diff options
Diffstat (limited to 'x11-base/xorg-server/files')
50 files changed, 2666 insertions, 0 deletions
diff --git a/x11-base/xorg-server/files/1.2.0-fix-amd-cpu-detection.patch b/x11-base/xorg-server/files/1.2.0-fix-amd-cpu-detection.patch new file mode 100644 index 0000000..48775d3 --- /dev/null +++ b/x11-base/xorg-server/files/1.2.0-fix-amd-cpu-detection.patch @@ -0,0 +1,38 @@ +http://gitweb.freedesktop.org/?p=xorg/xserver.git;a=commit;h=876b806ec09d5ff0c6cd19df91006c4eefedfaa6 +Reapply patch to fix AMD CPU detection + author Soren Sandmann Pedersen <ssp@dhcp83-218.boston.redhat.com> + Tue, 6 Feb 2007 22:16:23 +0000 (17:16 -0500) + committer Soren Sandmann Pedersen <ssp@dhcp83-218.boston.redhat.com> + Tue, 6 Feb 2007 22:16:23 +0000 (17:16 -0500) + commit 876b806ec09d5ff0c6cd19df91006c4eefedfaa6 + tree 0c30b71f2adbbea5641bc4611c6360e23a2e172d tree + parent 13568d2aa43da4216bbcb46e1125ff28c323ac54 commit | commitdiff +Reapply patch to fix AMD CPU detection + +--- xorg-server-1.2.0.orig/fb/fbpict.c 2007-03-18 21:43:21.000000000 +0100 ++++ xorg-server-1.2.0/fb/fbpict.c 2007-03-19 00:30:44.000000000 +0100 +@@ -1470,21 +1470,23 @@ + if (result) { + /* result now contains the standard feature bits */ + if (result & (1 << 15)) + features |= CMOV; + if (result & (1 << 23)) + features |= MMX; + if (result & (1 << 25)) + features |= SSE; + if (result & (1 << 26)) + features |= SSE2; +- if ((result & MMX) && !(result & SSE) && (strcmp(vendor, "AuthenticAMD") == 0)) { ++ if ((features & MMX) && !(features & SSE) && ++ (strcmp(vendor, "AuthenticAMD") == 0 || ++ strcmp(vendor, "Geode by NSC") == 0)) { + /* check for AMD MMX extensions */ + + unsigned int result; + __asm__("push %%ebx\n" + "mov $0x80000000, %%eax\n" + "cpuid\n" + "xor %%edx, %%edx\n" + "cmp $0x1, %%eax\n" + "jge 2\n" + "mov $0x80000001, %%eax\n" diff --git a/x11-base/xorg-server/files/1.2.0-properly-free-device-devprivates-memory-leak-fix.patch b/x11-base/xorg-server/files/1.2.0-properly-free-device-devprivates-memory-leak-fix.patch new file mode 100644 index 0000000..b4747c4 --- /dev/null +++ b/x11-base/xorg-server/files/1.2.0-properly-free-device-devprivates-memory-leak-fix.patch @@ -0,0 +1,38 @@ +http://gitweb.freedesktop.org/?p=xorg/xserver.git;a=commit;h=b5fde366e2e21234ac0b81222fd5c42ca3e49cba +Properly free device devPrivates - memory leak fix. + author Eamon Walsh <ewalsh@tycho.nsa.gov> + Wed, 7 Mar 2007 17:29:55 +0000 (12:29 -0500) + committer Eamon Walsh <ewalsh@moss-uranus.epoch.ncsc.mil> + Wed, 7 Mar 2007 17:29:55 +0000 (12:29 -0500) + commit b5fde366e2e21234ac0b81222fd5c42ca3e49cba + tree 21c4d64fc97f8a7b0ec39f7e7a408540dd78691e tree + parent a3d2c5d622d9ca36d6fa2966aff09524e3ea39ac commit | commitdiff +Properly free device devPrivates - memory leak fix. + +--- xorg-server-1.2.0.orig/dix/devices.c 2007-03-18 21:43:21.000000000 +0100 ++++ xorg-server-1.2.0/dix/devices.c 2007-03-18 21:47:58.000000000 +0100 +@@ -268,20 +268,24 @@ + if (l->xkb_sli) + XkbFreeSrvLedInfo(l->xkb_sli); + #endif + xfree(l); + } + #ifdef XKB + while (dev->xkb_interest) { + XkbRemoveResourceClient((DevicePtr)dev,dev->xkb_interest->resource); + } + #endif ++ ++ if (dev->devPrivates) ++ xfree(dev->devPrivates); ++ + xfree(dev->sync.event); + xfree(dev); + } + + void + CloseDownDevices() + { + register DeviceIntPtr dev, next; + + for (dev = inputInfo.devices; dev; dev = next) diff --git a/x11-base/xorg-server/files/1.2.0-typo-fix.patch b/x11-base/xorg-server/files/1.2.0-typo-fix.patch new file mode 100644 index 0000000..0a15217 --- /dev/null +++ b/x11-base/xorg-server/files/1.2.0-typo-fix.patch @@ -0,0 +1,36 @@ +http://gitweb.freedesktop.org/?p=xorg/xserver.git;a=commit;h=a23b0b069cac8a48e2b306b2095515d75f647705 +Typo fix. + author Adam Jackson <ajax@benzedrine.nwnk.net> + Mon, 12 Feb 2007 22:50:00 +0000 (17:50 -0500) + committer Adam Jackson <ajax@benzedrine.nwnk.net> + Mon, 12 Feb 2007 22:50:00 +0000 (17:50 -0500) + commit a23b0b069cac8a48e2b306b2095515d75f647705 + tree 44d98fa9da8b879e4d610a9fc484804a418d217c tree + parent d21c95f80bdba2f29eedd57fb0b00e580391c08e commit | commitdiff +Typo fix. + +--- xorg-server-1.2.0.orig/hw/xfree86/os-support/xf86_libc.h 2007-03-18 21:43:21.000000000 +0100 ++++ xorg-server-1.2.0/hw/xfree86/os-support/xf86_libc.h 2007-03-19 00:31:52.000000000 +0100 +@@ -421,21 +421,21 @@ + #undef tan + #define tan(d) xf86tan(d) + #undef tmpfile + #define tmpfile() xf86tmpfile() + #undef tolower + #define tolower(i) xf86tolower(i) + #undef toupper + #define toupper(i) xf86toupper(i) + #undef ungetc + #define ungetc(i,FP) xf86ungetc(i,FP) +-#undef vfprinf ++#undef vfprintf + #define vfprintf(p,f,a) xf86vfprintf(p,f,a) + #undef vsnprintf + #define vsnprintf(s,n,f,a) xf86vsnprintf(s,n,f,a) + #undef vsprintf + #define vsprintf(s,f,a) xf86vsprintf(s,f,a) + /* XXX Disable assert as if NDEBUG was defined */ + /* Some X headers defined this away too */ + #undef assert + #define assert(a) ((void)0) + #undef HUGE_VAL
\ No newline at end of file diff --git a/x11-base/xorg-server/files/1.2.0-zero-out-client-devprivates-on-allocation.patch b/x11-base/xorg-server/files/1.2.0-zero-out-client-devprivates-on-allocation.patch new file mode 100644 index 0000000..7c6144b --- /dev/null +++ b/x11-base/xorg-server/files/1.2.0-zero-out-client-devprivates-on-allocation.patch @@ -0,0 +1,36 @@ +http://gitweb.freedesktop.org/?p=xorg/xserver.git;a=commit;h=d9e079d2a385203fdd18d958cfc19d759cab4ba8 +Zero out client devPrivates on allocation. + author Eamon Walsh <ewalsh@tycho.nsa.gov> + Fri, 22 Dec 2006 18:07:09 +0000 (13:07 -0500) + committer Eamon Walsh <ewalsh@moss-uranus.epoch.ncsc.mil> + Fri, 22 Dec 2006 18:07:09 +0000 (13:07 -0500) + commit d9e079d2a385203fdd18d958cfc19d759cab4ba8 + tree 20548a2b4ab268c5a32c5883f3d06816c9f5d43e tree + parent e437f357b6850a6c87ca6696870b3abd40e5b8ed commit | commitdiff +Zero out client devPrivates on allocation. + +--- xorg-server-1.2.0.orig/dix/dispatch.c 2007-03-18 21:43:21.000000000 +0100 ++++ xorg-server-1.2.0/dix/dispatch.c 2007-03-18 22:00:24.000000000 +0100 +@@ -3683,20 +3683,22 @@ + ppriv = (DevUnion *)(client + 1); + else + { + ppriv = (DevUnion *)xalloc(totalClientSize - sizeof(ClientRec)); + if (!ppriv) + return 0; + } + client->devPrivates = ppriv; + sizes = clientPrivateSizes; + ptr = (char *)(ppriv + clientPrivateLen); ++ if (ppriv) ++ bzero(ppriv, totalClientSize - sizeof(ClientRec)); + for (i = clientPrivateLen; --i >= 0; ppriv++, sizes++) + { + if ( (size = *sizes) ) + { + ppriv->ptr = (pointer)ptr; + ptr += size; + } + else + ppriv->ptr = (pointer)NULL; + } diff --git a/x11-base/xorg-server/files/1.3-0003-Fix-for-CVE-2007-6427-Xinput-extension-memory-corr.patch b/x11-base/xorg-server/files/1.3-0003-Fix-for-CVE-2007-6427-Xinput-extension-memory-corr.patch new file mode 100644 index 0000000..18075a6 --- /dev/null +++ b/x11-base/xorg-server/files/1.3-0003-Fix-for-CVE-2007-6427-Xinput-extension-memory-corr.patch @@ -0,0 +1,244 @@ +Index: xorg-server-1.3.0.0/Xi/chgfctl.c +=================================================================== +--- xorg-server-1.3.0.0.orig/Xi/chgfctl.c ++++ xorg-server-1.3.0.0/Xi/chgfctl.c +@@ -451,18 +451,13 @@ ChangeStringFeedback(ClientPtr client, D + xStringFeedbackCtl * f) + { + register char n; +- register long *p; + int i, j; + KeySym *syms, *sup_syms; + + syms = (KeySym *) (f + 1); + if (client->swapped) { + swaps(&f->length, n); /* swapped num_keysyms in calling proc */ +- p = (long *)(syms); +- for (i = 0; i < f->num_keysyms; i++) { +- swapl(p, n); +- p++; +- } ++ SwapLongs((CARD32 *) syms, f->num_keysyms); + } + + if (f->num_keysyms > s->ctrl.max_symbols) { +Index: xorg-server-1.3.0.0/Xi/chgkmap.c +=================================================================== +--- xorg-server-1.3.0.0.orig/Xi/chgkmap.c ++++ xorg-server-1.3.0.0/Xi/chgkmap.c +@@ -79,18 +79,14 @@ int + SProcXChangeDeviceKeyMapping(register ClientPtr client) + { + register char n; +- register long *p; +- register int i, count; ++ register unsigned int count; + + REQUEST(xChangeDeviceKeyMappingReq); + swaps(&stuff->length, n); + REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq); +- p = (long *)&stuff[1]; + count = stuff->keyCodes * stuff->keySymsPerKeyCode; +- for (i = 0; i < count; i++) { +- swapl(p, n); +- p++; +- } ++ REQUEST_FIXED_SIZE(xChangeDeviceKeyMappingReq, count * sizeof(CARD32)); ++ SwapLongs((CARD32 *) (&stuff[1]), count); + return (ProcXChangeDeviceKeyMapping(client)); + } + +@@ -106,10 +102,14 @@ ProcXChangeDeviceKeyMapping(register Cli + int ret; + unsigned len; + DeviceIntPtr dev; ++ unsigned int count; + + REQUEST(xChangeDeviceKeyMappingReq); + REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq); + ++ count = stuff->keyCodes * stuff->keySymsPerKeyCode; ++ REQUEST_FIXED_SIZE(xChangeDeviceKeyMappingReq, count * sizeof(CARD32)); ++ + dev = LookupDeviceIntRec(stuff->deviceid); + if (dev == NULL) { + SendErrorToClient(client, IReqCode, X_ChangeDeviceKeyMapping, 0, +Index: xorg-server-1.3.0.0/Xi/chgprop.c +=================================================================== +--- xorg-server-1.3.0.0.orig/Xi/chgprop.c ++++ xorg-server-1.3.0.0/Xi/chgprop.c +@@ -81,19 +81,15 @@ int + SProcXChangeDeviceDontPropagateList(register ClientPtr client) + { + register char n; +- register long *p; +- register int i; + + REQUEST(xChangeDeviceDontPropagateListReq); + swaps(&stuff->length, n); + REQUEST_AT_LEAST_SIZE(xChangeDeviceDontPropagateListReq); + swapl(&stuff->window, n); + swaps(&stuff->count, n); +- p = (long *)&stuff[1]; +- for (i = 0; i < stuff->count; i++) { +- swapl(p, n); +- p++; +- } ++ REQUEST_FIXED_SIZE(xChangeDeviceDontPropagateListReq, ++ stuff->count * sizeof(CARD32)); ++ SwapLongs((CARD32 *) (&stuff[1]), stuff->count); + return (ProcXChangeDeviceDontPropagateList(client)); + } + +Index: xorg-server-1.3.0.0/Xi/grabdev.c +=================================================================== +--- xorg-server-1.3.0.0.orig/Xi/grabdev.c ++++ xorg-server-1.3.0.0/Xi/grabdev.c +@@ -82,8 +82,6 @@ int + SProcXGrabDevice(register ClientPtr client) + { + register char n; +- register long *p; +- register int i; + + REQUEST(xGrabDeviceReq); + swaps(&stuff->length, n); +@@ -91,11 +89,11 @@ SProcXGrabDevice(register ClientPtr clie + swapl(&stuff->grabWindow, n); + swapl(&stuff->time, n); + swaps(&stuff->event_count, n); +- p = (long *)&stuff[1]; +- for (i = 0; i < stuff->event_count; i++) { +- swapl(p, n); +- p++; +- } ++ ++ if (stuff->length != (sizeof(xGrabDeviceReq) >> 2) + stuff->event_count) ++ return BadLength; ++ ++ SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count); + + return (ProcXGrabDevice(client)); + } +Index: xorg-server-1.3.0.0/Xi/grabdevb.c +=================================================================== +--- xorg-server-1.3.0.0.orig/Xi/grabdevb.c ++++ xorg-server-1.3.0.0/Xi/grabdevb.c +@@ -80,8 +80,6 @@ int + SProcXGrabDeviceButton(register ClientPtr client) + { + register char n; +- register long *p; +- register int i; + + REQUEST(xGrabDeviceButtonReq); + swaps(&stuff->length, n); +@@ -89,11 +87,9 @@ SProcXGrabDeviceButton(register ClientPt + swapl(&stuff->grabWindow, n); + swaps(&stuff->modifiers, n); + swaps(&stuff->event_count, n); +- p = (long *)&stuff[1]; +- for (i = 0; i < stuff->event_count; i++) { +- swapl(p, n); +- p++; +- } ++ REQUEST_FIXED_SIZE(xGrabDeviceButtonReq, ++ stuff->event_count * sizeof(CARD32)); ++ SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count); + + return (ProcXGrabDeviceButton(client)); + } +Index: xorg-server-1.3.0.0/Xi/grabdevk.c +=================================================================== +--- xorg-server-1.3.0.0.orig/Xi/grabdevk.c ++++ xorg-server-1.3.0.0/Xi/grabdevk.c +@@ -80,8 +80,6 @@ int + SProcXGrabDeviceKey(register ClientPtr client) + { + register char n; +- register long *p; +- register int i; + + REQUEST(xGrabDeviceKeyReq); + swaps(&stuff->length, n); +@@ -89,11 +87,8 @@ SProcXGrabDeviceKey(register ClientPtr c + swapl(&stuff->grabWindow, n); + swaps(&stuff->modifiers, n); + swaps(&stuff->event_count, n); +- p = (long *)&stuff[1]; +- for (i = 0; i < stuff->event_count; i++) { +- swapl(p, n); +- p++; +- } ++ REQUEST_FIXED_SIZE(xGrabDeviceKeyReq, stuff->event_count * sizeof(CARD32)); ++ SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count); + return (ProcXGrabDeviceKey(client)); + } + +Index: xorg-server-1.3.0.0/Xi/selectev.c +=================================================================== +--- xorg-server-1.3.0.0.orig/Xi/selectev.c ++++ xorg-server-1.3.0.0/Xi/selectev.c +@@ -84,19 +84,16 @@ int + SProcXSelectExtensionEvent(register ClientPtr client) + { + register char n; +- register long *p; +- register int i; + + REQUEST(xSelectExtensionEventReq); + swaps(&stuff->length, n); + REQUEST_AT_LEAST_SIZE(xSelectExtensionEventReq); + swapl(&stuff->window, n); + swaps(&stuff->count, n); +- p = (long *)&stuff[1]; +- for (i = 0; i < stuff->count; i++) { +- swapl(p, n); +- p++; +- } ++ REQUEST_FIXED_SIZE(xSelectExtensionEventReq, ++ stuff->count * sizeof(CARD32)); ++ SwapLongs((CARD32 *) (&stuff[1]), stuff->count); ++ + return (ProcXSelectExtensionEvent(client)); + } + +Index: xorg-server-1.3.0.0/Xi/sendexev.c +=================================================================== +--- xorg-server-1.3.0.0.orig/Xi/sendexev.c ++++ xorg-server-1.3.0.0/Xi/sendexev.c +@@ -83,7 +83,7 @@ int + SProcXSendExtensionEvent(register ClientPtr client) + { + register char n; +- register long *p; ++ register CARD32 *p; + register int i; + xEvent eventT; + xEvent *eventP; +@@ -94,6 +94,11 @@ SProcXSendExtensionEvent(register Client + REQUEST_AT_LEAST_SIZE(xSendExtensionEventReq); + swapl(&stuff->destination, n); + swaps(&stuff->count, n); ++ ++ if (stuff->length != (sizeof(xSendExtensionEventReq) >> 2) + stuff->count + ++ (stuff->num_events * (sizeof(xEvent) >> 2))) ++ return BadLength; ++ + eventP = (xEvent *) & stuff[1]; + for (i = 0; i < stuff->num_events; i++, eventP++) { + proc = EventSwapVector[eventP->u.u.type & 0177]; +@@ -103,11 +108,8 @@ SProcXSendExtensionEvent(register Client + *eventP = eventT; + } + +- p = (long *)(((xEvent *) & stuff[1]) + stuff->num_events); +- for (i = 0; i < stuff->count; i++) { +- swapl(p, n); +- p++; +- } ++ p = (CARD32 *)(((xEvent *) & stuff[1]) + stuff->num_events); ++ SwapLongs(p, stuff->count); + return (ProcXSendExtensionEvent(client)); + } + diff --git a/x11-base/xorg-server/files/1.3-0006-Fix-for-CVE-2007-5958-File-existence-disclosure.patch b/x11-base/xorg-server/files/1.3-0006-Fix-for-CVE-2007-5958-File-existence-disclosure.patch new file mode 100644 index 0000000..b8e5178 --- /dev/null +++ b/x11-base/xorg-server/files/1.3-0006-Fix-for-CVE-2007-5958-File-existence-disclosure.patch @@ -0,0 +1,22 @@ +Index: xorg-server-1.3.0.0/Xext/security.c +=================================================================== +--- xorg-server-1.3.0.0.orig/Xext/security.c ++++ xorg-server-1.3.0.0/Xext/security.c +@@ -1567,7 +1567,7 @@ SecurityLoadPropertyAccessList(void) + return; + + #ifndef __UNIXOS2__ +- f = fopen(SecurityPolicyFile, "r"); ++ f = Fopen(SecurityPolicyFile, "r"); + #else + f = fopen((char*)__XOS2RedirRoot(SecurityPolicyFile), "r"); + #endif +@@ -1653,7 +1653,7 @@ SecurityLoadPropertyAccessList(void) + } + #endif /* PROPDEBUG */ + +- fclose(f); ++ Fclose(f); + } /* SecurityLoadPropertyAccessList */ + + diff --git a/x11-base/xorg-server/files/1.3-alpha-build-fix.patch b/x11-base/xorg-server/files/1.3-alpha-build-fix.patch new file mode 100644 index 0000000..481e4ad --- /dev/null +++ b/x11-base/xorg-server/files/1.3-alpha-build-fix.patch @@ -0,0 +1,36 @@ +commit 0f91abd5c68eb044d09733d18ef0f6b8ed128200 +Author: Julien Cristau <jcristau@debian.org> +Date: Thu Jul 19 20:37:26 2007 -0400 + + Fix alpha build failures + + Don't include <asm/pci.h> in os-support/linux/lnx_axp.c, use "lnx.h" and + <unistd.h> instead + +diff --git a/hw/xfree86/os-support/linux/lnx.h b/hw/xfree86/os-support/linux/lnx.h +index 5aca9e9..085c942 100644 +--- a/hw/xfree86/os-support/linux/lnx.h ++++ b/hw/xfree86/os-support/linux/lnx.h +@@ -11,7 +11,6 @@ extern int iopl __P ((int __level)); + + /* new pciconfig_iobase syscall added in 2.2.15 and 2.3.99 */ + # include <linux/unistd.h> +-# include <asm/pci.h> + extern long (*_iobase)(unsigned, int, int, int); + + /* +diff --git a/hw/xfree86/os-support/linux/lnx_axp.c b/hw/xfree86/os-support/linux/lnx_axp.c +index 0a76129..e255118 100644 +--- a/hw/xfree86/os-support/linux/lnx_axp.c ++++ b/hw/xfree86/os-support/linux/lnx_axp.c +@@ -112,8 +112,8 @@ lnxGetAXP(void) + /* + * pciconfig_iobase wrappers and dynamic i/o selection + */ +-#include <linux/unistd.h> +-#include <asm/pci.h> ++#include "lnx.h" ++#include <unistd.h> + #include <errno.h> + + /* glibc versions (single hose only) */ diff --git a/x11-base/xorg-server/files/1.3.0.0-fix-dual-head-screen-resolutions.patch b/x11-base/xorg-server/files/1.3.0.0-fix-dual-head-screen-resolutions.patch new file mode 100644 index 0000000..c5b9571 --- /dev/null +++ b/x11-base/xorg-server/files/1.3.0.0-fix-dual-head-screen-resolutions.patch @@ -0,0 +1,49 @@ +Title : x11-base/xorg-server-1.3.0.0 uses wrong screen resolutions on a dual-head systems +Assignee : x11@gentoo.org +Reported : 2007-05-23 16:53 0000 +Updated : 2007-10-02 19:39:28 0000 +Status : NEW +Severity : normal +Priority : P2 +Reporter : jouni.rinne@pp1.inet.fi +Product : Gentoo Linux +Component : Server +Keywords : Inclusion +CC : bas@lijer.nl +CC : daniel.pielmeier@googlemail.com +CC : frlinux@frlinux.net +CC : ml81@gmx.de +Comments : 14 +Attachments : 1 +URL : http://bugs.gentoo.org/show_bug.cgi?id=179545 + +commit 9c80eda826448822328bb678a7d284cc43fffb17 +Author: Adam Jackson <ajax@benzedrine.nwnk.net> +Date: Wed Apr 25 16:35:04 2007 -0400 + + Disable RANDR's fake Xinerama protocol when there's more than one screen. + + ... in the protocol sense. Xinerama doesn't have any provision for more + than one protocol screen each with its own geometry. + + Red Hat bug #231257. + +diff --git a/randr/rrxinerama.c b/randr/rrxinerama.c +index 1db27f1..2a57e4e 100644 +--- a/randr/rrxinerama.c ++++ b/randr/rrxinerama.c +@@ -428,6 +428,14 @@ RRXineramaExtensionInit(void) + return; + #endif + ++ /* ++ * Xinerama isn't capable enough to have multiple protocol screens each ++ * with their own output geometry. So if there's more than one protocol ++ * screen, just don't even try. ++ */ ++ if (screenInfo.numScreens > 1) ++ return; ++ + (void) AddExtension(PANORAMIX_PROTOCOL_NAME, 0,0, + ProcRRXineramaDispatch, + SProcRRXineramaDispatch, diff --git a/x11-base/xorg-server/files/1.3.0.0-fix-randr-resizing.patch b/x11-base/xorg-server/files/1.3.0.0-fix-randr-resizing.patch new file mode 100644 index 0000000..4828699 --- /dev/null +++ b/x11-base/xorg-server/files/1.3.0.0-fix-randr-resizing.patch @@ -0,0 +1,58 @@ +Title : xorg-server-1.3: desktop does not resize with RandR +Assignee : x11@gentoo.org +Reported : 2007-06-30 11:37 0000 +Updated : 2007-10-06 08:32:58 0000 +Status : ASSIGNED +Severity : normal +Priority : P2 +Reporter : sascha.lucas@rus.uni-stuttgart.de +Product : Gentoo Linux +Component : KDE +Keywords : Inclusion +CC : caster@gentoo.org +CC : chrschmitt@gmail.com +CC : gentoo@chlhp.de +CC : kde@gentoo.org +Comments : 14 +Attachments : 0 +URL : http://bugs.gentoo.org/show_bug.cgi?id=183721 + +commit c10df5b967d4da4e11786520317e2917de5541fa +Author: Aaron Plattner <aplattner@nvidia.com> +Date: Tue Apr 3 15:47:01 2007 -0700 + + Swap RRScreenChangeNotifyEvent dimensions when the screen has one crtc and it's rotated. + + RandR 