xserver: Branch 'server-1.8-branch' - 7 commits
Jeremy Huddleston
jeremyhu at kemper.freedesktop.org
Sat Sep 4 11:43:44 PDT 2010
Xext/xace.c | 170 +++++++++++++++++-----------------------
fb/fbbits.h | 2
hw/xfree86/ddc/interpret_edid.c | 2
hw/xfree86/modes/xf86Crtc.c | 2
hw/xfree86/modes/xf86RandR12.c | 26 +++++-
hw/xfree86/modes/xf86RandR12.h | 1
hw/xfree86/parser/Input.c | 7 +
hw/xfree86/parser/InputClass.c | 6 -
os/access.c | 5 +
render/render.c | 8 +
10 files changed, 127 insertions(+), 102 deletions(-)
New commits:
commit c2f661bd370e55d84d542d89c5234ed12e763522
Author: Keith Packard <keithp at keithp.com>
Date: Fri May 7 22:56:04 2010 -0700
Clean up RandR12 bits on screen close (bug 27114)
When resetting the server, pScrn->EnterVT must be unwrapped or the
next server generation will end up wrapping the wrapper and causing an
infinite recursion on EnterVT.
Signed-off-by: Keith Packard <keithp at keithp.com>
Tested-by: Michael Stapelberg <michael+freedesktop at stapelberg.de>
(cherry picked from commit 68a9ee8370e6f9b38218376ac92d5130a5b0ef1e)
diff --git a/hw/xfree86/modes/xf86Crtc.c b/hw/xfree86/modes/xf86Crtc.c
index 860e520..c7c0bad 100644
--- a/hw/xfree86/modes/xf86Crtc.c
+++ b/hw/xfree86/modes/xf86Crtc.c
@@ -756,6 +756,8 @@ xf86CrtcCloseScreen (int index, ScreenPtr screen)
crtc->randr_crtc = NULL;
}
+ xf86RandR12CloseScreen (screen);
+
return screen->CloseScreen (index, screen);
}
diff --git a/hw/xfree86/modes/xf86RandR12.c b/hw/xfree86/modes/xf86RandR12.c
index 7ba09b6..9325e9b 100644
--- a/hw/xfree86/modes/xf86RandR12.c
+++ b/hw/xfree86/modes/xf86RandR12.c
@@ -927,6 +927,24 @@ xf86RandR12Init (ScreenPtr pScreen)
}
void
+xf86RandR12CloseScreen (ScreenPtr pScreen)
+{
+ XF86RandRInfoPtr randrp;
+
+#if XORG_VERSION_CURRENT < XORG_VERSION_NUMERIC(7,0,0,0,0)
+ if (xf86RandR12Key == NULL)
+ return;
+#endif
+
+ randrp = XF86RANDRINFO(pScreen);
+#if RANDR_12_INTERFACE
+ xf86Screens[pScreen->myNum]->EnterVT = randrp->orig_EnterVT;
+#endif
+
+ free(randrp);
+}
+
+void
xf86RandR12SetRotations (ScreenPtr pScreen, Rotation rotations)
{
XF86RandRInfoPtr randrp;
@@ -1754,10 +1772,16 @@ static Bool
xf86RandR12EnterVT (int screen_index, int flags)
{
ScreenPtr pScreen = screenInfo.screens[screen_index];
+ ScrnInfoPtr pScrn = xf86Screens[screen_index];
XF86RandRInfoPtr randrp = XF86RANDRINFO(pScreen);
+ Bool ret;
if (randrp->orig_EnterVT) {
- if (!randrp->orig_EnterVT (screen_index, flags))
+ pScrn->EnterVT = randrp->orig_EnterVT;
+ ret = pScrn->EnterVT (screen_index, flags);
+ randrp->orig_EnterVT = pScrn->EnterVT;
+ pScrn->EnterVT = xf86RandR12EnterVT;
+ if (!ret)
return FALSE;
}
diff --git a/hw/xfree86/modes/xf86RandR12.h b/hw/xfree86/modes/xf86RandR12.h
index c8d9918..0c586be 100644
--- a/hw/xfree86/modes/xf86RandR12.h
+++ b/hw/xfree86/modes/xf86RandR12.h
@@ -30,6 +30,7 @@
extern _X_EXPORT Bool xf86RandR12CreateScreenResources (ScreenPtr pScreen);
