xserver: Branch 'master'

[Keith Packard]

 fb/fbseg.c |   18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

New commits:
commit 863d528a9f76d0e8f122aebf19f8564a4c67a938
Author: Simon Schubert <2 at 0x2c.org>
Date:   Sun Aug 12 09:40:16 2012 -0700

    fb: reorder Bresenham error correction to avoid overshoot.
    
    When fbBresSolid draws a line, it can happen that after the last
    pixel, the Bresenham error term overflows, and fbBresSolid paints
    another pixel before adjusting the error term.
    
    However, if this happens on the last pixel (len=0), this extra pixel
    might overshoot the boundary, and, in rare cases, lead to a segfault.
    
    Fix this issue by adjusting for the Bresenham error term before
    drawing the main pixel, not after.
    
    Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=24274
    Signed-off-by: Simon Schubert <2 at 0x2c.or>
    Tested-by: Mitch Davis <mjd+freedesktop.org at afork.com>
    Signed-off-by: Matt Turner <mattst88 at gmail.com>
    Signed-off-by: Keith Packard <keithp at keithp.com>

diff --git a/fb/fbseg.c b/fb/fbseg.c
index 0e4e0a9..1848387 100644
--- a/fb/fbseg.c
+++ b/fb/fbseg.c
@@ -65,6 +65,12 @@ fbBresSolid(DrawablePtr pDrawable,
     if (axis == X_AXIS) {
         bits = 0;
         while (len--) {
+            if (e >= 0) {
+                WRITE(dst, FbDoMaskRRop (READ(dst), and, xor, bits));
+                bits = 0;
+                dst += dstStride;
+                e += e3;
+            }
             bits |= mask;
             mask = fbBresShiftMask(mask, signdx, dstBpp);
             if (!mask) {
@@ -74,21 +80,12 @@ fbBresSolid(DrawablePtr pDrawable,
                 mask = mask0;
             }
             e += e1;
-            if (e >= 0) {
-                WRITE(dst, FbDoMaskRRop(READ(dst), and, xor, bits));
-                bits = 0;
-                dst += dstStride;
-                e += e3;
-            }
         }
         if (bits)
             WRITE(dst, FbDoMaskRRop(READ(dst), and, xor, bits));
     }
     else {
         while (len--) {
-            WRITE(dst, FbDoMaskRRop(READ(dst), and, xor, mask));
-            dst += dstStride;
-            e += e1;
             if (e >= 0) {
                 e += e3;
                 mask = fbBresShiftMask(mask, signdx, dstBpp);
@@ -97,6 +94,9 @@ fbBresSolid(DrawablePtr pDrawable,
                     mask = mask0;
                 }
             }
+            WRITE(dst, FbDoMaskRRop(READ(dst), and, xor, mask));
+            dst += dstStride;
+            e += e1;
         }
     }