xserver: Branch 'master'

[Adam Jackson]

 Xext/xace.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

New commits:
commit 92b3cd32066aa5befa67a408cc079cd2ce4c077e
Author: Aaron Plattner <aplattner at nvidia.com>
Date:   Tue Aug 2 10:34:07 2016 -0700

    xace: Fix XaceCensorImage to actually censor the right part of the image
    
    The caller passes arguments into XaceCensorImage that are in
    window-relative coordinates. However, the pBuf that it uses to construct
    a temporary pixmap has its origin at (x, y) relative to the window in
    question. The code to convert the censor region into boxes adjusts for
    the Y coordinate, but leaves the X coordinate alone. The result is that
    if x is not zero, it censors the wrong part of the image.
    
    Fix this by just translating censorRegion into pixmap-relative
    coordinates and using the resulting boxes as-is.
    
    Reported-by: Fabien Lelaquais <Fabien.Lelaquais at roguewave.com>
    Link: https://lists.x.org/archives/xorg/2016-August/058165.html
    Reviewed-by: Adam Jackson <ajax at redhat.com>
    Signed-off-by: Aaron Plattner <aplattner at nvidia.com>

diff --git a/Xext/xace.c b/Xext/xace.c
index 91c74d5..a3a83a2 100644
--- a/Xext/xace.c
+++ b/Xext/xace.c
@@ -245,6 +245,7 @@ XaceCensorImage(ClientPtr client,
 
     /* censorRegion = imageRegion - visibleRegion */
     RegionSubtract(&censorRegion, &imageRegion, pVisibleRegion);
+    RegionTranslate(&censorRegion, -x, -y);
     nRects = RegionNumRects(&censorRegion);
     if (nRects > 0) {           /* we have something to censor */
         GCPtr pScratchGC = NULL;
@@ -265,7 +266,7 @@ XaceCensorImage(ClientPtr client,
         }
         for (pBox = RegionRects(&censorRegion), i = 0; i < nRects; i++, pBox++) {
             pRects[i].x = pBox->x1;
-            pRects[i].y = pBox->y1 - imageBox.y1;
+            pRects[i].y = pBox->y1;
             pRects[i].width = pBox->x2 - pBox->x1;
             pRects[i].height = pBox->y2 - pBox->y1;
         }