extern _X_EXPORT Bool xf86RandR12Init(ScreenPtr pScreen);
+extern _X_EXPORT void xf86RandR12CloseScreen(ScreenPtr pScreen);
extern _X_EXPORT void xf86RandR12SetRotations (ScreenPtr pScreen, Rotation rotation);
extern _X_EXPORT void xf86RandR12SetTransformSupport (ScreenPtr pScreen, Bool transforms);
extern _X_EXPORT Bool xf86RandR12SetConfig(ScreenPtr pScreen, Rotation rotation, int rate,
commit 853410a873882623e4244c72ada17c59852778d5
Author: Simon Farnsworth <simon.farnsworth at onelan.com>
Date: Tue Jun 22 10:13:30 2010 +0100
Don't crash when asked if a client that has disconnected was local
ProcDRI2Dispatch uses LocalClient to determine if it's safe to respond
to a client that has made DRI2 requests which aren't sensible for
remote clients (anything but version). When the client has disappeared
mid-request stream (e.g. as a result of a kill -9, or a client-side
bug), LocalClient causes the X server to follow suit, as
((OsCommPtr)client->osPrivate)->trans_conn is NULL at this point.
The simple and obvious fix is to just return "not local" when
trans_conn is NULL, which fixes the crash I was seeing; however Keith
Packard pointed out that just checking trans_conn isn't enough;
quoting Keith:
"This looks almost right to me -- I reviewed the os code to see when
_XSERVTransClose is called (which is what frees the trans_conn data) and
found that every place which called that immediately set trans_conn to
NULL, except for the call in CloseDownFileDescriptor which is only
called from CloseDownConnection and which is immediately followed by
freeing the OsCommRec and setting client->osPrivate to NULL. So, I'd
suggest checking client->osPrivate in addition to the above check."
Signed-off-by: Simon Farnsworth <simon.farnsworth at onelan.com>
Reviewed-by: Keith Packard <keithp at keithp.com>
Signed-off-by: Keith Packard <keithp at keithp.com>
(cherry picked from commit 660f6ab5494a728c3ca7ba00c305e9ff06c8ecb2)
diff --git a/os/access.c b/os/access.c
index 3572da0..859f32e 100644
--- a/os/access.c
+++ b/os/access.c
@@ -1123,6 +1123,11 @@ Bool LocalClient(ClientPtr client)
pointer addr;
register HOST *host;
+ if (!client->osPrivate)
+ return FALSE;
+ if (!((OsCommPtr)client->osPrivate)->trans_conn)
+ return FALSE;
+
if (!_XSERVTransGetPeerAddr (((OsCommPtr)client->osPrivate)->trans_conn,
¬used, &alen, &from))
{
commit 929d43d3daeaa8b0df1479f6be432625ef13a340
Author: Jesse Adkins <jesserayadkins at gmail.com>
Date: Wed Aug 4 23:39:14 2010 -0700
xfree86: parser: Never use constant strings for driver names (fixes #17438)
When the parser sees the "keyboard" driver, it automatically (and
silently) replaces it with the constant string "kbd".
Everybody else uses malloc'd memory for the driver name, so input
device closure assumes it can use free.
Free val.str, so this crash doesn't turn into a memory leak. Whew.
