[PATCH 1/2] Fix cursor ref counting mistakes with sprites and xf86Cursor.c

[Keith Packard]

A few cursor value assignments weren't getting correctly ref counted,
causing leaks of cursor objects.

Signed-off-by: Keith Packard <keithp at keithp.com>
---
 dix/devices.c                  |    2 ++
 dix/events.c                   |   20 +++++++++++++++-----
 hw/xfree86/ramdac/xf86Cursor.c |    2 ++
 3 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/dix/devices.c b/dix/devices.c
index 1386491..a33df4d 100644
--- a/dix/devices.c
+++ b/dix/devices.c
@@ -851,6 +851,8 @@ CloseDevice(DeviceIntPtr dev)
     }
 
     if (DevHasCursor(dev) && dev->spriteInfo->sprite) {
+	if (dev->spriteInfo->sprite->current)
+	    FreeCursor(dev->spriteInfo->sprite->current, None);
         xfree(dev->spriteInfo->sprite->spriteTrace);
         xfree(dev->spriteInfo->sprite);
     }
diff --git a/dix/events.c b/dix/events.c
index 60dd162..4ee2bc9 100644
--- a/dix/events.c
+++ b/dix/events.c
@@ -2932,6 +2932,7 @@ InitializeSprite(DeviceIntPtr pDev, WindowPtr pWin)
 {
     SpritePtr pSprite;
     ScreenPtr pScreen;
+    CursorPtr pCursor;
 
     if (!pDev->spriteInfo->sprite)
     {
@@ -2975,8 +2976,7 @@ InitializeSprite(DeviceIntPtr pDev, WindowPtr pWin)
 
     if (pWin)
     {
-        pSprite->current = wCursor(pWin);
-        pSprite->current->refcnt++;
+	pCursor = wCursor(pWin);
 	pSprite->spriteTrace = (WindowPtr *)xcalloc(1, 32*sizeof(WindowPtr));
 	if (!pSprite->spriteTrace)
 	    FatalError("Failed to allocate spriteTrace");
@@ -2989,13 +2989,18 @@ InitializeSprite(DeviceIntPtr pDev, WindowPtr pWin)
 	pSprite->pDequeueScreen = pSprite->pEnqueueScreen;
 
     } else {
-        pSprite->current = NullCursor;
+        pCursor = NullCursor;
 	pSprite->spriteTrace = NULL;
 	pSprite->spriteTraceSize = 0;
 	pSprite->spriteTraceGood = 0;
 	pSprite->pEnqueueScreen = screenInfo.screens[0];
 	pSprite->pDequeueScreen = pSprite->pEnqueueScreen;
     }
+    if (pCursor)
+	pCursor->refcnt++;
+    if (pSprite->current)
+	FreeCursor(pSprite->current, None);
+    pSprite->current = pCursor;
 
     if (pScreen)
     {
@@ -3048,6 +3053,7 @@ UpdateSpriteForScreen(DeviceIntPtr pDev, ScreenPtr pScreen)
 {
     SpritePtr pSprite = NULL;
     WindowPtr win = NULL;
+    CursorPtr pCursor;
     if (!pScreen)
         return ;
 
@@ -3063,8 +3069,12 @@ UpdateSpriteForScreen(DeviceIntPtr pDev, ScreenPtr pScreen)
     pSprite->hotLimits.x2 = pScreen->width;
     pSprite->hotLimits.y2 = pScreen->height;
     pSprite->win = win;
-    pSprite->current = wCursor (win);
-    pSprite->current->refcnt++;
+    pCursor = wCursor(win);
+    if (pCursor)
+	pCursor->refcnt++;
+    if (pSprite->current)
+	FreeCursor(pSprite->current, 0);
+    pSprite->current = pCursor;
     pSprite->spriteTraceGood = 1;
     pSprite->spriteTrace[0] = win;
     (*pScreen->CursorLimits) (pDev,
diff --git a/hw/xfree86/ramdac/xf86Cursor.c b/hw/xfree86/ramdac/xf86Cursor.c
index f5f0873..346e994 100644
--- a/hw/xfree86/ramdac/xf86Cursor.c
+++ b/hw/xfree86/ramdac/xf86Cursor.c
@@ -312,6 +312,8 @@ xf86CursorSetCursor(DeviceIntPtr pDev, ScreenPtr pScreen, CursorPtr pCurs,
             xf86SetCursor(pScreen, NullCursor, x, y);
             ScreenPriv->isUp = FALSE;
         }
+	if (ScreenPriv->CurrentCursor)
+	    FreeCursor(ScreenPriv->CurrentCursor, None);
         ScreenPriv->CurrentCursor = NullCursor;
         return;
     }
-- 
1.7.0.4