xserver: Branch 'master'

[Julien Cristau]

 GL/glx/glxglcore.c |   13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

New commits:
diff-tree ff089e6cae634ac3eb509abd448a250bcbb17275 (from 943dd6ad99670c283a6869ea6c5f751acbd73134)
Author: Brian Paul <brian.paul at tungstengraphics.com>
Date:   Thu Aug 23 19:38:53 2007 +0200

    glx: fix crash when freeing visuals
    
    Don't set screen->num_vis to a value greater than the actual number of visuals.
    
    X.Org Bug #10809 <http://bugs.freedesktop.org/show_bug.cgi?id=10809>

diff --git a/GL/glx/glxglcore.c b/GL/glx/glxglcore.c
index df9be07..679d55c 100644
--- a/GL/glx/glxglcore.c
+++ b/GL/glx/glxglcore.c
@@ -296,7 +296,7 @@ static void init_screen_visuals(__GLXMES
     __GLcontextModes *modes;
     XMesaVisual *pXMesaVisual;
     int *used;
-    int i, j, size;
+    int num_vis, j, size;
 
     /* Alloc space for the list of XMesa visuals */
     size = screen->base.numVisuals * sizeof(XMesaVisual);
@@ -312,7 +312,7 @@ static void init_screen_visuals(__GLXMES
     used = (int *) xalloc(pScreen->numVisuals * sizeof(int));
     memset(used, 0, pScreen->numVisuals * sizeof(int));
 
-    i = 0;
+    num_vis = 0;
     for ( modes = screen->base.modes; modes != NULL; modes = modes->next ) {
 	const int vis_class = _gl_convert_to_x_visual_type( modes->visualType );
 	const int nplanes = (modes->rgbBits - modes->alphaBits);
@@ -327,7 +327,8 @@ static void init_screen_visuals(__GLXMES
 		!used[j]) {
 
 		/* Create the XMesa visual */
-		pXMesaVisual[i] =
+                assert(num_vis < screen->base.numVisuals);
+		pXMesaVisual[num_vis] =
 		    XMesaCreateVisual(pScreen,
 				      &pVis[j],
 				      modes->rgbMode,
@@ -364,13 +365,15 @@ static void init_screen_visuals(__GLXMES
 	    FatalError( "Matching visual found, but visualID still -1!\n" );
 	}
 
-	i++;
+	num_vis++;
     }
 
     xfree(used);
 
-    screen->num_vis = pScreen->numVisuals;
+    screen->num_vis = num_vis;
     screen->xm_vis = pXMesaVisual;
+
+    assert(screen->num_vis <= screen->base.numVisuals);
 }
 
 static __GLXscreen *