Signed-off-by: Jesse Adkins <jesserayadkins at gmail.com>
Reviewed-by: Peter Hutterer <peter.hutterer at who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
(cherry picked from commit bce12f2956f23c0ee53f7f6485dba631293a0931)
diff --git a/hw/xfree86/parser/Input.c b/hw/xfree86/parser/Input.c
index 8c8e46f..04f9c43 100644
--- a/hw/xfree86/parser/Input.c
+++ b/hw/xfree86/parser/Input.c
@@ -59,6 +59,7 @@
#include <xorg-config.h>
#endif
+#include "os.h"
#include "xf86Parser.h"
#include "xf86tokens.h"
#include "Configint.h"
@@ -102,8 +103,10 @@ xf86parseInputSection (void)
case DRIVER:
if (xf86getSubToken (&(ptr->inp_comment)) != STRING)
Error (QUOTE_MSG, "Driver");
- if (strcmp(val.str, "keyboard") == 0)
- ptr->inp_driver = "kbd";
+ if (strcmp(val.str, "keyboard") == 0) {
+ ptr->inp_driver = strdup("kbd");
+ free(val.str);
+ }
else
ptr->inp_driver = val.str;
break;
diff --git a/hw/xfree86/parser/InputClass.c b/hw/xfree86/parser/InputClass.c
index 7fb2866..9e73670 100644
--- a/hw/xfree86/parser/InputClass.c
+++ b/hw/xfree86/parser/InputClass.c
@@ -85,8 +85,10 @@ xf86parseInputClassSection(void)
case DRIVER:
if (xf86getSubToken(&(ptr->comment)) != STRING)
Error(QUOTE_MSG, "Driver");
- if (strcmp(val.str, "keyboard") == 0)
- ptr->driver = "kbd";
+ if (strcmp(val.str, "keyboard") == 0) {
+ ptr->driver = strdup("kbd");
+ free(val.str);
+ }
else
ptr->driver = val.str;
break;
commit 5e5cb1b19eaad35f9fb803dac3b47a4643991e49
Author: Keith Packard <keithp at keithp.com>
Date: Fri Aug 20 10:01:48 2010 -0700
fb: make isClipped always reject negative coordinates (bug 11503)
A window with either dimension > 32767 can be positioned such that
coordinates > 32767 are visible on the screen. Attempts to draw to
those pixels will generate coordinates wrapped around to negative
values.
The optimized clipping macro, 'isClipped', in fbbits.h, computes
clipping in window space rather than screen space using int16 values,
and so it too has coordinates wrapped around to negative values and
hence ends up accepting the wrapped drawing coordinates.
Two possible fixes for this problem
1) Detect wrapped region coordinates and clip those to 32767.
2) Detect negative incoming coordinates and reject those
This patch takes the second approach as it is much shorter, simply
detecting when either X or Y incoming coordinate is negative, which
can never be 'within' any drawable.
Signed-off-by: Keith Packard <keithp at keithp.com>
Reviewed-by: Adam Jackson <ajax at redhat.com>
(cherry picked from commit 3e56efcfb63677cd8574e1e435e61d96f79ea536)
diff --git a/fb/fbbits.h b/fb/fbbits.h
index 44991f1..b8af785 100644
--- a/fb/fbbits.h
+++ b/fb/fbbits.h
@@ -25,7 +25,7 @@
* underlying datatypes instead of masks
*/
-#define isClipped(c,ul,lr) ((((c) - (ul)) | ((lr) - (c))) & 0x80008000)
+#define isClipped(c,ul,lr) (((c) | ((c) - (ul)) | ((lr) - (c))) & 0x80008000)
#ifdef HAVE_DIX_CONFIG_H
#include <dix-config.h>
commit 430ee9fb87f2ffd99f83269522ac2f7f7d19cbfd
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date: Fri Aug 20 13:51:04 2010 +0100
edid: Adjust rounding of max_clock
A simple hack to accommodate various EDID who have detailed modes that
exceed the EDID's max pixel clock. The pixel clock is only defined in
units of 10MHz and often appears as the maximum pixel code of the
detailed modes, rounded to the nearest 10MHz. Adjusting the max_clock to
include an extra 5MHz prevents the parser from rejecting the detailed
modes.
The kernel uses the same fuzz and by including it in X we can use the
same modes in X as for the console.
