libX11: Changes to 'master'

Wed Feb 2 08:47:35 PST 2011

 modules/im/ximcp/imLcLkup.c |    4 ++++
 modules/im/ximcp/imRm.c     |    4 ++++
 modules/im/ximcp/imRmAttr.c |    7 +++++--
 modules/im/ximcp/imTrX.c    |   33 +++++++++++++++++++++------------
 modules/lc/def/lcDefConv.c  |    2 +-
 modules/lc/gen/lcGenConv.c  |    2 +-
 src/GetProp.c               |    2 +-
 src/ImUtil.c                |    1 +
 src/XlibInt.c               |    8 +++++---
 src/Xrm.c                   |   10 +++++++++-
 src/xcms/LRGB.c             |   22 ++++++++++------------
 src/xcms/cmsColNm.c         |    4 ++--
 src/xlibi18n/XDefaultOMIF.c |   10 ++--------
 src/xlibi18n/lcFile.c       |    6 ++----
 src/xlibi18n/lcGeneric.c    |    2 +-
 15 files changed, 69 insertions(+), 48 deletions(-)

New commits:
commit 450e17422c0e374d25c643f343ea268cec68da38
Author: Erkki SeppÃ¤lÃ¤ <erkki.seppala at vincit.fi>
Date:   Mon Jan 31 14:01:57 2011 +0200

    XlibInt: Use strncpy+zero termination instead of strcpy to enforce buffer size
    
    Possible overrun of 8192 byte fixed size buffer "buffer" by copying
    "ext->name" without length checking
    
    Reviewed-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Reviewed-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira at nokia.com>
    Signed-off-by: Erkki SeppÃ¤lÃ¤ <erkki.seppala at vincit.fi>
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>

commit e2566e43b02d2d7b7c1c3bb7db7c5ae81c1245fa
Author: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira at nokia.com>
Date:   Mon Jan 31 14:02:13 2011 +0200

    lc/def/lcDefConv: Use Xcalloc to avoid use of uninitialized memory
    
    Fixed by zero'ing conv on allocation with Xcalloc. Then
    close_converter works properly.
    
    Using uninitialized value "conv->state" in call to function "close_converter"
    
    Reviewed-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Reviewed-by: Erkki SeppÃ¤lÃ¤ <erkki.seppala at vincit.fi>
    Signed-off-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira at nokia.com>
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>

commit 03f81ad8fb9783986cf9b17661dd31e95c396681
Author: Erkki SeppÃ¤lÃ¤ <erkki.seppala at vincit.fi>
Date:   Mon Jan 31 14:02:16 2011 +0200

    xlibi18n/lcFile: Removed superfluous check for NULL target_dir
    
    The situation is already handled before this code.
    
    Cannot reach dead expression "0U" inside statement "if (1U + (target_dir ? strl..."
    
    Reviewed-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Reviewed-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira at nokia.com>
    Signed-off-by: Erkki SeppÃ¤lÃ¤ <erkki.seppala at vincit.fi>
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>

commit 1346b9ea3b3882201ff8c3ee462ff4b0d4edf639
Author: Erkki SeppÃ¤lÃ¤ <erkki.seppala at vincit.fi>
Date:   Mon Jan 31 14:02:15 2011 +0200

    ximcp/imLckup: Handle negative return value from _Xlcwctomb
    
    Fixed by negative value to memcpy by checking for the negative return
    value of _Xlcwctomb and returning 0/XLookupNone in that case.
    
    a negative value was passed to memcpy
    
    Unfortunately the other return values for *status don't fit into the
    error (which appears to indicate some internal error or running out of
    memory). The other valid status codes are XBufferOverflow,
    XLookupNone, XLookupChars, XLookupKeySym, and XLookupBoth. Each of
    these has a specific meaning attached.
    
    Reviewed-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira at nokia.com>
    Signed-off-by: Erkki SeppÃ¤lÃ¤ <erkki.seppala at vincit.fi>
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>

commit 79a5c86e020f08cc108184298a72e2777036de39
Author: Erkki SeppÃ¤lÃ¤ <erkki.seppala at vincit.fi>
Date:   Mon Jan 31 14:02:14 2011 +0200

    ximcp/imTrX: Handle failing XGetWindowProperty
    
    Checked return value of XGetWindowProperty and return false if it fails.
    
