XkbRF_RulesPtr	rules;
 
     if (!rules_name)
 	return False;
-    if (XkbBaseDirectory==NULL) {
-	if (strlen(rules_name)+7 > PATH_MAX)
-	    return False;
-	sprintf(buf,"rules/%s",rules_name);
-    }
-    else {
-	if (strlen(XkbBaseDirectory)+strlen(rules_name)+8 > PATH_MAX)
-	    return False;
-        sprintf(buf,"%s/rules/%s",XkbBaseDirectory,rules_name);
+
+    if (strlen(XkbBaseDirectory) + strlen(rules_name) + 8 > PATH_MAX) {
+        LogMessage(X_ERROR, "XKB: Rules name is too long\n");
+        return False;
     }
-    if ((file= fopen(buf,"r"))==NULL)
+    sprintf(buf,"%s/rules/%s", XkbBaseDirectory, rules_name);
+
+    file = fopen(buf, "r");
+    if (!file) {
+        LogMessage(X_ERROR, "XKB: Couldn't open rules file %s\n", file);
 	return False;
-    if ((rules= XkbRF_Create(0,0))==NULL) {
+    }
+
+    rules = XkbRF_Create(0, 0);
+    if (!rules) {
+        LogMessage(X_ERROR, "XKB: Couldn't create rules struct\n");
 	fclose(file);
 	return False;
     }
-    if (!XkbRF_LoadRules(file,rules)) {
+
+    if (!XkbRF_LoadRules(file, rules)) {
+        LogMessage(X_ERROR, "XKB: Couldn't parse rules file %s\n", rules_name);
 	fclose(file);
 	XkbRF_Free(rules,True);
 	return False;
     }
-    bzero((char *)names,sizeof(XkbComponentNamesRec));
-    complete= XkbRF_GetComponents(rules,defs,names);
+
+    memset(names, 0, sizeof(*names));
+    complete = XkbRF_GetComponents(rules,defs,names);
     fclose(file);
-    XkbRF_Free(rules,True);
-    return complete;
-}
+    XkbRF_Free(rules, True);
 
+    if (!complete)
+        LogMessage(X_ERROR, "XKB: Rules returned no components\n");
 
+    return complete;
+}
-- 
1.5.5.1




-- 
gentoo-commits@l.g.o mailing list