xserver: Branch 'master' - 4 commits

[Keith Packard]

 dix/dixfonts.c                 |   30 +++++++++++++++---------------
 fb/fbpict.c                    |    4 +++-
 hw/xfree86/modes/xf86Crtc.c    |    1 +
 hw/xquartz/pbproxy/Makefile.am |    1 +
 4 files changed, 20 insertions(+), 16 deletions(-)

New commits:
commit fae7ed62ad476114bd37b566202cf6b6546c0a1f
Author: Jeremy Huddleston <jeremyhu at apple.com>
Date:   Tue Oct 4 21:40:03 2011 -0700

    XQuartz: pbproxy: Add missing AM_OBJCFLAGS
    
    Signed-off-by: Jeremy Huddleston <jeremyhu at apple.com>

diff --git a/hw/xquartz/pbproxy/Makefile.am b/hw/xquartz/pbproxy/Makefile.am
index b8b95d2..1b14dff 100644
--- a/hw/xquartz/pbproxy/Makefile.am
+++ b/hw/xquartz/pbproxy/Makefile.am
@@ -2,6 +2,7 @@ AM_CPPFLAGS=-F/System/Library/Frameworks/ApplicationServices.framework/Framework
 	-DBUNDLE_ID_PREFIX=\"$(BUNDLE_ID_PREFIX)\"
 
 AM_CFLAGS=$(XPBPROXY_CFLAGS) 
+AM_OBJCFLAGS=$(XPBPROXY_CFLAGS)
 
 noinst_LTLIBRARIES = libxpbproxy.la
 libxpbproxy_la_SOURCES = \
commit e4cddf509e1729e8ff40354275b65455111ad2bd
Author: vdb at picaros.org <vdb at picaros.org>
Date:   Sat Sep 17 18:55:47 2011 +0200

    Fix a rare memory leak
    
    Signed-off-by: Servaas Vandenberghe <vdb at picaros.org>
    Reviewed-by: Jeremy Huddleston <jeremyhu at apple.com>

diff --git a/hw/xfree86/modes/xf86Crtc.c b/hw/xfree86/modes/xf86Crtc.c
index c2814d4..3fae039 100644
--- a/hw/xfree86/modes/xf86Crtc.c
+++ b/hw/xfree86/modes/xf86Crtc.c
@@ -133,6 +133,7 @@ xf86CrtcCreate (ScrnInfoPtr		scrn,
 	crtcs = malloc((xf86_config->num_crtc + 1) * sizeof (xf86CrtcPtr));
     if (!crtcs)
     {
+	free(crtc->gamma_red);
 	free(crtc);
 	return NULL;
     }
commit 53611213396479abfdce0f7752681572e0d26d78
Author: Kirill Elagin <kirelagin at gmail.com>
Date:   Tue Oct 4 23:02:20 2011 +0400

    Fix server crash due to invalid images
    
    See https://bugs.freedesktop.org/show_bug.cgi?id=39383
    
    Signed-off-by: Kirill Elagin <kirelagin at gmail.com>
    Reviewed-by: Jeremy Huddleston <jeremyhu at apple.com>

diff --git a/fb/fbpict.c b/fb/fbpict.c
index d1fd0cb..57c93fd 100644
--- a/fb/fbpict.c
+++ b/fb/fbpict.c
@@ -163,7 +163,9 @@ create_bits_picture (PicturePtr pict,
 	(pixman_format_code_t)pict->format,
 	pixmap->drawable.width, pixmap->drawable.height,
 	(uint32_t *)bits, stride * sizeof (FbStride));
-    
+
+    if (!image)
+	return NULL;
     
 #ifdef FB_ACCESS_WRAPPER
 #if FB_SHIFT==5
commit 7a33c5b934382b5554f41ab1502514e91c9bc52e
Author: Alan Hourihane <alanh at vmware.com>
Date:   Tue Oct 4 19:42:46 2011 -0700

    dixfonts: Don't overwrite local c variable until new_closure is safely initialized.
    
    Signed-off-by: Alan Hourihane <alanh at vmware.com>
    Reviewed-by: Jeremy Huddleston <jeremyhu at apple.com>

diff --git a/dix/dixfonts.c b/dix/dixfonts.c
index fbac124..d2bcb84 100644
--- a/dix/dixfonts.c
+++ b/dix/dixfonts.c
@@ -1302,31 +1302,30 @@ doPolyText(ClientPtr client, PTclosurePtr c)
 			goto bail;
 		    }
 		    *new_closure = *c;
-		    c = new_closure;
 
-		    len = c->endReq - c->pElt;
-		    c->data = malloc(len);
-		    if (!c->data)
+		    len = new_closure->endReq - new_closure->pElt;
+		    new_closure->data = malloc(len);
+		    if (!new_closure->data)
 		    {
-			free(c);
+			free(new_closure);
 			err = BadAlloc;
 			goto bail;
 		    }
-		    memmove(c->data, c->pElt, len);
-		    c->pElt = c->data;
-		    c->endReq = c->pElt + len;
+		    memmove(new_closure->data, new_closure->pElt, len);
+		    new_closure->pElt = new_closure->data;
+		    new_closure->endReq = new_closure->pElt + len;
 
 		    /* Step 2 */
 
-		    pGC = GetScratchGC(c->pGC->depth, c->pGC->pScreen);
+		    pGC = GetScratchGC(new_closure->pGC->depth, new_closure->pGC->pScreen);
 		    if (!pGC)
 		    {
-			free(c->data);
-			free(c);
+			free(new_closure->data);
+			free(new_closure);
 			err = BadAlloc;
 			goto bail;
 		    }
-		    if ((err = CopyGC(c->pGC, pGC, GCFunction |
+		    if ((err = CopyGC(new_closure->pGC, pGC, GCFunction |
 				      GCPlaneMask | GCForeground |
 				      GCBackground | GCFillStyle |
 				      GCTile | GCStipple |
@@ -1337,15 +1336,16 @@ doPolyText(ClientPtr client, PTclosurePtr c)
 				      Success)
 		    {
 			FreeScratchGC(pGC);
-			free(c->data);
-			free(c);
+			free(new_closure->data);
+			free(new_closure);
 			err = BadAlloc;
 			goto bail;
 		    }
+		    c = new_closure;
 		    origGC = c->pGC;
 		    c->pGC = pGC;
 		    ValidateGC(c->pDraw, c->pGC);
-		    
+
 		    ClientSleep(client, (ClientSleepProcPtr)doPolyText, c);
 
 		    /* Set up to perform steps 3 and 4 */