1.1 clients expect the size fields in this event to be the unrotated + dimensions of the screen. This behavior is "weird", but that's the way the old + code worked so we need to be bug-compatible with it. + +diff --git a/randr/rrscreen.c b/randr/rrscreen.c +index ad74ac3..f83fce3 100644 +--- a/randr/rrscreen.c ++++ b/randr/rrscreen.c +@@ -116,11 +116,19 @@ RRDeliverScreenEvent (ClientPtr client, WindowPtr pWin, ScreenPtr pScreen) + + se.sequenceNumber = client->sequence; + se.sizeID = RR10CurrentSizeID (pScreen); +- +- se.widthInPixels = pScreen->width; +- se.heightInPixels = pScreen->height; +- se.widthInMillimeters = pScreen->mmWidth; +- se.heightInMillimeters = pScreen->mmHeight; ++ ++ if (se.rotation & (RR_Rotate_90 | RR_Rotate_270)) { ++ se.widthInPixels = pScreen->height; ++ se.heightInPixels = pScreen->width; ++ se.widthInMillimeters = pScreen->mmHeight; ++ se.heightInMillimeters = pScreen->mmWidth; ++ } else { ++ se.widthInPixels = pScreen->width; ++ se.heightInPixels = pScreen->height; ++ se.widthInMillimeters = pScreen->mmWidth; ++ se.heightInMillimeters = pScreen->mmHeight; ++ } ++ + WriteEventsToClient (client, 1, (xEvent *) &se); + } + diff --git a/x11-base/xorg-server/files/1.3.0.0-fix-xephyr-amd64-segfault.patch b/x11-base/xorg-server/files/1.3.0.0-fix-xephyr-amd64-segfault.patch new file mode 100644 index 0000000..c8fdfed --- /dev/null +++ b/x11-base/xorg-server/files/1.3.0.0-fix-xephyr-amd64-segfault.patch @@ -0,0 +1,45 @@ +Title : x11-base/xorg-server-1.3.0.0 Xephyr segfaults on startup on amd64 +Assignee : x11@gentoo.org +Reported : 2007-09-20 17:22 0000 +Updated : 2007-09-20 17:52:21 0000 +Status : NEW +URL : https://bugs.freedesktop.org/show_bug.cgi?id=11582 +Severity : normal +Priority : P2 +Reporter : chithanh@cs.tu-berlin.de +Product : Gentoo Linux +Component : Server +Keywords : Inclusion +Comments : 2 +Attachments : 1 +URL : http://bugs.gentoo.org/show_bug.cgi?id=193207 + +commit dcc3de91d2b80be98e4488df29ec6b551c7ff6d1 +Author: Alan Coopersmith <alan.coopersmith@sun.com> +Date: Sat Aug 18 11:50:33 2007 +0200 + + Xephyr: fix immediat segfault on amd64 + + This closes bug https://bugs.freedesktop.org/show_bug.cgi?id=11582 + +diff --git a/hw/kdrive/ephyr/hostx.c b/hw/kdrive/ephyr/hostx.c +index d0a2f2f..12118da 100644 +--- a/hw/kdrive/ephyr/hostx.c ++++ b/hw/kdrive/ephyr/hostx.c +@@ -40,6 +40,7 @@ + #include <X11/Xatom.h> + #include <X11/keysym.h> + #include <X11/extensions/XShm.h> ++#include <X11/Xmd.h> + + /* + * All xlib calls go here, which gets built as its own .a . +@@ -79,7 +80,7 @@ static int HostXWantDamageDebug = 0; + + extern KeySym EphyrKeymap[]; + +-extern KeySym kdKeymap[]; ++extern CARD32 kdKeymap[]; + extern int kdMinScanCode; + extern int kdMaxScanCode; + extern int kdMinKeyCode; diff --git a/x11-base/xorg-server/files/1.3.0.0-fix-xkb-openoffice-hangs.patch b/x11-base/xorg-server/files/1.3.0.0-fix-xkb-openoffice-hangs.patch new file mode 100644 index 0000000..88df93b --- /dev/null +++ b/x11-base/xorg-server/files/1.3.0.0-fix-xkb-openoffice-hangs.patch @@ -0,0 +1,55 @@ +https://bugs.gentoo.org/show_bug.cgi?id=197104 + +commit a5b8053606d6e786cdcf6734f271acc05f9cc588 +Author: Adam Jackson <ajax@benzedrine.nwnk.net> +Date: Tue Sep 11 11:37:06 2007 -0400 + + Ignore - not just block - SIGALRM around Popen()/Pclose(). + + Because our "popen" implementation uses stdio, and because nobody's stdio + library is capable of surviving signals, we need to make absolutely sure + that we hide the SIGALRM from the smart scheduler. Otherwise, when you + open a menu in openoffice, and it recompiles XKB to deal with the + accelerators, and you popen xkbcomp because we suck, then the scheduler + will tell you you're taking forever doing something stupid, and the + wait() code will get confused, and input will hang and your CPU usage + slams to 100%. Down, not across. + +diff --git a/os/utils.c b/os/utils.c +index 3bb7dbe..afcaae4 100644 +--- a/os/utils.c ++++ b/os/utils.c +@@ -1720,6 +1720,8 @@ static struct pid { + int pid; + } *pidlist; + ++static sighandler_t old_alarm = NULL; /* XXX horrible awful hack */ ++ + pointer + Popen(char *command, char *type) + { +@@ -1741,11 +1743,15 @@ Popen(char *command, char *type) + return NULL; + } + ++ /* Ignore the smart scheduler while this is going on */ ++ old_alarm = signal(SIGALRM, SIG_IGN); ++ + switch (pid = fork()) { + case -1: /* error */ + close(pdes[0]); + close(pdes[1]); + xfree(cur); ++ signal(SIGALRM, old_alarm); + return NULL; + case 0: /* child */ + if (setgid(getgid()) == -1) +@@ -1921,6 +1927,8 @@ Pclose(pointer iop) + /* allow EINTR again */ + OsReleaseSignals (); + ++ signal(SIGALRM, old_alarm); ++ + return pid == -1 ? -1 : pstat; + } + diff --git a/x11-base/xorg-server/files/1.3.0.0-ramdac.patch b/x11-base/xorg-server/files/1.3.0.0-ramdac.patch new file mode 100644 index 0000000..37ab1b7 --- /dev/null +++ b/x11-base/xorg-server/files/1.3.0.0-ramdac.patch @@ -0,0 +1,91 @@ +Title : xorg-server-1.3: xf86-video-s3 - s3_drv.so: undefined symbol: RamDacInit +Assignee : x11@gentoo.org +Reported : 2007-09-12 15:53 0000 +Updated : 2007-10-06 08:34:19 0000 +Status : NEW +Severity : normal +Priority : P2 +Reporter : dpblnt@gmail.com +Product : Gentoo Linux +Component : Applications +Keywords : Inclusion +Comments : 3 +Attachments : 1 +URL : http://bugs.gentoo.org/show_bug.cgi?id=192312 + +commit 3c6f1428489c1f71acd41066ea73ef4ae7c60f17 +Author: Julien Cristau <jcristau@debian.org> +Date: Tue May 29 22:01:30 2007 -0400 + + Make sure that the ramdac symbols are present in the server + + The former ramdac module is now built into the server, so its symbols need to + be explicitly exported to drivers (Debian #423129). + +diff --git a/hw/xfree86/loader/xf86sym.c b/hw/xfree86/loader/xf86sym.c +index 5175f01..6535e4c 100644 +--- a/hw/xfree86/loader/xf86sym.c ++++ b/hw/xfree86/loader/xf86sym.c +@@ -96,6 +96,11 @@ + #endif + #include "xf86DDC.h" + #include "edid.h" ++#include "xf86Cursor.h" ++#include "xf86RamDac.h" ++#include "BT.h" ++#include "IBM.h" ++#include "TI.h" + + #ifndef HAS_GLIBC_SIGSETJMP + #if defined(setjmp) && defined(__GNU_LIBRARY__) && \ +@@ -1255,4 +1260,50 @@ _X_HIDDEN void *xfree86LookupTab[] = { + SYMFUNC(xf86I2CWriteRead) + SYMFUNC(xf86I2CWriteVec) + SYMFUNC(xf86I2CWriteWord) ++ ++ /* ramdac/xf86RamDac.c */ ++ SYMFUNC(RamDacCreateInfoRec) ++ SYMFUNC(RamDacHelperCreateInfoRec) ++ SYMFUNC(RamDacDestroyInfoRec) ++ SYMFUNC(RamDacHelperDestroyInfoRec) ++ SYMFUNC(RamDacInit) ++ SYMFUNC(RamDacHandleColormaps) ++ SYMFUNC(RamDacFreeRec) ++ SYMFUNC(RamDacGetHWIndex) ++ SYMVAR(RamDacHWPrivateIndex) ++ SYMVAR(RamDacScreenPrivateIndex) ++ ++ /* ramdac/xf86Cursor.c */ ++ SYMFUNC(xf86InitCursor) ++ SYMFUNC(xf86CreateCursorInfoRec) ++ SYMFUNC(xf86DestroyCursorInfoRec) ++ SYMFUNC(xf86ForceHWCursor) ++ ++ /* ramdac/BT.c */ ++ SYMFUNC(BTramdacProbe) ++ SYMFUNC(BTramdacSave) ++ SYMFUNC(BTramdacRestore) ++ SYMFUNC(BTramdacSetBpp) ++ ++ /* ramdac/IBM.c */ ++ SYMFUNC(IBMramdacProbe) ++ SYMFUNC(IBMramdacSave) ++ SYMFUNC(IBMramdacRestore) ++ SYMFUNC(IBMramdac526SetBpp) ++ SYMFUNC(IBMramdac640SetBpp) ++ SYMFUNC(IBMramdac526CalculateMNPCForClock) ++ SYMFUNC(IBMramdac640CalculateMNPCForClock) ++ SYMFUNC(IBMramdac526HWCursorInit) ++ SYMFUNC(IBMramdac640HWCursorInit) ++ SYMFUNC(IBMramdac526SetBppWeak) ++ ++ /* ramdac/TI.c */ ++ SYMFUNC(TIramdacCalculateMNPForClock) ++ SYMFUNC(TIramdacProbe) ++ SYMFUNC(TIramdacSave) ++ SYMFUNC(TIramdacRestore) ++ SYMFUNC(TIramdac3026SetBpp) ++ SYMFUNC(TIramdac3030SetBpp) ++ SYMFUNC(TIramdacHWCursorInit) ++ SYMFUNC(TIramdacLoadPalette) + }; diff --git a/x11-base/xorg-server/files/1.3.0.0-use-proc-instead-of-sys.patch b/x11-base/xorg-server/files/1.3.0.0-use-proc-instead-of-sys.patch new file mode 100644 index 0000000..600d0ba --- /dev/null +++ b/x11-base/xorg-server/files/1.3.0.0-use-proc-instead-of-sys.patch @@ -0,0 +1,16 @@ +https://bugs.gentoo.org/show_bug.cgi?id=167052 attachment #126176 + +Fix multi-domain systems including sparc and pegasos ppc + +diff -Nura xorg-server-1.3.0.0/hw/xfree86/os-support/bus/linuxPci.c xorg-server-1.3.0.0-nosysfs/hw/xfree86/os-support/bus/linuxPci.c +--- xorg-server-1.3.0.0/hw/xfree86/os-support/bus/linuxPci.c 2006-11-16 15:01:25.000000000 -0300 ++++ xorg-server-1.3.0.0-nosysfs/hw/xfree86/os-support/bus/linuxPci.c 2007-07-27 13:48:58.000000000 -0300 +@@ -148,7 +148,7 @@ + int domain, bus, dev, func; + char file[64]; + struct stat ignored; +- static int is26 = -1; ++ static int is26 = 0; + + domain = PCI_DOM_FROM_TAG(tag); + bus = PCI_BUS_NO_DOMAIN(PCI_BUS_FROM_TAG(tag)); diff --git a/x11-base/xorg-server/files/1.3.0.0-xephyr_crash_at_exit.patch b/x11-base/xorg-server/files/1.3.0.0-xephyr_crash_at_exit.patch new file mode 100644 index 0000000..4e5b130 --- /dev/null +++ b/x11-base/xorg-server/files/1.3.0.0-xephyr_crash_at_exit.patch @@ -0,0 +1,30 @@ +* Tue Mar 13 2007 Adam Jackson <ajax@redhat.com> 1.2.99.901-2 +- xserver-1.2.99.901-xephyr-crash-at-exit.patch: Fix yet another GLX visual + mess. (#231425) + +https://bugs.freedesktop.org/show_bug.cgi?id=10713 +http://cvs.fedora.redhat.com/viewcvs/devel/xorg-x11-server/xserver-1.2.99.901-xephyr-crash-at-exit.patch?rev=1.1&view=log +Debian bug #420421 (and maybe #424517) + +--- xorg-server-1.2.99.901/GL/mesa/X/xf86glx.c.jx 2007-03-07 14:15:25.000000000 -0500 ++++ xorg-server-1.2.99.901/GL/mesa/X/xf86glx.c 2007-03-13 14:27:38.000000000 -0400 +@@ -281,12 +281,14 @@ + __GLXMESAscreen *mesaScreen = (__GLXMESAscreen *) screen; + int i; + +- for (i = 0; i < mesaScreen->num_vis; i++) { +- if (mesaScreen->xm_vis[i]) +- XMesaDestroyVisual(mesaScreen->xm_vis[i]); +- } ++ if (mesaScreen->xm_vis) { ++ for (i = 0; i < mesaScreen->num_vis; i++) { ++ if (mesaScreen->xm_vis[i]) ++ XMesaDestroyVisual(mesaScreen->xm_vis[i]); ++ } + +- xfree(mesaScreen->xm_vis); ++ xfree(mesaScreen->xm_vis); ++ } + + __glXScreenDestroy(screen); + diff --git a/x11-base/xorg-server/files/1.4-0001-Fix-for-CVE-2007-5760-XFree86-Misc-extension-out-o.patch b/x11-base/xorg-server/files/1.4-0001-Fix-for-CVE-2007-5760-XFree86-Misc-extension-out-o.patch new file mode 100644 index 0000000..54dead0 --- /dev/null +++ b/x11-base/xorg-server/files/1.4-0001-Fix-for-CVE-2007-5760-XFree86-Misc-extension-out-o.patch @@ -0,0 +1,27 @@ +From 59a3b83922c810316a374a19484b24901c7437ae Mon Sep 17 00:00:00 2001 +From: Matthieu Herrb <matthieu@bluenote.herrb.com> +Date: Thu, 17 Jan 2008 15:26:41 +0100 +Subject: [PATCH] Fix for CVE-2007-5760 - XFree86 Misc extension out of bounds array index + +--- + hw/xfree86/common/xf86MiscExt.c | 4 ++++ + 1 files changed, 4 insertions(+), 0 deletions(-) + +diff --git a/hw/xfree86/common/xf86MiscExt.c b/hw/xfree86/common/xf86MiscExt.c +index c1b9c60..40c196a 100644 +--- a/hw/xfree86/common/xf86MiscExt.c ++++ b/hw/xfree86/common/xf86MiscExt.c +@@ -548,6 +548,10 @@ MiscExtPassMessage(int scrnIndex, const char *msgtype, const char *msgval, + { + ScrnInfoPtr pScr = xf86Screens[scrnIndex]; + ++ /* should check this in the protocol, but xf86NumScreens isn't exported */ ++ if (scrnIndex >= xf86NumScreens) ++ return BadValue; ++ + if (*pScr->HandleMessage == NULL) + return BadImplementation; + return (*pScr->HandleMessage)(scrnIndex, msgtype, msgval, retstr); +-- +1.5.3.5 + diff --git a/x11-base/xorg-server/files/1.4-0002-Fix-for-CVE-2007-6428-TOG-cup-extension-memory-cor.patch b/x11-base/xorg-server/files/1.4-0002-Fix-for-CVE-2007-6428-TOG-cup-extension-memory-cor.patch new file mode 100644 index 0000000..a72ce3c --- /dev/null +++ b/x11-base/xorg-server/files/1.4-0002-Fix-for-CVE-2007-6428-TOG-cup-extension-memory-cor.patch @@ -0,0 +1,26 @@ +From 4848d49d05a318559afe7a17a19ba055947ee1f5 Mon Sep 17 00:00:00 2001 +From: Matthieu Herrb <matthieu@bluenote.herrb.com> +Date: Thu, 17 Jan 2008 15:28:03 +0100 +Subject: [PATCH] Fix for CVE-2007-6428 - TOG-cup extension memory corruption. + +--- + Xext/cup.c | 3 +++ + 1 files changed, 3 insertions(+), 0 deletions(-) + +diff --git a/Xext/cup.c b/Xext/cup.c +index 6bfa278..781b9ce 100644 +--- a/Xext/cup.c ++++ b/Xext/cup.c +@@ -196,6 +196,9 @@ int ProcGetReservedColormapEntries( + + REQUEST_SIZE_MATCH (xXcupGetReservedColormapEntriesReq); + ++ if (stuff->screen >= screenInfo.numScreens) ++ return BadValue; ++ + #ifndef HAVE_SPECIAL_DESKTOP_COLORS + citems[CUP_BLACK_PIXEL].pixel = + screenInfo.screens[stuff->screen]->blackPixel; +-- +1.5.3.5 + diff --git a/x11-base/xorg-server/files/1.4-0003-Fix-for-CVE-2007-6427-Xinput-extension-memory-corr.patch b/x11-base/xorg-server/files/1.4-0003-Fix-for-CVE-2007-6427-Xinput-extension-memory-corr.patch new file mode 100644 index 0000000..ffbf8ac --- /dev/null +++ b/x11-base/xorg-server/files/1.4-0003-Fix-for-CVE-2007-6427-Xinput-extension-memory-corr.patch @@ -0,0 +1,262 @@ +From d244c8272e0ac47c41a9416e37293903b842a78b Mon Sep 17 00:00:00 2001 +From: Matthieu Herrb <matthieu@bluenote.herrb.com> +Date: Thu, 17 Jan 2008 15:27:34 +0100 +Subject: [PATCH] Fix for CVE-2007-6427 - Xinput extension memory corruption. + +--- + Xi/chgfctl.c | 7 +------ + Xi/chgkmap.c | 13 ++++++------- + Xi/chgprop.c | 10 +++------- + Xi/grabdev.c | 12 +++++------- + Xi/grabdevb.c | 10 +++------- + Xi/grabdevk.c | 9 ++------- + Xi/selectev.c | 11 ++++------- + Xi/sendexev.c | 14 ++++++++------ + 8 files changed, 32 insertions(+), 54 deletions(-) + +diff --git a/Xi/chgfctl.c b/Xi/chgfctl.c +index 2e0e13c..235d659 100644 +--- a/Xi/chgfctl.c ++++ b/Xi/chgfctl.c +@@ -327,18 +327,13 @@ ChangeStringFeedback(ClientPtr client, DeviceIntPtr dev, + xStringFeedbackCtl * f) + { + char n; +- long *p; + int i, j; + KeySym *syms, *sup_syms; + + syms = (KeySym *) (f + 1); + if (client->swapped) { + swaps(&f->length, n); /* swapped num_keysyms in calling proc */ +- p = (long *)(syms); +- for (i = 0; i < f->num_keysyms; i++) { +- swapl(p, n); +- p++; +- } ++ SwapLongs((CARD32 *) syms, f->num_keysyms); + } + + if (f->num_keysyms > s->ctrl.max_symbols) { +diff --git a/Xi/chgkmap.c b/Xi/chgkmap.c +index eac520f..f8f85bc 100644 +--- a/Xi/chgkmap.c ++++ b/Xi/chgkmap.c +@@ -79,18 +79,14 @@ int + SProcXChangeDeviceKeyMapping(ClientPtr client) + { + char n; +- long *p; +- int i, count; ++ unsigned int count; + + REQUEST(xChangeDeviceKeyMappingReq); + swaps(&stuff->length, n); + REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq); +- p = (long *)&stuff[1]; + count = stuff->keyCodes * stuff->keySymsPerKeyCode; +- for (i = 0; i < count; i++) { +- swapl(p, n); +- p++; +- } ++ REQUEST_FIXED_SIZE(xChangeDeviceKeyMappingReq, count * sizeof(CARD32)); ++ SwapLongs((CARD32 *) (&stuff[1]), count); + return (ProcXChangeDeviceKeyMapping(client)); + } + +@@ -106,10 +102,13 @@ ProcXChangeDeviceKeyMapping(ClientPtr client) + int ret; + unsigned len; + DeviceIntPtr dev; ++ unsigned int count; + + REQUEST(xChangeDeviceKeyMappingReq); + REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq); + ++ count = stuff->keyCodes * stuff->keySymsPerKeyCode; ++ REQUEST_FIXED_SIZE(xChangeDeviceKeyMappingReq, count * sizeof(CARD32)); + dev = LookupDeviceIntRec(stuff->deviceid); + if (dev == NULL) { + SendErrorToClient(client, IReqCode, X_ChangeDeviceKeyMapping, 0, +diff --git a/Xi/chgprop.c b/Xi/chgprop.c +index 59a93c6..21bda5b 100644 +--- a/Xi/chgprop.c ++++ b/Xi/chgprop.c +@@ -81,19 +81,15 @@ int + SProcXChangeDeviceDontPropagateList(ClientPtr client) + { + char n; +- long *p; +- int i; + + REQUEST(xChangeDeviceDontPropagateListReq); + swaps(&stuff->length, n); + REQUEST_AT_LEAST_SIZE(xChangeDeviceDontPropagateListReq); + swapl(&stuff->window, n); + swaps(&stuff->count, n); +- p = (long *)&stuff[1]; +- for (i = 0; i < stuff->count; i++) { +- swapl(p, n); +- p++; +- } ++ REQUEST_FIXED_SIZE(xChangeDeviceDontPropagateListReq, ++ stuff->count * sizeof(CARD32)); ++ SwapLongs((CARD32 *) (&stuff[1]), stuff->count); + return (ProcXChangeDeviceDontPropagateList(client)); + } + +diff --git a/Xi/grabdev.c b/Xi/grabdev.c +index e2809ef..d0b4ae7 100644 +--- a/Xi/grabdev.c ++++ b/Xi/grabdev.c +@@ -82,8 +82,6 @@ int + SProcXGrabDevice(ClientPtr client) + { + char n; +- long *p; +- int i; + + REQUEST(xGrabDeviceReq); + swaps(&stuff->length, n); +@@ -91,11 +89,11 @@ SProcXGrabDevice(ClientPtr client) + swapl(&stuff->grabWindow, n); + swapl(&stuff->time, n); + swaps(&stuff->event_count, n); +- p = (long *)&stuff[1]; +- for (i = 0; i < stuff->event_count; i++) { +- swapl(p, n); +- p++; +- } ++ ++ if (stuff->length != (sizeof(xGrabDeviceReq) >> 2) + stuff->event_count) ++ return BadLength; ++ ++ SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count); + + return (ProcXGrabDevice(client)); + } +diff --git a/Xi/grabdevb.c b/Xi/grabdevb.c +index df62d0c..18db1f7 100644 +--- a/Xi/grabdevb.c ++++ b/Xi/grabdevb.c +@@ -80,8 +80,6 @@ int + SProcXGrabDeviceButton(ClientPtr client) + { + char n; +- long *p; +- int i; + + REQUEST(xGrabDeviceButtonReq); + swaps(&stuff->length, n); +@@ -89,11 +87,9 @@ SProcXGrabDeviceButton(ClientPtr client) + swapl(&stuff->grabWindow, n); + swaps(&stuff->modifiers, n); + swaps(&stuff->event_count, n); +- p = (long *)&stuff[1]; +- for (i = 0; i < stuff->event_count; i++) { +- swapl(p, n); +- p++; +- } ++ REQUEST_FIXED_SIZE(xGrabDeviceButtonReq, ++ stuff->event_count * sizeof(CARD32)); ++ SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count); + + return (ProcXGrabDeviceButton(client)); + } +diff --git a/Xi/grabdevk.c b/Xi/grabdevk.c +index b74592f..429b2f7 100644 +--- a/Xi/grabdevk.c ++++ b/Xi/grabdevk.c +@@ -80,8 +80,6 @@ int + SProcXGrabDeviceKey(ClientPtr client) + { + char n; +- long *p; +- int i; + + REQUEST(xGrabDeviceKeyReq); + swaps(&stuff->length, n); +@@ -89,11 +87,8 @@ SProcXGrabDeviceKey(ClientPtr client) + swapl(&stuff->grabWindow, n); + swaps(&stuff->modifiers, n); + swaps(&stuff->event_count, n); +- p = (long *)&stuff[1]; +- for (i = 0; i < stuff->event_count; i++) { +- swapl(p, n); +- p++; +- } ++ REQUEST_FIXED_SIZE(xGrabDeviceKeyReq, stuff->event_count * sizeof(CARD32)); ++ SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count); + return (ProcXGrabDeviceKey(client)); + } + +diff --git a/Xi/selectev.c b/Xi/selectev.c +index d52db1b..19415c5 100644 +--- a/Xi/selectev.c ++++ b/Xi/selectev.c +@@ -131,19 +131,16 @@ int + SProcXSelectExtensionEvent(ClientPtr client) + { + char n; +- long *p; +- int i; + + REQUEST(xSelectExtensionEventReq); + swaps(&stuff->length, n); + REQUEST_AT_LEAST_SIZE(xSelectExtensionEventReq); + swapl(&stuff->window, n); + swaps(&stuff->count, n); +- p = (long *)&stuff[1]; +- for (i = 0; i < stuff->count; i++) { +- swapl(p, n); +- p++; +- } ++ REQUEST_FIXED_SIZE(xSelectExtensionEventReq, ++ stuff->count * sizeof(CARD32)); ++ SwapLongs((CARD32 *) (&stuff[1]), stuff->count); ++ + return (ProcXSelectExtensionEvent(client)); + } + +diff --git a/Xi/sendexev.c b/Xi/sendexev.c +index eac9abe..9803cf3 100644 +--- a/Xi/sendexev.c ++++ b/Xi/sendexev.c +@@ -83,7 +83,7 @@ int + SProcXSendExtensionEvent(ClientPtr client) + { + char n; +- long *p; ++ CARD32 *p; + int i; + xEvent eventT; + xEvent *eventP; +@@ -94,6 +94,11 @@ SProcXSendExtensionEvent(ClientPtr client) + REQUEST_AT_LEAST_SIZE(xSendExtensionEventReq); + swapl(&stuff->destination, n); + swaps(&stuff->count, n); ++ ++ if (stuff->length != (sizeof(xSendExtensionEventReq) >> 2) + stuff->count + ++ (stuff->num_events * (sizeof(xEvent) >> 2))) ++ return BadLength; ++ + eventP = (xEvent *) & stuff[1]; + for (i = 0; i < stuff->num_events; i++, eventP++) { + proc = EventSwapVector[eventP->u.u.type & 0177]; +@@ -103,11 +108,8 @@ SProcXSendExtensionEvent(ClientPtr client) + *eventP = eventT; + } + +- p = (long *)(((xEvent *) & stuff[1]) + stuff->num_events); +- for (i = 0; i < stuff->count; i++) { +- swapl(p, n); +- p++; +- } ++ p = (CARD32 *)(((xEvent *) & stuff[1]) + stuff->num_events); ++ SwapLongs(p, stuff->count); + return (ProcXSendExtensionEvent(client)); + } + +-- +1.5.3.5 + diff --git a/x11-base/xorg-server/files/1.4-0004-Fix-for-CVE-2007-6429-MIT-SHM-and-EVI-extensions-i.patch b/x11-base/xorg-server/files/1.4-0004-Fix-for-CVE-2007-6429-MIT-SHM-and-EVI-extensions-i.patch new file mode 100644 index 0000000..ac66b4d --- /dev/null +++ b/x11-base/xorg-server/files/1.4-0004-Fix-for-CVE-2007-6429-MIT-SHM-and-EVI-extensions-i.patch @@ -0,0 +1,210 @@ +From 8b14f7b74284900b95a319ec80c4333e63af2296 Mon Sep 17 00:00:00 2001 +From: Matthieu Herrb <matthieu@bluenote.herrb.com> +Date: Thu, 17 Jan 2008 15:28:42 +0100 +Subject: [PATCH] Fix for CVE-2007-6429 - MIT-SHM and EVI extensions integer overflows. + +--- + Xext/EVI.c | 15 ++++++++++++++- + Xext/sampleEVI.c | 29 ++++++++++++++++++++++++----- + Xext/shm.c | 46 ++++++++++++++++++++++++++++++++++++++-------- + 3 files changed, 76 insertions(+), 14 deletions(-) + +diff --git a/Xext/EVI.c b/Xext/EVI.c +index 8fe3481..13bd32a 100644 +--- a/Xext/EVI.c ++++ b/Xext/EVI.c +@@ -34,6 +34,7 @@ THE USE OR PERFORMANCE OF THIS SOFTWARE. + #include <X11/extensions/XEVIstr.h> + #include "EVIstruct.h" + #include "modinit.h" ++#include "scrnintstr.h" + + #if 0 + static unsigned char XEVIReqCode = 0; +@@ -87,10 +88,22 @@ ProcEVIGetVisualInfo(ClientPtr client) + { + REQUEST(xEVIGetVisualInfoReq); + xEVIGetVisualInfoReply rep; +- int n, n_conflict, n_info, sz_info, sz_conflict; ++ int i, n, n_conflict, n_info, sz_info, sz_conflict; + VisualID32 *conflict; ++ unsigned int total_visuals = 0; + xExtendedVisualInfo *eviInfo; + int status; ++ ++ /* ++ * do this first, otherwise REQUEST_FIXED_SIZE can overflow. we assume ++ * here that you don't have more than 2^32 visuals over all your screens; ++ * this seems like a safe assumption. ++ */ ++ for (i = 0; i < screenInfo.numScreens; i++) ++ total_visuals += screenInfo.screens[i]->numVisuals; ++ if (stuff->n_visual > total_visuals) ++ return BadValue; ++ + REQUEST_FIXED_SIZE(xEVIGetVisualInfoReq, stuff->n_visual * sz_VisualID32); + status = eviPriv->getVisualInfo((VisualID32 *)&stuff[1], (int)stuff->n_visual, + &eviInfo, &n_info, &conflict, &n_conflict); +diff --git a/Xext/sampleEVI.c b/Xext/sampleEVI.c +index 7508aa7..b871bfd 100644 +--- a/Xext/sampleEVI.c ++++ b/Xext/sampleEVI.c +@@ -34,6 +34,13 @@ THE USE OR PERFORMANCE OF THIS SOFTWARE. + #include <X11/extensions/XEVIstr.h> + #include "EVIstruct.h" + #include "scrnintstr.h" ++ ++#if HAVE_STDINT_H ++#include <stdint.h> ++#elif !defined(UINT32_MAX) ++#define UINT32_MAX 0xffffffffU ++#endif ++ + static int sampleGetVisualInfo( + VisualID32 *visual, + int n_visual, +@@ -42,24 +49,36 @@ static int sampleGetVisualInfo( + VisualID32 **conflict_rn, + int *n_conflict_rn) + { +- int max_sz_evi = n_visual * sz_xExtendedVisualInfo * screenInfo.numScreens; ++ unsigned int max_sz_evi; + VisualID32 *temp_conflict; + xExtendedVisualInfo *evi; +- int max_visuals = 0, max_sz_conflict, sz_conflict = 0; ++ unsigned int max_visuals = 0, max_sz_conflict, sz_conflict = 0; + register int visualI, scrI, sz_evi = 0, conflictI, n_conflict; +- *evi_rn = evi = (xExtendedVisualInfo *)xalloc(max_sz_evi); +- if (!*evi_rn) +- return BadAlloc; ++ ++ if (n_visual > UINT32_MAX/(sz_xExtendedVisualInfo * screenInfo.numScreens)) ++ return BadAlloc; ++ max_sz_evi = n_visual * sz_xExtendedVisualInfo * screenInfo.numScreens; ++ + for (scrI = 0; scrI < screenInfo.numScreens; scrI++) { + if (screenInfo.screens[scrI]->numVisuals > max_visuals) + max_visuals = screenInfo.screens[scrI]->numVisuals; + } ++ ++ if (n_visual > UINT32_MAX/(sz_VisualID32 * screenInfo.numScreens ++ * max_visuals)) ++ return BadAlloc; + max_sz_conflict = n_visual * sz_VisualID32 * screenInfo.numScreens * max_visuals; ++ ++ *evi_rn = evi = (xExtendedVisualInfo *)xalloc(max_sz_evi); ++ if (!*evi_rn) ++ return BadAlloc; ++ + temp_conflict = (VisualID32 *)xalloc(max_sz_conflict); + if (!temp_conflict) { + xfree(*evi_rn); + return BadAlloc; + } ++ + for (scrI = 0; scrI < screenInfo.numScreens; scrI++) { + for (visualI = 0; visualI < n_visual; visualI++) { + evi[sz_evi].core_visual_id = visual[visualI]; +diff --git a/Xext/shm.c b/Xext/shm.c +index ac587be..5633be9 100644 +--- a/Xext/shm.c ++++ b/Xext/shm.c +@@ -711,6 +711,8 @@ ProcPanoramiXShmCreatePixmap( + int i, j, result, rc; + ShmDescPtr shmdesc; + REQUEST(xShmCreatePixmapReq); ++ unsigned int width, height, depth; ++ unsigned long size; + PanoramiXRes *newPix; + + REQUEST_SIZE_MATCH(xShmCreatePixmapReq); +@@ -724,11 +726,26 @@ ProcPanoramiXShmCreatePixmap( + return rc; + + VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client); +- if (!stuff->width || !stuff->height) ++ ++ width = stuff->width; ++ height = stuff->height; ++ depth = stuff->depth; ++ if (!width || !height || !depth) + { + client->errorValue = 0; + return BadValue; + } ++ if (width > 32767 || height > 32767) ++ return BadAlloc; ++ size = PixmapBytePad(width, depth) * height; ++ if (sizeof(size) == 4) { ++ if (size < width * height) ++ return BadAlloc; ++ /* thankfully, offset is unsigned */ ++ if (stuff->offset + size < size) ++ return BadAlloc; ++ } ++ + if (stuff->depth != 1) + { + pDepth = pDraw->pScreen->allowedDepths; +@@ -739,9 +756,7 @@ ProcPanoramiXShmCreatePixmap( + return BadValue; + } + CreatePmap: +- VERIFY_SHMSIZE(shmdesc, stuff->offset, +- PixmapBytePad(stuff->width, stuff->depth) * stuff->height, +- client); ++ VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client); + + if(!(newPix = (PanoramiXRes *) xalloc(sizeof(PanoramiXRes)))) + return BadAlloc; +@@ -1040,6 +1055,8 @@ ProcShmCreatePixmap(client) + register int i, rc; + ShmDescPtr shmdesc; + REQUEST(xShmCreatePixmapReq); ++ unsigned int width, height, depth; ++ unsigned long size; + + REQUEST_SIZE_MATCH(xShmCreatePixmapReq); + client->errorValue = stuff->pid; +@@ -1052,11 +1069,26 @@ ProcShmCreatePixmap(client) + return rc; + + VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client); +- if (!stuff->width || !stuff->height) ++ ++ width = stuff->width; ++ height = stuff->height; ++ depth = stuff->depth; ++ if (!width || !height || !depth) + { + client->errorValue = 0; + return BadValue; + } ++ if (width > 32767 || height > 32767) ++ return BadAlloc; ++ size = PixmapBytePad(width, depth) * height; ++ if (sizeof(size) == 4) { ++ if (size < width * height) ++ return BadAlloc; ++ /* thankfully, offset is unsigned */ ++ if (stuff->offset + size < size) ++ return BadAlloc; ++ } ++ + if (stuff->depth != 1) + { + pDepth = pDraw->pScreen->allowedDepths; +@@ -1067,9 +1099,7 @@ ProcShmCreatePixmap(client) + return BadValue; + } + CreatePmap: +- VERIFY_SHMSIZE(shmdesc, stuff->offset, +- PixmapBytePad(stuff->width, stuff->depth) * stuff->height, +- client); ++ VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client); + pMap = (*shmFuncs[pDraw->pScreen->myNum]->CreatePixmap)( + pDraw->pScreen, stuff->width, + stuff->height, stuff->depth, +-- +1.5.3.5 + diff --git a/x11-base/xorg-server/files/1.4-0005-Fix-for-CVE-2008-0006-PCF-Font-parser-buffer-overf.patch b/x11-base/xorg-server/files/1.4-0005-Fix-for-CVE-2008-0006-PCF-Font-parser-buffer-overf.patch new file mode 100644 index 0000000..bb09eb8 --- /dev/null +++ b/x11-base/xorg-server/files/1.4-0005-Fix-for-CVE-2008-0006-PCF-Font-parser-buffer-overf.patch @@ -0,0 +1,30 @@ +From f09b8007e7f6e60e0b9c9665ec632b578ae08b6f Mon Sep 17 00:00:00 2001 +From: Matthieu Herrb <matthieu@bluenote.herrb.com> +Date: Thu, 17 Jan 2008 15:29:06 +0100 +Subject: [PATCH] Fix for CVE-2008-0006 - PCF Font parser buffer overflow. + +--- + dix/dixfonts.c | 7 +++++++ + 1 files changed, 7 insertions(+), 0 deletions(-) + +diff --git a/dix/dixfonts.c b/dix/dixfonts.c +index c21b3ec..7bb2404 100644 +--- a/dix/dixfonts.c ++++ b/dix/dixfonts.c +@@ -325,6 +325,13 @@ doOpenFont(ClientPtr client, OFclosurePtr c) + err = BadFontName; + goto bail; + } ++ /* check values for firstCol, lastCol, firstRow, and lastRow */ ++ if (pfont->info.firstCol > pfont->info.lastCol || ++ pfont->info.firstRow > pfont->info.lastRow || ++ pfont->info.lastCol - pfont->info.firstCol > 255) { ++ err = AllocError; ++ goto bail; ++ } + if (!pfont->fpe) + pfont->fpe = fpe; + pfont->refcnt++; +-- +1.5.3.5 + diff --git a/x11-base/xorg-server/files/1.4-0006-Fix-for-CVE-2007-5958-File-existence-disclosure.patch b/x11-base/xorg-server/files/1.4-0006-Fix-for-CVE-2007-5958-File-existence-disclosure.patch new file mode 100644 index 0000000..61cc4da --- /dev/null +++ b/x11-base/xorg-server/files/1.4-0006-Fix-for-CVE-2007-5958-File-existence-disclosure.patch @@ -0,0 +1,34 @@ +From 19b95cdd1d14a1e7d1abba1880ab023c96f19bf5 Mon Sep 17 00:00:00 2001 +From: Matthieu Herrb <matthieu@bluenote.herrb.com> +Date: Thu, 17 Jan 2008 17:03:39 +0100 +Subject: [PATCH] Fix for CVE-2007-5958 - File existence disclosure. + +--- + Xext/security.c | 4 ++-- + 1 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/Xext/security.c b/Xext/security.c +index ba057de..e9d48c9 100644 +--- a/Xext/security.c ++++ b/Xext/security.c +@@ -1563,7 +1563,7 @@ SecurityLoadPropertyAccessList(void) + if (!SecurityPolicyFile) + return; + +- f = fopen(SecurityPolicyFile, "r"); ++ f = Fopen(SecurityPolicyFile, "r"); + if (!f) + { + ErrorF("error opening security policy file %s\n", +@@ -1646,7 +1646,7 @@ SecurityLoadPropertyAccessList(void) + } + #endif /* PROPDEBUG */ + +- fclose(f); ++ Fclose(f); + } /* SecurityLoadPropertyAccessList */ + + +-- +1.5.3.5 + diff --git a/x11-base/xorg-server/files/1.4-0007-CVE-2007-6429-Don-t-spuriously-reject-8bpp-shm-pix.patch