xserver: Branch 'randr-1.2-for-server-1.2'

[Keith Packard]

 randr/rrcrtc.c   |    2 +-
 randr/rroutput.c |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

New commits:
diff-tree 4202b23ed86405a4cebfdcf239df1b023c1d10ca (from ec83d674167e7045d5317b179c9998e3172a26dc)
Author: Keith Packard <keithp at guitar.keithp.com>
Date:   Mon Nov 27 21:40:24 2006 -0800

    Destroying RandR crtc or output overwrites memory.
    
    RRCrtcDestroyResource and RROutputDestroyResource had matching
    bugs that would overwrite memory past the end of the storage
    of the crtc or output arrays. Oops.

diff --git a/randr/rrcrtc.c b/randr/rrcrtc.c
index 212352c..e8a7b79 100644
--- a/randr/rrcrtc.c
+++ b/randr/rrcrtc.c
@@ -344,7 +344,7 @@ RRCrtcDestroyResource (pointer value, XI
 	    if (pScrPriv->crtcs[i] == crtc)
 	    {
 		memmove (pScrPriv->crtcs + i, pScrPriv->crtcs + i + 1,
-			 (pScrPriv->numCrtcs - (i - 1)) * sizeof (RRCrtcPtr));
+			 (pScrPriv->numCrtcs - (i + 1)) * sizeof (RRCrtcPtr));
 		--pScrPriv->numCrtcs;
 		break;
 	    }
diff --git a/randr/rroutput.c b/randr/rroutput.c
index f38f582..430f8bd 100644
--- a/randr/rroutput.c
+++ b/randr/rroutput.c
@@ -327,7 +327,7 @@ RROutputDestroyResource (pointer value, 
 	    if (pScrPriv->outputs[i] == output)
 	    {
 		memmove (pScrPriv->outputs + i, pScrPriv->outputs + i + 1,
-			 (pScrPriv->numOutputs - (i - 1)) * sizeof (RROutputPtr));
+			 (pScrPriv->numOutputs - (i + 1)) * sizeof (RROutputPtr));
 		--pScrPriv->numOutputs;
 		break;
 	    }