xserver: Branch 'master' - 2 commits

[Keith Packard]

 glx/glxdri2.c          |    8 ++++++--
 hw/xfree86/dri2/dri2.c |   15 +++++++++++++--
 hw/xfree86/dri2/dri2.h |    7 +++++++
 3 files changed, 26 insertions(+), 4 deletions(-)

New commits:
commit a2d0829531249e24dbca25fc20ed30a2bb2d8ed8
Author: Michel Dänzer <michel.daenzer at amd.com>
Date:   Thu Jul 12 13:16:37 2012 +0200

    glx: Free DRI2 drawable reference to destroyed GLX drawable.
    
    Otherwise the reference can lead to use after free in
    __glXDRIinvalidateBuffers().
    
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=50019
    
    Signed-off-by: Michel Dänzer <michel.daenzer at amd.com>
    Reviewed-by: Kristian Høgsberg <krh at bitplanet.net>
    Signed-off-by: Keith Packard <keithp at keithp.com>

diff --git a/glx/glxdri2.c b/glx/glxdri2.c
index 909de70..be5afbc 100644
--- a/glx/glxdri2.c
+++ b/glx/glxdri2.c
@@ -106,6 +106,7 @@ struct __GLXDRIdrawable {
     int height;
     __DRIbuffer buffers[MAX_DRAWABLE_BUFFERS];
     int count;
+    XID dri2_id;
 };
 
 static void
@@ -114,6 +115,8 @@ __glXDRIdrawableDestroy(__GLXdrawable * drawable)
     __GLXDRIdrawable *private = (__GLXDRIdrawable *) drawable;
     const __DRIcoreExtension *core = private->screen->core;
 
+    FreeResource(private->dri2_id, FALSE);
+
     (*core->destroyDrawable) (private->driDrawable);
 
     __glXDrawableRelease(drawable);
@@ -670,8 +673,9 @@ __glXDRIscreenCreateDrawable(ClientPtr client,
     private->base.waitGL = __glXDRIdrawableWaitGL;
     private->base.waitX = __glXDRIdrawableWaitX;
 
-    if (DRI2CreateDrawable(client, pDraw, drawId,
-                           __glXDRIinvalidateBuffers, private)) {
+    if (DRI2CreateDrawable2(client, pDraw, drawId,
+                            __glXDRIinvalidateBuffers, private,
+                            &private->dri2_id)) {
         free(private);
         return NULL;
     }
commit 8a87acc9e57be740e3bd252567622246051a0723
Author: Michel Dänzer <michel.daenzer at amd.com>
Date:   Thu Jul 12 13:16:36 2012 +0200

    dri2: Add DRI2CreateDrawable2.
    
    Same as DRI2CreateDrawable, except it can return the DRI2 specific XID of the
    DRI2 drawable reference to the base drawable.
    
    Signed-off-by: Michel Dänzer <michel.daenzer at amd.com>
    Reviewed-by: Kristian Høgsberg <krh at bitplanet.net>
    Signed-off-by: Keith Packard <keithp at keithp.com>

diff --git a/hw/xfree86/dri2/dri2.c b/hw/xfree86/dri2/dri2.c
index 2ea0c33..63feed5 100644
--- a/hw/xfree86/dri2/dri2.c
+++ b/hw/xfree86/dri2/dri2.c
@@ -333,8 +333,9 @@ DRI2AddDrawableRef(DRI2DrawablePtr pPriv, XID id, XID dri2_id,
 }
 
 int
-DRI2CreateDrawable(ClientPtr client, DrawablePtr pDraw, XID id,
-                   DRI2InvalidateProcPtr invalidate, void *priv)
+DRI2CreateDrawable2(ClientPtr client, DrawablePtr pDraw, XID id,
+                    DRI2InvalidateProcPtr invalidate, void *priv,
+                    XID *dri2_id_out)
 {
     DRI2DrawablePtr pPriv;
     DRI2ClientPtr dri2_client = dri2ClientPrivate(client);
@@ -354,9 +355,19 @@ DRI2CreateDrawable(ClientPtr client, DrawablePtr pDraw, XID id,
     if (rc != Success)
         return rc;
 
+    if (dri2_id_out)
+        *dri2_id_out = dri2_id;
+
     return Success;
 }
 
+int
+DRI2CreateDrawable(ClientPtr client, DrawablePtr pDraw, XID id,
+                   DRI2InvalidateProcPtr invalidate, void *priv)
+{
+    return DRI2CreateDrawable2(client, pDraw, id, invalidate, priv, NULL);
+}
+
 static int
 DRI2DrawableGone(pointer p, XID id)
 {
diff --git a/hw/xfree86/dri2/dri2.h b/hw/xfree86/dri2/dri2.h
index da7825e..1e7afdd 100644
--- a/hw/xfree86/dri2/dri2.h
+++ b/hw/xfree86/dri2/dri2.h
@@ -274,6 +274,13 @@ extern _X_EXPORT int DRI2CreateDrawable(ClientPtr client,
                                         DRI2InvalidateProcPtr invalidate,
                                         void *priv);
 
+extern _X_EXPORT int DRI2CreateDrawable2(ClientPtr client,
+                                         DrawablePtr pDraw,
+                                         XID id,
+                                         DRI2InvalidateProcPtr invalidate,
+                                         void *priv,
+                                         XID *dri2_id_out);
+
 extern _X_EXPORT DRI2BufferPtr *DRI2GetBuffers(DrawablePtr pDraw,
                                                int *width,
                                                int *height,