xserver: Branch 'server-1.8-branch'

[Jeremy Huddleston]

 hw/xquartz/xpr/xprCursor.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

New commits:
commit 9168c63e275767c728afe7b2bba8bc391aceeeb8
Author: Jeremy Huddleston <jeremyhu at apple.com>
Date:   Tue Jul 13 08:25:27 2010 -0700

    XQuartz: Avoid a crash when mistakenly free()ing in QuartzSetCursor on some configs
    
    Signed-off-by: Jeremy Huddleston <jeremyhu at apple.com>
    (cherry picked from commit 648d189548530fa23d97d1e8737f89d297f1c443)

diff --git a/hw/xquartz/xpr/xprCursor.c b/hw/xquartz/xpr/xprCursor.c
index fbaf825..95eaed9 100644
--- a/hw/xquartz/xpr/xprCursor.c
+++ b/hw/xquartz/xpr/xprCursor.c
@@ -68,6 +68,7 @@ static Bool
 load_cursor(CursorPtr src, int screen)
 {
     uint32_t *data;
+    Bool free_data = FALSE;
     uint32_t rowbytes;
     int width, height;
     int hot_x, hot_y;
@@ -96,6 +97,7 @@ load_cursor(CursorPtr src, int screen)
         unsigned i;
         rowbytes = src->bits->width * sizeof (CARD32);
         data = xalloc(rowbytes * src->bits->height);
+        free_data = TRUE;
         if(!data) {
             FatalError("Failed to allocate memory in %s\n", __func__);
         }
@@ -122,6 +124,7 @@ load_cursor(CursorPtr src, int screen)
         /* round up to 8 pixel boundary so we can convert whole bytes */
         rowbytes = ((src->bits->width * 4) + 31) & ~31;
         data = xalloc(rowbytes * src->bits->height);
+        free_data = TRUE;
         if(!data) {
             FatalError("Failed to allocate memory in %s\n", __func__);
         }
@@ -174,7 +177,8 @@ load_cursor(CursorPtr src, int screen)
     }
 
     err = xp_set_cursor(width, height, hot_x, hot_y, data, rowbytes);
-    xfree(data);
+    if(free_data)
+        xfree(data);
     return err == Success;
 }