xserver: Branch 'xorg-server-1.2-apple'

[Jeremy Huddleston]

 Xext/shm.c |   12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

New commits:
commit 5ef366e8eb9f4c309105d23da1b96890bb8aa92d
Author: Matthias Hopf <mhopf at suse.de>
Date:   Mon Jan 21 16:13:21 2008 +0100

    CVE-2007-6429: Always test for size+offset wrapping.
    (cherry picked from commit be6c17fcf9efebc0bbcc3d9a25f8c5a2450c2161)

diff --git a/Xext/shm.c b/Xext/shm.c
index ed7dc28..4a16fb6 100644
--- a/Xext/shm.c
+++ b/Xext/shm.c
@@ -761,10 +761,10 @@ CreatePmap:
     if (sizeof(size) == 4 && BitsPerPixel(depth) > 8) {
         if (size < width * height)
             return BadAlloc;
-        /* thankfully, offset is unsigned */
-        if (stuff->offset + size < size)
-            return BadAlloc;
     }
+    /* thankfully, offset is unsigned */
+    if (stuff->offset + size < size)
+	return BadAlloc;
 
     VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
 
@@ -1101,10 +1101,10 @@ CreatePmap:
     if (sizeof(size) == 4 && BitsPerPixel(depth) > 8) {
 	if (size < width * height)
 	    return BadAlloc;
-	/* thankfully, offset is unsigned */
-	if (stuff->offset + size < size)
-	    return BadAlloc;
     }
+    /* thankfully, offset is unsigned */
+    if (stuff->offset + size < size)
+	return BadAlloc;
 
     VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
     pMap = (*shmFuncs[pDraw->pScreen->myNum]->CreatePixmap)(