xserver: Branch 'master' - 3 commits

[Keith Packard]

 glx/glxcmds.c                   |    7 +++++++
 hw/xfree86/ddc/interpret_edid.c |    2 +-
 render/render.c                 |    8 ++++++++
 3 files changed, 16 insertions(+), 1 deletion(-)

New commits:
commit 951605b4660290044fb238bcf1d6d9e498567e8c
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date:   Fri Aug 20 13:51:04 2010 +0100

    edid: Adjust rounding of max_clock
    
    A simple hack to accommodate various EDID who have detailed modes that
    exceed the EDID's max pixel clock. The pixel clock is only defined in
    units of 10MHz and often appears as the maximum pixel code of the
    detailed modes, rounded to the nearest 10MHz. Adjusting the max_clock to
    include an extra 5MHz prevents the parser from rejecting the detailed
    modes.
    
    The kernel uses the same fuzz and by including it in X we can use the
    same modes in X as for the console.
    
    Fixes:
    
      Bug 23833 - X uses different refresh rate to that set by kernel module
      https://bugs.freedesktop.org/show_bug.cgi?id=23833
    
    In the future, we will want to try harder to keep the KMS modes but at
    the same time we need to apply the restrictions as specified by the
    user's configuration, and need to fill in modes for fullscreen games on
    fixed-mode panels.
    
    Reported-and-tested-by: Fabio Pedretti <fabio.ped at libero.it>
    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
    Reviewed-by: Alex Deucher <alexdeucher at gmail.com>
    Signed-off-by: Keith Packard <keithp at keithp.com>

diff --git a/hw/xfree86/ddc/interpret_edid.c b/hw/xfree86/ddc/interpret_edid.c
index acb7efa..46958f7 100644
--- a/hw/xfree86/ddc/interpret_edid.c
+++ b/hw/xfree86/ddc/interpret_edid.c
@@ -552,7 +552,7 @@ get_monitor_ranges(Uchar *c, struct monitor_ranges *r)
     r->max_h = MAX_H;
     r->max_clock = 0;
     if(MAX_CLOCK != 0xff) /* is specified? */
-	r->max_clock = MAX_CLOCK * 10;
+	r->max_clock = MAX_CLOCK * 10 + 5;
     if (HAVE_2ND_GTF) {
 	r->gtf_2nd_f = F_2ND_GTF;
 	r->gtf_2nd_c = C_2ND_GTF;
commit 7e581780603d6b15291d032efdeeca77f969e0ba
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date:   Thu Jun 24 12:24:58 2010 +0100

    glx: Prevent NULL context deref in __glXGetDrawable() (bug 29184)
    
    During a SwapBuffers request, we may end up querying an unknown drawable
    outside of an active context, and so need to report this error prior to
    attempting to dereference the NULL context.
    
    Also fixes:
    
      [Bug 29184] glXSwapBuffers with no GLX context crashes X.
      https://bugs.freedesktop.org/show_bug.cgi?id=29184
    
    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
    Cc: Kristian Høgsberg <krh at bitplanet.net>
    Reviewed-by: Adam Jackson <ajax at redhat.com>
    Signed-off-by: Keith Packard <keithp at keithp.com>

diff --git a/glx/glxcmds.c b/glx/glxcmds.c
index 9e5b213..8d13c15 100644
--- a/glx/glxcmds.c
+++ b/glx/glxcmds.c
@@ -491,6 +491,13 @@ __glXGetDrawable(__GLXcontext *glxc, GLXDrawable drawId, ClientPtr client,
 	return pGlxDraw;
     }
 
+    /* No active context and an unknown drawable, bail. */
+    if (glxc == NULL) {
+	    client->errorValue = drawId;
+	    *error = BadMatch;
+	    return NULL;
+    }
+
     /* The drawId wasn't a GLX drawable.  Make sure it's a window and
      * create a GLXWindow for it.  Check that the drawable screen
      * matches the context screen and that the context fbconfig is
commit 5725849a1b427cd4a72b84e57f211edb35838718
Author: Adam Jackson <ajax at redhat.com>
Date:   Mon Jun 28 18:08:50 2010 -0400

    render: Bounds check for nglyphs in ProcRenderAddGlyphs (#28801)
    
    Signed-off-by: Adam Jackson <ajax at redhat.com>
    Reviewed-by: Julien Cristau <jcristau at debian.org>
    Signed-off-by: Keith Packard <keithp at keithp.com>

diff --git a/render/render.c b/render/render.c
index ef233e4..00241f9 100644
--- a/render/render.c
+++ b/render/render.c
@@ -1077,6 +1077,14 @@ ProcRenderAddGlyphs (ClientPtr client)
     gi = (xGlyphInfo *) (gids + nglyphs);
     bits = (CARD8 *) (gi + nglyphs);
     remain -= (sizeof (CARD32) + sizeof (xGlyphInfo)) * nglyphs;
+
+    /* protect against bad nglyphs */
+    if (gi < stuff || gi > ((CARD32 *)stuff + client->req_len) ||
+        bits < stuff || bits > ((CARD32 *)stuff + client->req_len)) {
+        err = BadLength;
+        goto bail;
+    }
+
     for (i = 0; i < nglyphs; i++)
     {
 	size_t padded_width;