Fixes:
Bug 23833 - X uses different refresh rate to that set by kernel module
https://bugs.freedesktop.org/show_bug.cgi?id=23833
In the future, we will want to try harder to keep the KMS modes but at
the same time we need to apply the restrictions as specified by the
user's configuration, and need to fill in modes for fullscreen games on
fixed-mode panels.
Reported-and-tested-by: Fabio Pedretti <fabio.ped at libero.it>
Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
Reviewed-by: Alex Deucher <alexdeucher at gmail.com>
Signed-off-by: Keith Packard <keithp at keithp.com>
(cherry picked from commit 951605b4660290044fb238bcf1d6d9e498567e8c)
diff --git a/hw/xfree86/ddc/interpret_edid.c b/hw/xfree86/ddc/interpret_edid.c
index f3e593a..774a7dc 100644
--- a/hw/xfree86/ddc/interpret_edid.c
+++ b/hw/xfree86/ddc/interpret_edid.c
@@ -552,7 +552,7 @@ get_monitor_ranges(Uchar *c, struct monitor_ranges *r)
r->max_h = MAX_H;
r->max_clock = 0;
if(MAX_CLOCK != 0xff) /* is specified? */
- r->max_clock = MAX_CLOCK * 10;
+ r->max_clock = MAX_CLOCK * 10 + 5;
if (HAVE_2ND_GTF) {
r->gtf_2nd_f = F_2ND_GTF;
r->gtf_2nd_c = C_2ND_GTF;
commit f9a9500b2f037a34b2312324505c7810ed03e38b
Author: Adam Jackson <ajax at redhat.com>
Date: Mon Jun 28 18:08:50 2010 -0400
render: Bounds check for nglyphs in ProcRenderAddGlyphs (#28801)
Signed-off-by: Adam Jackson <ajax at redhat.com>
Reviewed-by: Julien Cristau <jcristau at debian.org>
Signed-off-by: Keith Packard <keithp at keithp.com>
(cherry picked from commit 5725849a1b427cd4a72b84e57f211edb35838718)
diff --git a/render/render.c b/render/render.c
index afe4c92..2779818 100644
--- a/render/render.c
+++ b/render/render.c
@@ -1085,6 +1085,14 @@ ProcRenderAddGlyphs (ClientPtr client)
gi = (xGlyphInfo *) (gids + nglyphs);
bits = (CARD8 *) (gi + nglyphs);
remain -= (sizeof (CARD32) + sizeof (xGlyphInfo)) * nglyphs;
+
+ /* protect against bad nglyphs */
+ if (gi < stuff || gi > ((CARD32 *)stuff + client->req_len) ||
+ bits < stuff || bits > ((CARD32 *)stuff + client->req_len)) {
+ err = BadLength;
+ goto bail;
+ }
+
for (i = 0; i < nglyphs; i++)
{
size_t padded_width;
commit 64f81b80c7c8636044577225685a387cc8a6b564
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date: Tue Aug 10 19:30:20 2010 +0100
xace: Invalid reference to out-of-scope data.
The callback data passed by reference to the hook was allocated on stack
within the scope of the case statement. The compiler is free to reuse
any of that stack space whilst making the function call so we may end up
passing garbage into the callback.
References:
Bug 18451 - Xorg server 1.5.2 SEGV during XFixesGetCursorImage()
https://bugs.freedesktop.org/show_bug.cgi?id=18451
v2: Drop the unrelated hunk that snuck in when ammending the commit
message.
Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
Reviewed-by: Alan Coopersmith <alan.coopersmith at oracle.com>
Signed-off-by: Keith Packard <keithp at keithp.com>
(cherry picked from commit 6dae7f3792611aace1df0cca63bf50c50d93de43)
diff --git a/Xext/xace.c b/Xext/xace.c
index bf0e98f..414eb4a 100644
--- a/Xext/xace.c
+++ b/Xext/xace.c
@@ -87,7 +87,18 @@ void XaceHookAuditEnd(ClientPtr ptr, int result)
*/
int XaceHook(int hook, ...)