    Return value of "XGetWindowProperty(im->core.display, spec->lib_connect_wid, prop, 0L, (length + bytes_after_ret + 3UL) / 4UL, 1, 0UL, &type_ret, &format_ret, &nitems, &bytes_after_ret, &prop_ret)" is not checked
    
    Reviewed-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Signed-off-by: Erkki SeppÃ¤lÃ¤ <erkki.seppala at vincit.fi>
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>

commit 2ace8d5c89c8f6d9f42b4068f4b508ca28f0ced1
Author: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira at nokia.com>
Date:   Mon Jan 31 14:02:12 2011 +0200

    XlibInt: info_list->watch_data was reallocated, but result was discarded
    
    info_list->watch_data was being reallocated, but the return value of
    the reallocation was stored only into a local variable. This might
    cause some funky behavior and crashes.
    
    Variable "wd_array" goes out of scope
    Value "wd_array" is overwritten in "wd_array = (XPointer*)realloc((char*)info_list->watch_data, (((dpy->watcher_count + 1) * 4U == 0U) ? 1U : ((dpy->watcher_count + 1) * 4U)))"
    
    Reviewed-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Reviewed-by: Erkki SeppÃ¤lÃ¤ <erkki.seppala at vincit.fi>
    Signed-off-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira at nokia.com>
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>

commit 2b16a7e683e355c9746290b2cee2fd0dd2bf342a
Author: Erkki SeppÃ¤lÃ¤ <erkki.seppala at vincit.fi>
Date:   Mon Jan 31 14:02:10 2011 +0200

    GetProp: Zero-initialized error so its resourceID field is initialized
    
    Using uninitialized value "error.resourceID" in call to function "_XError"
    
    Reviewed-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Reviewed-by: Erkki SeppÃ¤lÃ¤ <erkki.seppala at vincit.fi>
    Signed-off-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira at nokia.com>
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>

commit 85e9f38e016137f0ff2791eb0d092ab027382d2c
Author: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira at nokia.com>
Date:   Tue Feb 1 11:07:25 2011 +0200

    xcms/LRGB: Add a label for freeing property_return.
    
    The rest of the code uses goto's to free memory allocated later
    and prevent memory leaks, but there were several paths were
    property_return was free'd just before a goto.
    
    Reviewed-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Signed-off-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira at nokia.com>
    Signed-off-by: Erkki SeppÃ¤lÃ¤ <erkki.seppala at vincit.fi>
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>

commit 3161dc57d4e9b70f852f05e5e474455e121b06ab
Author: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira at nokia.com>
Date:   Mon Jan 31 14:02:08 2011 +0200

    xcms/LRGB: Fix potential resource leak.
    
    property_return was not free'd if the allocation of pRedTbl failed.
    
    Reviewed-by: Erkki SeppÃ¤lÃ¤ <erkki.seppala at vincit.fi>
    Signed-off-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira at nokia.com>
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>

commit be3e6c205d94dedc1cdebf5d17b987f0f828377a
Author: Erkki SeppÃ¤lÃ¤ <erkki.seppala at vincit.fi>
Date:   Mon Jan 31 14:02:06 2011 +0200

    Xrm: Handle the extremely unlikely situation of fstat failing
    
    Tracked variable "size" was passed to a negative sink.
    
    Reviewed-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Reviewed-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira at nokia.com>
    Signed-off-by: Erkki SeppÃ¤lÃ¤ <erkki.seppala at vincit.fi>
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>

commit 3fae16c64d6ef76fd4a25a54c7f7de76596457db
Author: Erkki SeppÃ¤lÃ¤ <erkki.seppala at vincit.fi>
Date:   Mon Jan 31 14:02:05 2011 +0200

    Xrm: NEWTABLE had a memory leak after a memory allocation error
    
    The NEWTABLE macro missed freeing its allocated memory on subsequent
    memory allocation errors. Added call to Xfree.
    