b/x11-base/xorg-server/files/1.4-0007-CVE-2007-6429-Don-t-spuriously-reject-8bpp-shm-pix.patch new file mode 100644 index 0000000..903f2be --- /dev/null +++ b/x11-base/xorg-server/files/1.4-0007-CVE-2007-6429-Don-t-spuriously-reject-8bpp-shm-pix.patch @@ -0,0 +1,85 @@ +From e9fa7c1c88a8130a48f772c92b186b8b777986b5 Mon Sep 17 00:00:00 2001 +From: Adam Jackson <ajax@redhat.com> +Date: Fri, 18 Jan 2008 14:41:20 -0500 +Subject: [PATCH] CVE-2007-6429: Don't spuriously reject <8bpp shm pixmaps. + +Move size validation after depth validation, and only validate size if +the bpp of the pixmap format is > 8. If bpp < 8 then we're already +protected from overflow by the width and height checks. +--- + Xext/shm.c | 36 ++++++++++++++++++++---------------- + 1 files changed, 20 insertions(+), 16 deletions(-) + +diff --git a/Xext/shm.c b/Xext/shm.c +index c545e49..e46f6fc 100644 +--- a/Xext/shm.c ++++ b/Xext/shm.c +@@ -783,14 +783,6 @@ ProcPanoramiXShmCreatePixmap( + } + if (width > 32767 || height > 32767) + return BadAlloc; +- size = PixmapBytePad(width, depth) * height; +- if (sizeof(size) == 4) { +- if (size < width * height) +- return BadAlloc; +- /* thankfully, offset is unsigned */ +- if (stuff->offset + size < size) +- return BadAlloc; +- } + + if (stuff->depth != 1) + { +@@ -801,7 +793,17 @@ ProcPanoramiXShmCreatePixmap( + client->errorValue = stuff->depth; + return BadValue; + } ++ + CreatePmap: ++ size = PixmapBytePad(width, depth) * height; ++ if (sizeof(size) == 4 && BitsPerPixel(depth) > 8) { ++ if (size < width * height) ++ return BadAlloc; ++ /* thankfully, offset is unsigned */ ++ if (stuff->offset + size < size) ++ return BadAlloc; ++ } ++ + VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client); + + if(!(newPix = (PanoramiXRes *) xalloc(sizeof(PanoramiXRes)))) +@@ -1126,14 +1128,6 @@ ProcShmCreatePixmap(client) + } + if (width > 32767 || height > 32767) + return BadAlloc; +- size = PixmapBytePad(width, depth) * height; +- if (sizeof(size) == 4) { +- if (size < width * height) +- return BadAlloc; +- /* thankfully, offset is unsigned */ +- if (stuff->offset + size < size) +- return BadAlloc; +- } + + if (stuff->depth != 1) + { +@@ -1144,7 +1138,17 @@ ProcShmCreatePixmap(client) + client->errorValue = stuff->depth; + return BadValue; + } ++ + CreatePmap: ++ size = PixmapBytePad(width, depth) * height; ++ if (sizeof(size) == 4 && BitsPerPixel(depth) > 8) { ++ if (size < width * height) ++ return BadAlloc; ++ /* thankfully, offset is unsigned */ ++ if (stuff->offset + size < size) ++ return BadAlloc; ++ } ++ + VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client); + pMap = (*shmFuncs[pDraw->pScreen->myNum]->CreatePixmap)( + pDraw->pScreen, stuff->width, +-- +1.5.3.8 + diff --git a/x11-base/xorg-server/files/1.4-0008-CVE-2007-6429-Always-test-for-size-offset-wrapping.patch b/x11-base/xorg-server/files/1.4-0008-CVE-2007-6429-Always-test-for-size-offset-wrapping.patch new file mode 100644 index 0000000..6e5baf1 --- /dev/null +++ b/x11-base/xorg-server/files/1.4-0008-CVE-2007-6429-Always-test-for-size-offset-wrapping.patch @@ -0,0 +1,44 @@ +From be6c17fcf9efebc0bbcc3d9a25f8c5a2450c2161 Mon Sep 17 00:00:00 2001 +From: Matthias Hopf <mhopf@suse.de> +Date: Mon, 21 Jan 2008 16:13:21 +0100 +Subject: [PATCH] CVE-2007-6429: Always test for size+offset wrapping. + +--- + Xext/shm.c | 12 ++++++------ + 1 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/Xext/shm.c b/Xext/shm.c +index e46f6fc..a7a1ecf 100644 +--- a/Xext/shm.c ++++ b/Xext/shm.c +@@ -799,10 +799,10 @@ CreatePmap: + if (sizeof(size) == 4 && BitsPerPixel(depth) > 8) { + if (size < width * height) + return BadAlloc; +- /* thankfully, offset is unsigned */ +- if (stuff->offset + size < size) +- return BadAlloc; + } ++ /* thankfully, offset is unsigned */ ++ if (stuff->offset + size < size) ++ return BadAlloc; + + VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client); + +@@ -1144,10 +1144,10 @@ CreatePmap: + if (sizeof(size) == 4 && BitsPerPixel(depth) > 8) { + if (size < width * height) + return BadAlloc; +- /* thankfully, offset is unsigned */ +- if (stuff->offset + size < size) +- return BadAlloc; + } ++ /* thankfully, offset is unsigned */ ++ if (stuff->offset + size < size) ++ return BadAlloc; + + VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client); + pMap = (*shmFuncs[pDraw->pScreen->myNum]->CreatePixmap)( +-- +1.5.3.8 + diff --git a/x11-base/xorg-server/files/1.4-0009-Don-t-break-grab-and-focus-state-for-a-window-when-r.patch b/x11-base/xorg-server/files/1.4-0009-Don-t-break-grab-and-focus-state-for-a-window-when-r.patch new file mode 100644 index 0000000..3a8dbd9 --- /dev/null +++ b/x11-base/xorg-server/files/1.4-0009-Don-t-break-grab-and-focus-state-for-a-window-when-r.patch @@ -0,0 +1,40 @@ +From a6a7fadbb03ee99312dfb15ac478ab3c414c1c0b Mon Sep 17 00:00:00 2001 +From: =?utf-8?q?Kristian=20H=C3=B8gsberg?= <krh@redhat.com> +Date: Wed, 16 Jan 2008 20:24:11 -0500 +Subject: [PATCH] Don't break grab and focus state for a window when redirecting it. + +Composite uses an unmap/map cycle to trigger backing pixmap allocation +and cliprect recomputation when a window is redirected or unredirected. +To avoid protocol visible side effects, map and unmap events are +disabled temporarily. However, when a window is unmapped it is also +removed from grabs and loses focus, but these state changes are not +disabled. + +This change supresses the unmap side effects during the composite +unmap/map cycle and fixes this bug: + + http://bugzilla.gnome.org/show_bug.cgi?id=488264 + +where compiz would cause gnome-screensaver to lose its grab when +compiz unredirects the fullscreen lock window. +--- + dix/window.c | 3 ++- + 1 files changed, 2 insertions(+), 1 deletions(-) + +diff --git a/dix/window.c b/dix/window.c +index 33cf76b..1ccf126 100644 +--- a/dix/window.c ++++ b/dix/window.c +@@ -2993,7 +2993,8 @@ UnrealizeTree( + } + #endif + (* Unrealize)(pChild); +- DeleteWindowFromAnyEvents(pChild, FALSE); ++ if (MapUnmapEventsEnabled(pWin)) ++ DeleteWindowFromAnyEvents(pChild, FALSE); + if (pChild->viewable) + { + #ifdef DO_SAVE_UNDERS +-- +1.5.3.8 + diff --git a/x11-base/xorg-server/files/1.4-document-new-font-catalogs.patch b/x11-base/xorg-server/files/1.4-document-new-font-catalogs.patch new file mode 100644 index 0000000..e9a6aad --- /dev/null +++ b/x11-base/xorg-server/files/1.4-document-new-font-catalogs.patch @@ -0,0 +1,132 @@ +diff --git a/doc/Xserver.man.pre b/doc/Xserver.man.pre +index aac3b51..c9ee019 100644 +--- a/doc/Xserver.man.pre ++++ b/doc/Xserver.man.pre +@@ -508,8 +508,7 @@ its parent process after it has set up the various connection schemes. + \fIXdm\fP uses this feature to recognize when connecting to the server + is possible. + .SH FONTS +-The X server +-can obtain fonts from directories and/or from font servers. ++The X server can obtain fonts from directories and/or from font servers. + The list of directories and font servers + the X server uses when trying to open a font is controlled + by the \fIfont path\fP. +@@ -517,8 +516,45 @@ by the \fIfont path\fP. + The default font path is + __default_font_path__ . + .LP ++A special kind of directory can be specified using the the \fBcatalogue\fP: ++prefix. Directories specified this way can contain symlinks pointing to the ++real font directories. See the FONTPATH.D section for details. ++.LP + The font path can be set with the \fB\-fp\fP option or by \fIxset\fP(1) + after the server has started. ++.SH "FONTPATH.D" ++You can specify a special kind of font path in the form \fBcatalogue:<dir>\fR. ++The directory specified after the catalogue: prefix will be scanned for symlinks ++and each symlink destination will be added as a local fontfile FPE. ++.PP ++The symlink can be suffixed by attributes such as '\fBunscaled\fR', which ++will be passed through to the underlying fontfile FPE. The only exception is ++the newly introduced '\fBpri\fR' attribute, which will be used for ordering ++the font paths specified by the symlinks. ++ ++An example configuration: ++ ++.nf ++ 75dpi:unscaled:pri=20 \-> /usr/share/X11/fonts/75dpi ++ ghostscript:pri=60 \-> /usr/share/fonts/default/ghostscript ++ misc:unscaled:pri=10 \-> /usr/share/X11/fonts/misc ++ type1:pri=40 \-> /usr/share/X11/fonts/Type1 ++ type1:pri=50 \-> /usr/share/fonts/default/Type1 ++.fi ++ ++This will add /usr/share/X11/fonts/misc as the first FPE with the attribute ++'unscaled', second FPE will be /usr/share/X11/fonts/75dpi, also with ++the attribute unscaled etc. This is functionally equivalent to setting ++the following font path: ++ ++.nf ++ /usr/share/X11/fonts/misc:unscaled, ++ /usr/share/X11/fonts/75dpi:unscaled, ++ /usr/share/X11/fonts/Type1, ++ /usr/share/fonts/default/Type1, ++ /usr/share/fonts/default/ghostscript ++.fi ++ + .SH FILES + .TP 30 + .I /etc/X\fBn\fP.hosts +diff --git a/hw/xfree86/doc/man/xorg.conf.man.pre b/hw/xfree86/doc/man/xorg.conf.man.pre +index ce54ea9..54d8eaa 100644 +--- a/hw/xfree86/doc/man/xorg.conf.man.pre ++++ b/hw/xfree86/doc/man/xorg.conf.man.pre +@@ -293,15 +293,50 @@ server searches for font databases. + Multiple + .B FontPath + entries may be specified, and they will be concatenated to build up the +-fontpath used by the server. Font path elements may be either absolute +-directory paths, or a font server identifier. ++fontpath used by the server. Font path elements can be absolute ++directory paths, catalogue directories or a font server identifier. The ++formats of the later two are explained below: ++.PP ++.RS 7 ++Catalogue directories: ++.PP ++.RS 4 ++Catalogue directories can be specified using the prefix \fBcatalogue:\fR ++before the directory name. The directory can then be populated with ++symlinks pointing to the real font directories, using the following ++syntax in the symlink name: ++.PP ++.RS 4 ++.IR <identifier> : [attribute]: pri= <priority> ++.RE ++.PP ++where ++.I <identifier> ++is an alphanumeric identifier, ++.I [attribute] ++is an attribute wich will be passed to the underlying FPE and ++.I <priority> ++is a number used to order the fontfile FPEs. Examples: ++.PP ++.RS 4 ++.nf ++.I 75dpi:unscaled:pri=20 -> /usr/share/X11/fonts/75dpi ++.I gscript:pri=60 -> /usr/share/fonts/default/ghostscript ++.I misc:unscaled:pri=10 \-> /usr/share/X11/fonts/misc ++.fi ++.PP ++.RE .RE .RE ++.PP ++.RS 7 ++Font server identifiers: ++.PP ++.RS 4 + Font server identifiers have the form: ++.RS 4 + .PP +-.RS 11 + .IR <trans> / <hostname> : <port\-number> + .RE + .PP +-.RS 7 + where + .I <trans> + is the transport type to use to connect to the font server (e.g., +@@ -313,10 +348,11 @@ for a TCP/IP connection), + is the hostname of the machine running the font server, and + .I <port\-number> + is the port number that the font server is listening on (usually 7100). ++.RE + .PP + When this entry is not specified in the config file, the server falls back + to the compiled\-in default font path, which contains the following +-font path elements: ++font path elements (which can be set inside a catalogue directory): + .PP + .RS 4 + .nf diff --git a/x11-base/xorg-server/files/1.4-dont-hang-openoffice.patch b/x11-base/xorg-server/files/1.4-dont-hang-openoffice.patch new file mode 100644 index 0000000..9ec79fd --- /dev/null +++ b/x11-base/xorg-server/files/1.4-dont-hang-openoffice.patch @@ -0,0 +1,71 @@ +Title : x11-base/xorg-server-1.3 and 1.4 consumes 100% CPU, locking the ke +yboard, apparently triggered by opening an OpenOffice pulldown menu +Assignee : x11@gentoo.org +Reported : 2007-10-26 03:51 0000 +Updated : 2007-11-07 07:21:56 0000 +Status : NEW +URL : https://bugs.freedesktop.org/show_bug.cgi?id=10525 +Severity : critical +Priority : P2 +Reporter : smw@alcor.concordia.ca +Product : Gentoo Linux +Component : Server +Keywords : Inclusion +CC : tetromino@gmail.com +Comments : 3 +Attachments : 0 +URL : http://bugs.gentoo.org/show_bug.cgi?id=197104 + +commit a5b8053606d6e786cdcf6734f271acc05f9cc588 +Author: Adam Jackson <ajax@benzedrine.nwnk.net> +Date: Tue Sep 11 11:37:06 2007 -0400 + + Ignore - not just block - SIGALRM around Popen()/Pclose(). + + Because our "popen" implementation uses stdio, and because nobody's stdio + library is capable of surviving signals, we need to make absolutely sure + that we hide the SIGALRM from the smart scheduler. Otherwise, when you + open a menu in openoffice, and it recompiles XKB to deal with the + accelerators, and you popen xkbcomp because we suck, then the scheduler + will tell you you're taking forever doing something stupid, and the + wait() code will get confused, and input will hang and your CPU usage + slams to 100%. Down, not across. + +diff --git a/os/utils.c b/os/utils.c +index 3bb7dbe..afcaae4 100644 +--- a/os/utils.c ++++ b/os/utils.c +@@ -1720,6 +1720,8 @@ static struct pid { + int pid; + } *pidlist; + ++static sighandler_t old_alarm = NULL; /* XXX horrible awful hack */ ++ + pointer + Popen(char *command, char *type) + { +@@ -1741,11 +1743,15 @@ Popen(char *command, char *type) + return NULL; + } + ++ /* Ignore the smart scheduler while this is going on */ ++ old_alarm = signal(SIGALRM, SIG_IGN); ++ + switch (pid = fork()) { + case -1: /* error */ + close(pdes[0]); + close(pdes[1]); + xfree(cur); ++ signal(SIGALRM, old_alarm); + return NULL; + case 0: /* child */ + if (setgid(getgid()) == -1) +@@ -1921,6 +1927,8 @@ Pclose(pointer iop) + /* allow EINTR again */ + OsReleaseSignals (); + ++ signal(SIGALRM, old_alarm); ++ + return pid == -1 ? -1 : pstat; + } + diff --git a/x11-base/xorg-server/files/1.4-fix-dmx-build.patch b/x11-base/xorg-server/files/1.4-fix-dmx-build.patch new file mode 100644 index 0000000..07f43ab --- /dev/null +++ b/x11-base/xorg-server/files/1.4-fix-dmx-build.patch @@ -0,0 +1,19 @@ +diff --git a/hw/dmx/dmxinput.c b/hw/dmx/dmxinput.c +index d644b5d..83f8a4a 100644 +--- a/hw/dmx/dmxinput.c ++++ b/hw/dmx/dmxinput.c +@@ -105,3 +105,14 @@ void dmxUpdateWindowInfo(DMXUpdateType type, WindowPtr pWindow) + if (!dmxInput->detached && dmxInput->updateWindowInfo) + dmxInput->updateWindowInfo(dmxInput, type, pWindow); + } ++ ++int ++NewInputDeviceRequest (InputOption *options, DeviceIntPtr *pdev) ++{ ++ return BadRequest; ++} ++ ++void ++DeleteInputDeviceRequest(DeviceIntPtr pDev) ++{ ++} diff --git a/x11-base/xorg-server/files/1.4-fix-dmx-link.patch b/x11-base/xorg-server/files/1.4-fix-dmx-link.patch new file mode 100644 index 0000000..909442d --- /dev/null +++ b/x11-base/xorg-server/files/1.4-fix-dmx-link.patch @@ -0,0 +1,12 @@ +diff --git a/hw/dmx/Makefile.am b/hw/dmx/Makefile.am +index 002ea11..15dc281 100644 +--- a/hw/dmx/Makefile.am ++++ b/hw/dmx/Makefile.am +@@ -87,6 +87,7 @@ Xdmx_LDADD = $(XORG_CORE_LIBS) \ + $(GLX_LIBS) \ + input/libdmxinput.a \ + config/libdmxconfig.a \ ++ @XSERVER_LIBS@ \ + @DMXMODULES_LIBS@ + + # Man page diff --git a/x11-base/xorg-server/files/1.4-fix-kdrive-automake.patch b/x11-base/xorg-server/files/1.4-fix-kdrive-automake.patch new file mode 100644 index 0000000..cdc436e --- /dev/null +++ b/x11-base/xorg-server/files/1.4-fix-kdrive-automake.patch @@ -0,0 +1,12 @@ +diff --git a/hw/kdrive/Makefile.am b/hw/kdrive/Makefile.am +index 5803644..71d3403 100644 +--- a/hw/kdrive/Makefile.am ++++ b/hw/kdrive/Makefile.am +@@ -1,6 +1,5 @@ + if KDRIVEVESA +-VESA_SUBDIRS = vesa ati chips epson i810 mach64 mga nvidia pm2 r128 \ +- smi via ++VESA_SUBDIRS = vesa ati chips epson i810 mach64 mga nvidia pm2 r128 smi via + endif + + if BUILD_KDRIVEFBDEVLIB diff --git a/x11-base/xorg-server/files/1.4-fix-xephyr-link.patch b/x11-base/xorg-server/files/1.4-fix-xephyr-link.patch new file mode 100644 index 0000000..35ca029 --- /dev/null +++ b/x11-base/xorg-server/files/1.4-fix-xephyr-link.patch @@ -0,0 +1,25 @@ +diff --git a/configure.ac b/configure.ac +index 62fdd78..7a37590 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -1802,7 +1802,7 @@ if test "$KDRIVE" = yes; then + XSDL_INCS="`sdl-config --cflags` $XSERVER_CFLAGS" + fi + +- PKG_CHECK_MODULES(XEPHYR, x11 xext xfont xau xdmcp, [xephyr="yes"], [xephyr="no"]) ++ PKG_CHECK_MODULES(XEPHYR, x11 xext xfont xau xdmcp $PIXMAN, [xephyr="yes"], [xephyr="no"]) + if test "x$XEPHYR" = xauto; then + XEPHYR=$xephyr + fi +diff --git a/hw/kdrive/ephyr/Makefile.am b/hw/kdrive/ephyr/Makefile.am +index cc3019f..1738d0f 100644 +--- a/hw/kdrive/ephyr/Makefile.am ++++ b/hw/kdrive/ephyr/Makefile.am +@@ -28,6 +28,7 @@ Xephyr_LDADD = \ + libxephyr-hostx.a \ + ../../../exa/libexa.la \ + @KDRIVE_LIBS@ \ ++ @XSERVER_LIBS@ \ + @XEPHYR_LIBS@ + + Xephyr_DEPENDENCIES = \ diff --git a/x11-base/xorg-server/files/1.4-fix-xprint-build.patch b/x11-base/xorg-server/files/1.4-fix-xprint-build.patch new file mode 100644 index 0000000..98fbacf --- /dev/null +++ b/x11-base/xorg-server/files/1.4-fix-xprint-build.patch @@ -0,0 +1,22 @@ +diff --git a/hw/xprint/ddxInit.c b/hw/xprint/ddxInit.c +index a465c4c..1e7652e 100644 +--- a/hw/xprint/ddxInit.c ++++ b/hw/xprint/ddxInit.c +@@ -310,6 +310,17 @@ ChangeDeviceControl ( + return BadMatch; + } + ++int ++NewInputDeviceRequest(InputOption *options, DeviceIntPtr *pdev) ++{ ++ return BadValue; ++} ++ ++void ++DeleteInputDeviceRequest(DeviceIntPtr dev) ++{ ++} ++ + void + OpenInputDevice ( + DeviceIntPtr dev, diff --git a/x11-base/xorg-server/files/1.4-fix-xprint-link.patch b/x11-base/xorg-server/files/1.4-fix-xprint-link.patch new file mode 100644 index 0000000..1cf7205 --- /dev/null +++ b/x11-base/xorg-server/files/1.4-fix-xprint-link.patch @@ -0,0 +1,13 @@ +diff --git a/hw/xprint/Makefile.am b/hw/xprint/Makefile.am +index dc8764a..728e69d 100644 +--- a/hw/xprint/Makefile.am ++++ b/hw/xprint/Makefile.am +@@ -12,7 +12,7 @@ Xprt_LDFLAGS = -L$(top_srcdir) + Xprt_LDADD = @XPRINT_LIBS@ ps/libps.la raster/libraster.la \ + pcl/libpcl.la pcl-mono/libpcl.la $(top_builddir)/fb/libfb.la \ + $(top_builddir)/render/librender.la $(top_builddir)/mi/libmi.la \ +- $(top_builddir)/Xext/libXext.la @FREETYPE_LIBS@ ++ $(top_builddir)/Xext/libXext.la @FREETYPE_LIBS@ @XSERVER_LIBS@ + + miinitext-wrapper.c: + echo "#include \"$(top_srcdir)/mi/miinitext.c\"" >> $@ diff --git a/x11-base/xorg-server/files/1.4-fpic-libxf86config.patch b/x11-base/xorg-server/files/1.4-fpic-libxf86config.patch new file mode 100644 index 0000000..c3b9ebd --- /dev/null +++ b/x11-base/xorg-server/files/1.4-fpic-libxf86config.patch @@ -0,0 +1,13 @@ +diff --git a/hw/xfree86/parser/Makefile.am b/hw/xfree86/parser/Makefile.am +index 849ee8b..1b49d48 100644 +--- a/hw/xfree86/parser/Makefile.am ++++ b/hw/xfree86/parser/Makefile.am +@@ -25,7 +25,7 @@ libxf86config_a_SOURCES = \ + DRI.c \ + Extensions.c + +-AM_CFLAGS = $(DIX_CFLAGS) $(XORG_CFLAGS) ++AM_CFLAGS = $(DIX_CFLAGS) $(XORG_CFLAGS) -fPIC + + EXTRA_DIST = \ + Configint.h \ diff --git a/x11-base/xorg-server/files/1.4-ia64.patch b/x11-base/xorg-server/files/1.4-ia64.patch new file mode 100644 index 0000000..13ffb5f --- /dev/null +++ b/x11-base/xorg-server/files/1.4-ia64.patch @@ -0,0 +1,49 @@ +--- /dev/null 1969-12-31 16:00:00.000000000 -0800 ++++ hw/xfree86/os-support/shared/ia64Pci.h 2007-08-03 12:56:38.000000000 -0700 +@@ -0,0 +1,46 @@ ++/* ++ * Copyright 2004, Egbert Eich ++ * ++ * Permission is hereby granted, free of charge, to any person obtaining a copy ++ * of this software and associated documentation files (the "Software"), to ++ * deal in the Software without restriction, including without limitation the ++ * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or ++ * sell copies of the Software, and to permit persons to whom the Software is ++ * furnished to do so, subject to the following conditions: ++ * ++ * The above copyright