{
- pointer calldata; /* data passed to callback */
+ union {
+ XaceResourceAccessRec res;
+ XaceDeviceAccessRec dev;
+ XaceSendAccessRec send;
+ XaceReceiveAccessRec recv;
+ XaceClientAccessRec client;
+ XaceExtAccessRec ext;
+ XaceServerAccessRec server;
+ XaceScreenAccessRec screen;
+ XaceAuthAvailRec auth;
+ XaceKeyAvailRec key;
+ } u;
int *prv = NULL; /* points to return value from callback */
va_list ap; /* argument list */
va_start(ap, hook);
@@ -99,117 +110,86 @@ int XaceHook(int hook, ...)
*/
switch (hook)
{
- case XACE_RESOURCE_ACCESS: {
- XaceResourceAccessRec rec;
- rec.client = va_arg(ap, ClientPtr);
- rec.id = va_arg(ap, XID);
- rec.rtype = va_arg(ap, RESTYPE);
- rec.res = va_arg(ap, pointer);
- rec.ptype = va_arg(ap, RESTYPE);
- rec.parent = va_arg(ap, pointer);
- rec.access_mode = va_arg(ap, Mask);
- rec.status = Success; /* default allow */
- calldata = &rec;
- prv = &rec.status;
+ case XACE_RESOURCE_ACCESS:
+ u.res.client = va_arg(ap, ClientPtr);
+ u.res.id = va_arg(ap, XID);
+ u.res.rtype = va_arg(ap, RESTYPE);
+ u.res.res = va_arg(ap, pointer);
+ u.res.ptype = va_arg(ap, RESTYPE);
+ u.res.parent = va_arg(ap, pointer);
+ u.res.access_mode = va_arg(ap, Mask);
+ u.res.status = Success; /* default allow */
+ prv = &u.res.status;
break;
- }
- case XACE_DEVICE_ACCESS: {
- XaceDeviceAccessRec rec;
- rec.client = va_arg(ap, ClientPtr);
- rec.dev = va_arg(ap, DeviceIntPtr);
- rec.access_mode = va_arg(ap, Mask);
- rec.status = Success; /* default allow */
- calldata = &rec;
- prv = &rec.status;
+ case XACE_DEVICE_ACCESS:
+ u.dev.client = va_arg(ap, ClientPtr);
+ u.dev.dev = va_arg(ap, DeviceIntPtr);
+ u.dev.access_mode = va_arg(ap, Mask);
+ u.dev.status = Success; /* default allow */
+ prv = &u.dev.status;
break;
- }
- case XACE_SEND_ACCESS: {
- XaceSendAccessRec rec;
- rec.client = va_arg(ap, ClientPtr);
- rec.dev = va_arg(ap, DeviceIntPtr);
- rec.pWin = va_arg(ap, WindowPtr);
- rec.events = va_arg(ap, xEventPtr);
- rec.count = va_arg(ap, int);
- rec.status = Success; /* default allow */
- calldata = &rec;
- prv = &rec.status;
+ case XACE_SEND_ACCESS:
+ u.send.client = va_arg(ap, ClientPtr);
+ u.send.dev = va_arg(ap, DeviceIntPtr);
+ u.send.pWin = va_arg(ap, WindowPtr);
+ u.send.events = va_arg(ap, xEventPtr);
+ u.send.count = va_arg(ap, int);
+ u.send.status = Success; /* default allow */
+ prv = &u.send.status;
break;
- }
- case XACE_RECEIVE_ACCESS: {
- XaceReceiveAccessRec rec;
- rec.client = va_arg(ap, ClientPtr);
- rec.pWin = va_arg(ap, WindowPtr);
- rec.events = va_arg(ap, xEventPtr);
- rec.count = va_arg(ap, int);
- rec.status = Success; /* default allow */
- calldata = &rec;
- prv = &rec.status;
+ case XACE_RECEIVE_ACCESS:
+ u.recv.client = va_arg(ap, ClientPtr);
+ u.recv.pWin = va_arg(ap, WindowPtr);
+ u.recv.events = va_arg(ap, xEventPtr);
+ u.recv.count = va_arg(ap, int);