    Variable "table" goes out of scope
    
    Reviewed-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Reviewed-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira at nokia.com>
    Signed-off-by: Erkki SeppÃ¤lÃ¤ <erkki.seppala at vincit.fi>
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>

commit 7110ac653349a23c80c365f11f6270dc27c8975a
Author: Erkki SeppÃ¤lÃ¤ <erkki.seppala at vincit.fi>
Date:   Mon Jan 31 14:02:03 2011 +0200

    ImUtil: Handle a memory leak in one early return branch
    
    Fixed memory leak by adding Xfree for image
    
    Variable "image" goes out of scope
    
    Reviewed-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Reviewed-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira at nokia.com>
    Signed-off-by: Erkki SeppÃ¤lÃ¤ <erkki.seppala at vincit.fi>
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>

commit d695f5da9f5b778e54b6987d9177048e32818c4d
Author: Erkki SeppÃ¤lÃ¤ <erkki.seppala at vincit.fi>
Date:   Mon Jan 31 14:02:01 2011 +0200

    ximcp/imRm: Handle leaking colormap_ret
    
    Fixed memory leak by adding Xfree for colormap_ret
    
    Variable "colormap_ret" goes out of scope
    
    Reviewed-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Reviewed-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira at nokia.com>
    Signed-off-by: Erkki SeppÃ¤lÃ¤ <erkki.seppala at vincit.fi>
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>

commit f9eda19d08c1ea0973dfe0bc10a2519d6fd26cc7
Author: Erkki SeppÃ¤lÃ¤ <erkki.seppala at vincit.fi>
Date:   Mon Jan 31 14:01:59 2011 +0200

    ximcp/imRmAttr: Handle leaking missing_list
    
    Fixed memory leak by adding Xfree and initializing missing_list with NULL
    
    Variable "missing_list" goes out of scope
    
    Reviewed-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Reviewed-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira at nokia.com>
    Signed-off-by: Erkki SeppÃ¤lÃ¤ <erkki.seppala at vincit.fi>
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>

commit 3183269e0979c9dbce9d55d9e03937897dc9fb3b
Author: Erkki SeppÃ¤lÃ¤ <erkki.seppala at vincit.fi>
Date:   Mon Jan 31 14:01:58 2011 +0200

    ximcp/imRmAttr: Handle leaking colormap_ret
    
    XFree colormap_ret and initialize it when appropriate.
    
    Variable "colormap_ret" goes out of scope
    
    Reviewed-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Signed-off-by: Erkki SeppÃ¤lÃ¤ <erkki.seppala at vincit.fi>
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>

commit f66a032a937030f2d9baa81744d36dc585bb085c
Author: Erkki SeppÃ¤lÃ¤ <erkki.seppala at vincit.fi>
Date:   Mon Jan 31 14:01:56 2011 +0200

    xlibi18n/lcGeneric: Initialize uninitialized local variable
    
    Using uninitialized value "new"
    
    Reviewed-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Reviewed-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira at nokia.com>
    Signed-off-by: Erkki SeppÃ¤lÃ¤ <erkki.seppala at vincit.fi>
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>

commit d0266e06d38110ec908ca28379014eff743630b7
Author: Erkki SeppÃ¤lÃ¤ <erkki.seppala at vincit.fi>
Date:   Mon Jan 31 14:01:54 2011 +0200

    xcmx/cmxColNm: Removed unused assignments to pBuf (in two functions)
    
    Pointer "pBuf" returned from "fgets(buf, 256, stream)" is never used
    
    Reviewed-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Reviewed-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira at nokia.com>
    Signed-off-by: Erkki SeppÃ¤lÃ¤ <erkki.seppala at vincit.fi>
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>

commit cc686655d7bfdeab8b67e01a24bd452a2e9e3fcf
Author: Alan Coopersmith <alan.coopersmith at oracle.com>
Date:   Tue Feb 1 12:30:56 2011 +0200

    XDefaultOMIF.c: Fix memory leaks in get_font_name
    
    Instead of copying the value returned by get_prop_name and then releasing it,
    directly use the return value of get_prop_name, which allocates memory for the
    name.
    
    If get_prop_name returns NULL, continue on to XFreeFont to release the font
    before returning the NULL via the normal function return.
    
    Reviewed-by: Erkki SeppÃ¤lÃ¤ <erkki.seppala at vincit.fi>
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>