libXi: Changes to 'master'

[Peter Hutterer]

 src/XGetDCtl.c      |   10 +++++-----
 src/XGetProp.c      |    4 +++-
 src/XIGrabDevice.c  |   18 ++++++++++++------
 src/XIPassiveGrab.c |    9 ++++++++-
 src/XISelEv.c       |   30 +++++++++++++++++++++++++-----
 5 files changed, 53 insertions(+), 18 deletions(-)

New commits:
commit 0f3f5a36d5fc6dc53f69f48a0c83aef6a1fcf381
Author: Peter Hutterer <peter.hutterer at who-t.net>
Date:   Tue May 28 15:52:34 2013 +1000

    If the XGetDeviceDontPropagateList reply has an invalid length, return 0
    
    If we skip over the reply data, return 0 as number of event classes.
    
    Follow-up to 6dd6dc51a2935c72774be81e5cc2ba2c30e9feff.
    
    Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>

commit 35ae16dc2f16b24a22625b2d9f76a2128b673a6c
Author: Peter Hutterer <peter.hutterer at who-t.net>
Date:   Tue May 28 15:52:33 2013 +1000

    Change size += to size = in XGetDeviceControl
    
    size += blah is technically correct but it implies that we're looping or
    otherwise incrementing the size. Which we don't, it's only ever set once.
    
    Change this to avoid reviewer confusion.
    
    Reported-by: Dave "color-me-confused" Airlie <airlied at redhat.com>
    Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>

commit 4c8e9bcab459ea5f870d3e56eff15f931807f9b7
Author: Peter Hutterer <peter.hutterer at who-t.net>
Date:   Tue May 28 15:52:32 2013 +1000

    Fix potential corruption in mask_len handling
    
    First: check for allocation failure on the mask.
    XI2 requires that the mask is zeroed, so we can't just Data() the mask
    provided by the client (it will pad) - we need a tmp buffer. Make sure that
    doesn't fail.
    
    Second:
    req->mask_len is a uint16_t, so check against malicious mask_lens that would
    cause us to corrupt memory on copy, as the code always allocates
    req->mask_len * 4, but copies mask->mask_len bytes.
    
    Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>