xserver: Branch 'master' - 3 commits

[Keith Packard]

 configure.ac           |    2 +-
 dix/dispatch.c         |   23 +++++++++++++++--------
 hw/kdrive/src/kinput.c |    2 +-
 3 files changed, 17 insertions(+), 10 deletions(-)

New commits:
commit 6f89ae3e64c4dfeea508813e546c10ba1da3ea8e
Author: Thomas Klausner <wiz at NetBSD.org>
Date:   Wed Sep 4 20:06:07 2013 +0200

    Fix typo in configure warning.
    
    Signed-off-by: Thomas Klausner <wiz at NetBSD.org>
    Reviewed-by: Peter Hutterer <peter.hutterer at who-t.net>
    Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>

diff --git a/configure.ac b/configure.ac
index d27ca23..5159420 100644
--- a/configure.ac
+++ b/configure.ac
@@ -47,7 +47,7 @@ XORG_WITH_XSLTPROC
 XORG_ENABLE_UNIT_TESTS
 XORG_LD_WRAP([optional])
 
-m4_ifndef([XORG_FONT_MACROS_VERSION], [m4_fatal([must install fontutil 1.1 or later before running autoconf/autogen])])
+m4_ifndef([XORG_FONT_MACROS_VERSION], [m4_fatal([must install font-util 1.1 or later before running autoconf/autogen])])
 XORG_FONT_MACROS_VERSION(1.1)
 
 dnl this gets generated by autoheader, and thus contains all the defines.  we
commit 47218a6e09549781fd61dbf5e0d3d5c81da64323
Author: Thomas Klausner <wiz at NetBSD.org>
Date:   Wed Sep 4 20:05:51 2013 +0200

    Fix bug in cursor handling.
    
    CreateCursor (Xlib call XCreatePixmapCursor) with a non-bitmap
    source pixmap and a None mask is supposed to error out with BadMatch,
    but didn't.
    
    From der Mouse <mouse at Rodents-Montreal.ORG>, changed following
    comments by Alan Coopersmith <alan.coopersmith at oracle.com>.
    
    Signed-off-by: Thomas Klausner <wiz at NetBSD.org>
    Reviewed-by: Jasper St. Pierre <jstpierre at mecheye.net>
    Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>

diff --git a/dix/dispatch.c b/dix/dispatch.c
index 51d0de2..71fda48 100644
--- a/dix/dispatch.c
+++ b/dix/dispatch.c
@@ -2864,18 +2864,25 @@ ProcCreateCursor(ClientPtr client)
         return rc;
     }
 
-    rc = dixLookupResourceByType((pointer *) &msk, stuff->mask, RT_PIXMAP,
-                                 client, DixReadAccess);
-    if (rc != Success) {
-        if (stuff->mask != None) {
+    if (src->drawable.depth != 1)
+        return (BadMatch);
+
+    /* Find and validate cursor mask pixmap, if one is provided */
+    if (stuff->mask != None) {
+        rc = dixLookupResourceByType((pointer *) &msk, stuff->mask, RT_PIXMAP,
+                                     client, DixReadAccess);
+        if (rc != Success) {
             client->errorValue = stuff->mask;
             return rc;
         }
+
+        if (src->drawable.width != msk->drawable.width
+            || src->drawable.height != msk->drawable.height
+            || src->drawable.depth != 1 || msk->drawable.depth != 1)
+            return BadMatch;
     }
-    else if (src->drawable.width != msk->drawable.width
-             || src->drawable.height != msk->drawable.height
-             || src->drawable.depth != 1 || msk->drawable.depth != 1)
-        return BadMatch;
+    else
+        msk = NULL;
 
     width = src->drawable.width;
     height = src->drawable.height;
commit 1110b71e360195aab040d835b54540ab558638c5
Author: Chris Clayton <chris2553 at googlemail.com>
Date:   Wed Sep 4 15:42:04 2013 +1000

    kdrive: fix build error on gcc 4.8 for out-of-bounds array access
    
    I'm getting a error building xorg-server-1.14.1.902 with thelatest snapshot
    of gcc-4.8:
    
    input.c:225:43: error: array subscript is above array bounds
    [-Werror=array-bounds]
    
    This is because kdNumInputFds can become equal to KD_MAX_INPUT_FDS in
    KdRegisterFd(). This means that in KdUnregisterFd(), kdInputFds[j + 1] can
    be beyond the end of the array.
    
    Signed-off-by: Chris Clayton <chris2553 at googlemail.com>
    Reviewed-by: Keith Packard <keithp at keithp.com>
    Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>

diff --git a/hw/kdrive/src/kinput.c b/hw/kdrive/src/kinput.c
index f93830e..527c7a2 100644
--- a/hw/kdrive/src/kinput.c
+++ b/hw/kdrive/src/kinput.c
@@ -221,7 +221,7 @@ KdUnregisterFd(void *closure, int fd, Bool do_close)
             if (do_close)
                 close(kdInputFds[i].fd);
             kdNumInputFds--;
-            for (j = i; j < kdNumInputFds; j++)
+            for (j = i; j < (kdNumInputFds - 1); j++)
                 kdInputFds[j] = kdInputFds[j + 1];
             break;
         }