xserver: Branch 'master'

[Matthieu Herrb]

 fb/fbtrap.c         |    3 +++
 render/renderedge.c |    1 +
 2 files changed, 4 insertions(+)

New commits:
diff-tree 71fc5b3e9309182978ead676965d65ca93a4e3b9 (from 873ef75b1e8c94d39670c981c4d830ab8bcc018b)
Author: Keith Packard <keithp at keithp.com>
Date:   Wed May 2 11:41:11 2007 +0200

    Fix for a divide by zero that can be triggered by a malicious client.
    
    Problem reported by Derek Abdine of rapid7.com. Thanks.

diff --git a/fb/fbtrap.c b/fb/fbtrap.c
index 4c67bcd..478a80f 100644
--- a/fb/fbtrap.c
+++ b/fb/fbtrap.c
@@ -117,6 +117,9 @@ fbRasterizeTrapezoid (PicturePtr    pPic
     RenderEdge	l, r;
     xFixed	t, b;
     
+    if (!xTrapezoidValid (trap))
+	return;
+
     fbGetDrawable (pPicture->pDrawable, buf, stride, bpp, pxoff, pyoff);
 
     width = pPicture->pDrawable->width;
diff --git a/render/renderedge.c b/render/renderedge.c
index 199ec22..c2ffabe 100644
--- a/render/renderedge.c
+++ b/render/renderedge.c
@@ -143,6 +143,7 @@ RenderEdgeInit (RenderEdge	*e,
     dx = x_bot - x_top;
     dy = y_bot - y_top;
     e->dy = dy;
+    e->dx = 0;
     if (dy)
     {
 	if (dx >= 0)