xserver: Branch 'master'

[Keith Packard]

 dix/privates.c |    1 +
 1 file changed, 1 insertion(+)

New commits:
commit 4151a13c80f3afa43f88afcf19a7aeb16dace93a
Author: Francisco Jerez <currojerez at riseup.net>
Date:   Mon Oct 5 02:39:03 2009 +0200

    dix: Fix a double free in dixFreePrivates.
    
    It can be reproduced when the server is regenerated and for some
    reason the private keys are reassigned in a different order: a
    manually allocated private may get an index formerly used by a
    preallocated private. In that case it will first be manually freed and
    then again by dixFreePrivates, as items[i].size was never zeroed
    out. Do it in dixResetPrivates.
    
    Signed-off-by: Francisco Jerez <currojerez at riseup.net>
    Acked-by: Eamon Walsh <ewalsh at tycho.nsa.gov>
    Signed-off-by: Keith Packard <keithp at keithp.com>

diff --git a/dix/privates.c b/dix/privates.c
index 3a2deb8..e3e7274 100644
--- a/dix/privates.c
+++ b/dix/privates.c
@@ -303,6 +303,7 @@ dixResetPrivates(void)
     /* reset private descriptors */
     for (i = 1; i < nextPriv; i++) {
 	*items[i].key = 0;
+	items[i].size = 0;
 	DeleteCallbackList(&items[i].initfuncs);
 	DeleteCallbackList(&items[i].deletefuncs);
     }