+ u.recv.status = Success; /* default allow */
+ prv = &u.recv.status;
break;
- }
- case XACE_CLIENT_ACCESS: {
- XaceClientAccessRec rec;
- rec.client = va_arg(ap, ClientPtr);
- rec.target = va_arg(ap, ClientPtr);
- rec.access_mode = va_arg(ap, Mask);
- rec.status = Success; /* default allow */
- calldata = &rec;
- prv = &rec.status;
+ case XACE_CLIENT_ACCESS:
+ u.client.client = va_arg(ap, ClientPtr);
+ u.client.target = va_arg(ap, ClientPtr);
+ u.client.access_mode = va_arg(ap, Mask);
+ u.client.status = Success; /* default allow */
+ prv = &u.client.status;
break;
- }
- case XACE_EXT_ACCESS: {
- XaceExtAccessRec rec;
- rec.client = va_arg(ap, ClientPtr);
- rec.ext = va_arg(ap, ExtensionEntry*);
- rec.access_mode = DixGetAttrAccess;
- rec.status = Success; /* default allow */
- calldata = &rec;
- prv = &rec.status;
+ case XACE_EXT_ACCESS:
+ u.ext.client = va_arg(ap, ClientPtr);
+ u.ext.ext = va_arg(ap, ExtensionEntry*);
+ u.ext.access_mode = DixGetAttrAccess;
+ u.ext.status = Success; /* default allow */
+ prv = &u.ext.status;
break;
- }
- case XACE_SERVER_ACCESS: {
- XaceServerAccessRec rec;
- rec.client = va_arg(ap, ClientPtr);
- rec.access_mode = va_arg(ap, Mask);
- rec.status = Success; /* default allow */
- calldata = &rec;
- prv = &rec.status;
+ case XACE_SERVER_ACCESS:
+ u.server.client = va_arg(ap, ClientPtr);
+ u.server.access_mode = va_arg(ap, Mask);
+ u.server.status = Success; /* default allow */
+ prv = &u.server.status;
break;
- }
case XACE_SCREEN_ACCESS:
- case XACE_SCREENSAVER_ACCESS: {
- XaceScreenAccessRec rec;
- rec.client = va_arg(ap, ClientPtr);
- rec.screen = va_arg(ap, ScreenPtr);
- rec.access_mode = va_arg(ap, Mask);
- rec.status = Success; /* default allow */
- calldata = &rec;
- prv = &rec.status;
+ case XACE_SCREENSAVER_ACCESS:
+ u.screen.client = va_arg(ap, ClientPtr);
+ u.screen.screen = va_arg(ap, ScreenPtr);
+ u.screen.access_mode = va_arg(ap, Mask);
+ u.screen.status = Success; /* default allow */
+ prv = &u.screen.status;
break;
- }
- case XACE_AUTH_AVAIL: {
- XaceAuthAvailRec rec;
- rec.client = va_arg(ap, ClientPtr);
- rec.authId = va_arg(ap, XID);
- calldata = &rec;
+ case XACE_AUTH_AVAIL:
+ u.auth.client = va_arg(ap, ClientPtr);
+ u.auth.authId = va_arg(ap, XID);
break;
- }
- case XACE_KEY_AVAIL: {
- XaceKeyAvailRec rec;
- rec.event = va_arg(ap, xEventPtr);
- rec.keybd = va_arg(ap, DeviceIntPtr);
- rec.count = va_arg(ap, int);
- calldata = &rec;
+ case XACE_KEY_AVAIL:
+ u.key.event = va_arg(ap, xEventPtr);
+ u.key.keybd = va_arg(ap, DeviceIntPtr);
+ u.key.count = va_arg(ap, int);
break;
- }
- default: {
+ default:
va_end(ap);
return 0; /* unimplemented hook number */
- }
}
va_end(ap);
/* call callbacks and return result, if any. */
- CallCallbacks(&XaceHooks[hook], calldata);
+ CallCallbacks(&XaceHooks[hook], &u);
return prv ? *prv : Success;
}
More information about the xorg-commit
mailing list