xserver: Branch 'server-1.11-branch' - 2 commits

[Jeremy Huddleston]

 Xi/xipassivegrab.c |   13 ++++++++++---
 dix/events.c       |   14 +++++++++++++-
 2 files changed, 23 insertions(+), 4 deletions(-)

New commits:
commit e9ae33316012ffe9acfeeb7303ab3392c2ca2a2b
Author: Sam Spilsbury <sam.spilsbury at canonical.com>
Date:   Wed Sep 14 09:58:34 2011 +0800

    Remove the SendEvent bit (0x80) before doing range checks on event type.
    
    Some extension libraries may set this bit before converting the event to
    wire protocol and as such range checking the event will cause an invalid
    BadValue error to result. As the documentation suggests the the bit
    should be "forced on", remove it before doing range checks and continue
    to force it on in the server.
    
    Reviewed-by: Jamey Sharp <jamey at minilop.net>
    Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
    (cherry picked from commit 2d2dce558d24eeea0eb011ec9ebaa6c5c2273c39)

diff --git a/dix/events.c b/dix/events.c
index 8a4c6b9..9e58edb 100644
--- a/dix/events.c
+++ b/dix/events.c
@@ -5224,6 +5224,8 @@ CloseDownEvents(void)
     InputEventList = NULL;
 }
 
+#define SEND_EVENT_BIT 0x80
+
 /**
  * Server-side protocol handling for SendEvent request.
  *
@@ -5241,6 +5243,16 @@ ProcSendEvent(ClientPtr client)
 
     REQUEST_SIZE_MATCH(xSendEventReq);
 
+    /* libXext and other extension libraries may set the bit indicating
+     * that this event came from a SendEvent request so remove it
+     * since otherwise the event type may fail the range checks
+     * and cause an invalid BadValue error to be returned.
+     *
+     * This is safe to do since we later add the SendEvent bit (0x80)
+     * back in once we send the event to the client */
+
+    stuff->event.u.u.type &= ~(SEND_EVENT_BIT);
+
     /* The client's event type must be a core event type or one defined by an
 	extension. */
 
@@ -5298,7 +5310,7 @@ ProcSendEvent(ClientPtr client)
 	client->errorValue = stuff->propagate;
 	return BadValue;
     }
-    stuff->event.u.u.type |= 0x80;
+    stuff->event.u.u.type |= SEND_EVENT_BIT;
     if (stuff->propagate)
     {
 	for (;pWin; pWin = pWin->parent)
commit 347f5610ca023fb31485aa19c20607af8bf9c834
Author: Carlos Garnacho <carlosg at gnome.org>
Date:   Wed Aug 31 00:46:52 2011 +0200

    Xi: Fix passive XI2 ungrabs on XIAll[Master]Devices
    
    The corresponding DeviceIntPtr wasn't being gotten properly,
    resulting in BadDevice from dixLookupDevice().
    
    Signed-off-by: Carlos Garnacho <carlosg at gnome.org>
    Reviewed-by: Peter Hutterer <peter.hutterer at who-t.net>
    Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
    (cherry picked from commit f52d5cd374563544dafe29587411f345e31bbdf8)

diff --git a/Xi/xipassivegrab.c b/Xi/xipassivegrab.c
index ae43433..5cdd8ac 100644
--- a/Xi/xipassivegrab.c
+++ b/Xi/xipassivegrab.c
@@ -261,9 +261,16 @@ ProcXIPassiveUngrabDevice(ClientPtr client)
     REQUEST(xXIPassiveUngrabDeviceReq);
     REQUEST_AT_LEAST_SIZE(xXIPassiveUngrabDeviceReq);
 
-    rc = dixLookupDevice(&dev, stuff->deviceid, client, DixGrabAccess);
-    if (rc != Success)
-	return rc;
+    if (stuff->deviceid == XIAllDevices)
+        dev = inputInfo.all_devices;
+    else if (stuff->deviceid == XIAllMasterDevices)
+        dev = inputInfo.all_master_devices;
+    else
+    {
+        rc = dixLookupDevice(&dev, stuff->deviceid, client, DixGrabAccess);
+        if (rc != Success)
+	    return rc;
+    }
 
     if (stuff->grab_type != XIGrabtypeButton &&
         stuff->grab_type != XIGrabtypeKeycode &&