xserver: Branch 'xorg-server-1.4-apple' - 4 commits

[Jeremy Huddleston]

 Xext/shm.c      |   36 ++++++++++++++++++++----------------
 dix/getevents.c |    2 +-
 xkb/xkbLEDs.c   |    3 +++
 3 files changed, 24 insertions(+), 17 deletions(-)

New commits:
commit 1b22192e5079cec0e0b5e072415e93aae67d8593
Merge: b3eabf1... bc72ef3...
Author: Jeremy Huddleston <jeremy at yuffie.local>
Date:   Wed Feb 13 23:48:02 2008 -0800

    Merge branch 'server-1.4-branch' into xorg-server-1.4-apple

commit bc72ef3a159efd67067322c043bba444869dc356
Author: Peter Hutterer <peter at cs.unisa.edu.au>
Date:   Wed Jan 30 10:39:54 2008 +1030

    xkb: don't update LEDs if they don't exist. (Bug #13961)
    
    In some weird cases we call this function when there is no SrvLedInfo on the
    device. And it turns out null-pointer dereferences are bad.
    
    X.Org Bug 13961 <http://bugs.freedesktop.org/show_bug.cgi?id=13961>
    (cherry picked from commit d954f9c80348de294602d931d387e5cd1ef4b9a5)

diff --git a/xkb/xkbLEDs.c b/xkb/xkbLEDs.c
index d607d90..d28973c 100644
--- a/xkb/xkbLEDs.c
+++ b/xkb/xkbLEDs.c
@@ -63,6 +63,9 @@ XkbSrvLedInfoPtr	sli;
 
     sli= XkbFindSrvLedInfo(dev,XkbDfltXIClass,XkbDfltXIId,0);
 
+    if (!sli)
+        return update;
+
     if (state_changes&(XkbModifierStateMask|XkbGroupStateMask))
 	update|= sli->usesEffective;
     if (state_changes&(XkbModifierBaseMask|XkbGroupBaseMask))
commit e98027c3ac7195fec665ef393d980b02870ca1b8
Author: Peter Hutterer <peter at cs.unisa.edu.au>
Date:   Tue Dec 18 13:57:07 2007 +1030

    dix: set the correct number of valuators in valuator events.
    
    (first_valuator + num_valuators) must never be larger than the number of axes,
    otherwise DIX freaks out. And from looking at libXI, anything larger than 6 is
    wrong too.
    (cherry picked from commit 9f6ae61ad12cc2813d04405458e1ca5aed8a539e)

diff --git a/dix/getevents.c b/dix/getevents.c
index 12d8189..b7ba69b 100644
--- a/dix/getevents.c
+++ b/dix/getevents.c
@@ -344,7 +344,7 @@ getValuatorEvents(xEvent *events, DeviceIntPtr pDev, int first_valuator,
     for (i = first_valuator; i < final_valuator; i += 6, xv++, events++) {
         xv->type = DeviceValuator;
         xv->first_valuator = i;
-        xv->num_valuators = num_valuators;
+        xv->num_valuators = ((num_valuators - i) > 6) ? 6 : (num_valuators - i);
         xv->deviceid = pDev->id;
         switch (final_valuator - i) {
         case 6:
commit b6d4cdf64f43ae805beada6122c8be2ed138742c
Author: Adam Jackson <ajax at redhat.com>
Date:   Fri Jan 18 14:41:20 2008 -0500

    CVE-2007-6429: Don't spuriously reject <8bpp shm pixmaps.
    
    Move size validation after depth validation, and only validate size if
    the bpp of the pixmap format is > 8.  If bpp < 8 then we're already
    protected from overflow by the width and height checks.
    (cherry picked from commit e9fa7c1c88a8130a48f772c92b186b8b777986b5)

diff --git a/Xext/shm.c b/Xext/shm.c
index 5633be9..6f99e90 100644
--- a/Xext/shm.c
+++ b/Xext/shm.c
@@ -737,14 +737,6 @@ ProcPanoramiXShmCreatePixmap(
     }
     if (width > 32767 || height > 32767)
         return BadAlloc;
-    size = PixmapBytePad(width, depth) * height;
-    if (sizeof(size) == 4) {
-        if (size < width * height)
-            return BadAlloc;
-        /* thankfully, offset is unsigned */
-        if (stuff->offset + size < size)
-            return BadAlloc;
-    }
 
     if (stuff->depth != 1)
     {
@@ -755,7 +747,17 @@ ProcPanoramiXShmCreatePixmap(
 	client->errorValue = stuff->depth;
         return BadValue;
     }
+
 CreatePmap:
+    size = PixmapBytePad(width, depth) * height;
+    if (sizeof(size) == 4 && BitsPerPixel(depth) > 8) {
+        if (size < width * height)
+            return BadAlloc;
+        /* thankfully, offset is unsigned */
+        if (stuff->offset + size < size)
+            return BadAlloc;
+    }
+
     VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
 
     if(!(newPix = (PanoramiXRes *) xalloc(sizeof(PanoramiXRes))))
@@ -1080,14 +1082,6 @@ ProcShmCreatePixmap(client)
     }
     if (width > 32767 || height > 32767)
 	return BadAlloc;
-    size = PixmapBytePad(width, depth) * height;
-    if (sizeof(size) == 4) {
-	if (size < width * height)
-	    return BadAlloc;
-	/* thankfully, offset is unsigned */
-	if (stuff->offset + size < size)
-	    return BadAlloc;
-    }
 
     if (stuff->depth != 1)
     {
@@ -1098,7 +1092,17 @@ ProcShmCreatePixmap(client)
 	client->errorValue = stuff->depth;
         return BadValue;
     }
+
 CreatePmap:
+    size = PixmapBytePad(width, depth) * height;
+    if (sizeof(size) == 4 && BitsPerPixel(depth) > 8) {
+	if (size < width * height)
+	    return BadAlloc;
+	/* thankfully, offset is unsigned */
+	if (stuff->offset + size < size)
+	    return BadAlloc;
+    }
+
     VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
     pMap = (*shmFuncs[pDraw->pScreen->myNum]->CreatePixmap)(
 			    pDraw->pScreen, stuff->width,