xserver: Branch 'master' - 2 commits

[Keith Packard]

 hw/xfree86/dri2/dri2.c |   22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

New commits:
commit b3d2164a0361f636bfe77b51456bee9213af4f13
Author: Ville Syrjälä <ville.syrjala at nokia.com>
Date:   Tue Apr 12 17:16:50 2011 +0300

    dri2: Pass out_count by value to update_dri2_drawable_buffers()
    
    update_dri2_drawable_buffers() doesn't modify out_count, so pass it
    by value.
    
    Signed-off-by: Ville Syrjälä <ville.syrjala at nokia.com>
    Reviewed-by: Tiago Vignatti <tiago.vignatti at nokia.com>
    Reviewed-by: Ian Romanick <ian.d.romanick at intel.com>

diff --git a/hw/xfree86/dri2/dri2.c b/hw/xfree86/dri2/dri2.c
index 23b6594..5c42a51 100644
--- a/hw/xfree86/dri2/dri2.c
+++ b/hw/xfree86/dri2/dri2.c
@@ -358,7 +358,7 @@ allocate_or_reuse_buffer(DrawablePtr pDraw, DRI2ScreenPtr ds,
 
 static void
 update_dri2_drawable_buffers(DRI2DrawablePtr pPriv, DrawablePtr pDraw,
-			     DRI2BufferPtr *buffers, int *out_count, int *width, int *height)
+			     DRI2BufferPtr *buffers, int out_count, int *width, int *height)
 {
     DRI2ScreenPtr   ds = DRI2GetScreen(pDraw->pScreen);
     int i;
@@ -374,7 +374,7 @@ update_dri2_drawable_buffers(DRI2DrawablePtr pPriv, DrawablePtr pDraw,
     }
 
     pPriv->buffers = buffers;
-    pPriv->bufferCount = *out_count;
+    pPriv->bufferCount = out_count;
     pPriv->width = pDraw->width;
     pPriv->height = pDraw->height;
     *width = pPriv->width;
@@ -477,7 +477,7 @@ do_get_buffers(DrawablePtr pDraw, int *width, int *height,
 
     *out_count = i;
 
-    update_dri2_drawable_buffers(pPriv, pDraw, buffers, out_count, width, height);
+    update_dri2_drawable_buffers(pPriv, pDraw, buffers, *out_count, width, height);
 
     /* If the client is getting a fake front-buffer, pre-fill it with the
      * contents of the real front-buffer.  This ensures correct operation of
@@ -513,7 +513,7 @@ err_out:
 	buffers = NULL;
     }
 
-    update_dri2_drawable_buffers(pPriv, pDraw, buffers, out_count, width, height);
+    update_dri2_drawable_buffers(pPriv, pDraw, buffers, *out_count, width, height);
 
     return buffers;
 }
commit 93c833ee84a3465ec5d251e622ba26434cb532f8
Author: Ville Syrjälä <ville.syrjala at nokia.com>
Date:   Tue Apr 12 17:13:28 2011 +0300

    dri2: Handle calloc() failure
    
    Don't access invalid memory if calloc() fails to allocate the buffers
    array.
    
    Signed-off-by: Ville Syrjälä <ville.syrjala at nokia.com>
    Reviewed-by: Tiago Vignatti <tiago.vignatti at nokia.com>
    Reviewed-by: Ian Romanick <ian.d.romanick at intel.com>

diff --git a/hw/xfree86/dri2/dri2.c b/hw/xfree86/dri2/dri2.c
index 10be599..23b6594 100644
--- a/hw/xfree86/dri2/dri2.c
+++ b/hw/xfree86/dri2/dri2.c
@@ -409,6 +409,8 @@ do_get_buffers(DrawablePtr pDraw, int *width, int *height,
 	&& (pPriv->serialNumber == DRI2DrawableSerial(pDraw));
 
     buffers = calloc((count + 1), sizeof(buffers[0]));
+    if (!buffers)
+	goto err_out;
 
     for (i = 0; i < count; i++) {
 	const unsigned attachment = *(attachments++);
@@ -501,13 +503,15 @@ err_out:
 
     *out_count = 0;
 
-    for (i = 0; i < count; i++) {
+    if (buffers) {
+	for (i = 0; i < count; i++) {
 	    if (buffers[i] != NULL)
-		    (*ds->DestroyBuffer)(pDraw, buffers[i]);
-    }
+		(*ds->DestroyBuffer)(pDraw, buffers[i]);
+	}
 
-    free(buffers);
-    buffers = NULL;
+	free(buffers);
+	buffers = NULL;
+    }
 
     update_dri2_drawable_buffers(pPriv, pDraw, buffers, out_count, width, height);