notice and this permission notice shall be included in ++ * all copies or substantial portions of the Software. ++ * ++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR ++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, ++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL ++ * EGBERT EICH BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER ++ * IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CON- ++ * NECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. ++ * ++ * Except as contained in this notice, the name of Egbert Eich shall not ++ * be used in advertising or otherwise to promote the sale, use or other deal- ++ *ings in this Software without prior written authorization from Egbert Eich. ++ * ++ */ ++#ifdef HAVE_XORG_CONFIG_H ++#include <xorg-config.h> ++#endif ++ ++#ifndef _IA64_PCI_H ++# define _IA64_PCI_H ++ ++#include "Pci.h" ++ ++typedef enum { ++ NONE_CHIPSET, ++ I460GX_CHIPSET, ++ E8870_CHIPSET, ++ ZX1_CHIPSET, ++ ALTIX_CHIPSET ++} IA64Chipset; ++ ++# ifdef OS_PROBE_PCI_CHIPSET ++extern IA64Chipset OS_PROBE_PCI_CHIPSET(scanpciWrapperOpt flags); ++# endif ++#endif diff --git a/x11-base/xorg-server/files/1.4.0.90-clean-generated-files.patch b/x11-base/xorg-server/files/1.4.0.90-clean-generated-files.patch new file mode 100644 index 0000000..ece24eb --- /dev/null +++ b/x11-base/xorg-server/files/1.4.0.90-clean-generated-files.patch @@ -0,0 +1,19 @@ +commit d988da6eee8422774dff364050bf431b843a714a +Author: Arkadiusz Miskiewicz <arekm@maven.pl> +Date: Thu Dec 13 00:09:08 2007 +0200 + + Xprint: Clean up generated files + + Remember to clean generated wrapper files. + (cherry picked from commit 977fcdea8198906936a64b8117e6a6d027c617e3) + +diff --git a/hw/xprint/Makefile.am b/hw/xprint/Makefile.am +index dc8764a..f834966 100644 +--- a/hw/xprint/Makefile.am ++++ b/hw/xprint/Makefile.am +@@ -41,3 +41,5 @@ Xprt_SOURCES = \ + $(top_srcdir)/fb/fbcmap_mi.c + + EXTRA_DIST = ValTree.c ++ ++CLEANFILES = miinitext-wrapper.c dpmsstubs-wrapper.c diff --git a/x11-base/xorg-server/files/1.5.1/0001-only-build-dri2-when-DRI2-is-enabled.patch b/x11-base/xorg-server/files/1.5.1/0001-only-build-dri2-when-DRI2-is-enabled.patch new file mode 100644 index 0000000..c230dd1 --- /dev/null +++ b/x11-base/xorg-server/files/1.5.1/0001-only-build-dri2-when-DRI2-is-enabled.patch @@ -0,0 +1,31 @@ +From af8cef461c4d107f7a03645568a635d0458da9b8 Mon Sep 17 00:00:00 2001 +From: Alan Hourihane <alanh@tungstengraphics.com> +Date: Wed, 24 Sep 2008 14:24:36 +0100 +Subject: [PATCH] only build dri2 when DRI2 is enabled + +--- + glx/Makefile.am | 6 +++++- + 1 files changed, 5 insertions(+), 1 deletions(-) + +diff --git a/glx/Makefile.am b/glx/Makefile.am +index 39b96d7..0214295 100644 +--- a/glx/Makefile.am ++++ b/glx/Makefile.am +@@ -45,9 +45,13 @@ glapi_sources = \ + glthread.h \ + glprocs.h + ++if DRI2 ++GLXDRI_SOURCE = glxdri2.c ++endif ++ + libglxdri_la_SOURCES = \ + glxdri.c \ +- glxdri2.c \ ++ $(GLXDRI2_SOURCE) \ + glxdricommon.h \ + extension_string.c \ + extension_string.h +-- +1.6.0.1 + diff --git a/x11-base/xorg-server/files/1.5.2-fix-xvesa-with-new-kernels.patch b/x11-base/xorg-server/files/1.5.2-fix-xvesa-with-new-kernels.patch new file mode 100644 index 0000000..2d0f469 --- /dev/null +++ b/x11-base/xorg-server/files/1.5.2-fix-xvesa-with-new-kernels.patch @@ -0,0 +1,19 @@ +See https://bugs.gentoo.org/show_bug.cgi?id=235789 +2008-09-09 Martin von Gagern + +--- xorg-server-1.5.0.orig/hw/kdrive/vesa/vm86.h 2008-09-09 17:24:59.000000000 +0200 ++++ xorg-server-1.5.0/hw/kdrive/vesa/vm86.h 2008-09-09 18:01:53.000000000 +0200 +@@ -67,6 +67,13 @@ + #include "os.h" + #endif + ++#ifndef IF_MASK ++#define IF_MASK X86_EFLAGS_IF ++#endif ++#ifndef IOPL_MASK ++#define IOPL_MASK X86_EFLAGS_IOPL ++#endif ++ + typedef unsigned char U8; + typedef unsigned short U16; + typedef unsigned int U32; diff --git a/x11-base/xorg-server/files/1.5.2-force-LC_ALL-C-when-running-awk.patch b/x11-base/xorg-server/files/1.5.2-force-LC_ALL-C-when-running-awk.patch new file mode 100644 index 0000000..ffb3e0d --- /dev/null +++ b/x11-base/xorg-server/files/1.5.2-force-LC_ALL-C-when-running-awk.patch @@ -0,0 +1,38 @@ +From 8918c50440de301887af8006f2dc72d64adf9f9c Mon Sep 17 00:00:00 2001 +From: Remi Cardona <remi@gentoo.org> +Date: Sat, 18 Oct 2008 12:23:51 +0200 +Subject: [PATCH] force LC_ALL=C when running awk +MIME-Version: 1.0 +Content-Type: text/plain; charset=utf-8 +Content-Transfer-Encoding: 8bit + +This bug was reported by a user trying to build the server with a +Turkish locale (tr_TR). The problem is that the Turkish alphabet is +latin-based, but not entirely similar. The bug comes from vesamodes +which has "Interlaced", which is then converted to lowercase by +modelines2c.awk. Execept that with a Turkish locale +tolower("Interlaced") is not "interlaced" but "ınterlaced", which the +rest of the script fails to understand. + +This patch forces LC_ALL=C when running the awk script to always get the +intended latin en_US alphabet. +--- + hw/xfree86/common/Makefile.am | 2 +- + 1 files changed, 1 insertions(+), 1 deletions(-) + +diff --git a/hw/xfree86/common/Makefile.am b/hw/xfree86/common/Makefile.am +index 0f44075..723973a 100644 +--- a/hw/xfree86/common/Makefile.am ++++ b/hw/xfree86/common/Makefile.am +@@ -24,7 +24,7 @@ BUSSOURCES = xf86isaBus.c xf86pciBus.c xf86fbBus.c xf86noBus.c $(SBUS_SOURCES) + MODEDEFSOURCES = $(srcdir)/vesamodes $(srcdir)/extramodes + + xf86DefModeSet.c: $(srcdir)/modeline2c.awk $(MODEDEFSOURCES) +- cat $(MODEDEFSOURCES) | $(AWK) -f $(srcdir)/modeline2c.awk > $@ ++ cat $(MODEDEFSOURCES) | LC_ALL=C $(AWK) -f $(srcdir)/modeline2c.awk > $@ + + BUILT_SOURCES = xf86DefModeSet.c + +-- +1.6.0.2 + diff --git a/x11-base/xorg-server/files/1.5.3-builtin-fonts.patch b/x11-base/xorg-server/files/1.5.3-builtin-fonts.patch new file mode 100644 index 0000000..50719ad --- /dev/null +++ b/x11-base/xorg-server/files/1.5.3-builtin-fonts.patch @@ -0,0 +1,28 @@ +From fe82a1fe634a2e0ceb030de90309d26044c7b75e Mon Sep 17 00:00:00 2001 +From: Adam Jackson <ajax@redhat.com> +Date: Thu, 1 Nov 2007 15:06:17 -0400 +Subject: [PATCH] Enable builtin font FPE. + +--- + dix/dixfonts.c | 3 --- + 1 files changed, 0 insertions(+), 3 deletions(-) + +diff --git a/dix/dixfonts.c b/dix/dixfonts.c +index c21b3ec..c951b05 100644 +--- a/dix/dixfonts.c ++++ b/dix/dixfonts.c +@@ -1890,11 +1890,8 @@ InitFonts (void) + } else + #endif + { +-#ifdef BUILTIN_FONTS + BuiltinRegisterFpeFunctions(); +-#else + FontFileRegisterFpeFunctions(); +-#endif + #ifndef NOFONTSERVERACCESS + fs_register_fpe_functions(); + #endif +-- +1.5.3.4 + diff --git a/x11-base/xorg-server/files/avoid-crash-on-minimized-xv-window.patch b/x11-base/xorg-server/files/avoid-crash-on-minimized-xv-window.patch new file mode 100644 index 0000000..23eeca1 --- /dev/null +++ b/x11-base/xorg-server/files/avoid-crash-on-minimized-xv-window.patch @@ -0,0 +1,55 @@ +From: Michel Dänzer <michel@tungstengraphics.com> +Date: Thu, 24 May 2007 10:10:05 +0000 (+0200) +Subject: Consolidate portPriv->pDraw assignments into xf86XVEnlistPortInWindow. +X-Git-Tag: xorg-server-1.3.99.0 +X-Git-Url: http://gitweb.freedesktop.org/?p=xorg/xserver.git;a=commitdiff;h=649e7f82d8d4333443493056b81eb20d6cf022bc + +Consolidate portPriv->pDraw assignments into xf86XVEnlistPortInWindow. + +This avoids a crash in xf86XVReputVideo and also cleans up the code slightly. +--- + +--- a/hw/xfree86/common/xf86xv.c ++++ b/hw/xfree86/common/xf86xv.c +@@ -979,6 +979,9 @@ xf86XVEnlistPortInWindow(WindowPtr pWin, + winPriv->next = PrivRoot; + pWin->devPrivates[XF86XVWindowIndex].ptr = (pointer)winPriv; + } ++ ++ portPriv->pDraw = (DrawablePtr)pWin; ++ + return Success; + } + +@@ -1375,7 +1378,6 @@ xf86XVPutVideo( + result = xf86XVEnlistPortInWindow((WindowPtr)pDraw, portPriv); + if(result != Success) return result; + +- portPriv->pDraw = pDraw; + portPriv->type = XvInputMask; + + /* save a copy of these parameters */ +@@ -1479,7 +1481,6 @@ xf86XVPutStill( + + xf86XVEnlistPortInWindow((WindowPtr)pDraw, portPriv); + portPriv->isOn = XV_ON; +- portPriv->pDraw = pDraw; + portPriv->drw_x = drw_x; portPriv->drw_y = drw_y; + portPriv->drw_w = drw_w; portPriv->drw_h = drw_h; + portPriv->type = 0; /* no mask means it's transient and should +@@ -1529,7 +1530,6 @@ xf86XVGetVideo( + result = xf86XVEnlistPortInWindow((WindowPtr)pDraw, portPriv); + if(result != Success) return result; + +- portPriv->pDraw = pDraw; + portPriv->type = XvOutputMask; + + /* save a copy of these parameters */ +@@ -1784,7 +1784,6 @@ xf86XVPutImage( + (portPriv->AdaptorRec->flags & VIDEO_OVERLAID_IMAGES)) { + + portPriv->isOn = XV_ON; +- portPriv->pDraw = pDraw; + portPriv->drw_x = drw_x; portPriv->drw_y = drw_y; + portPriv->drw_w = drw_w; portPriv->drw_h = drw_h; + portPriv->type = 0; /* no mask means it's transient and should diff --git a/x11-base/xorg-server/files/tslib-1.0-check.patch b/x11-base/xorg-server/files/tslib-1.0-check.patch new file mode 100644 index 0000000..57a361a --- /dev/null +++ b/x11-base/xorg-server/files/tslib-1.0-check.patch @@ -0,0 +1,144 @@ +<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> +<html xmlns="http://www.w3.org/1999/xhtml"> + + + + + + + <head> + <title> + Attachment – + gentoo + </title> + <link rel="search" href="/index.cgi/search" /> + <link rel="help" href="/index.cgi/wiki/TracGuide" /> + <link rel="alternate" href="/index.cgi/raw-attachment/ticket/114/tslib-1.0-check.patch" type="text/x-diff; charset=iso-8859-15" title="Original Format" /> + <link rel="up" href="/index.cgi/ticket/114" title="Ticket #114" /> + <link rel="start" href="/index.cgi/wiki" /> + <link rel="stylesheet" href="/index.cgi/chrome/common/css/trac.css" type="text/css" /><link rel="stylesheet" href="/index.cgi/chrome/common/css/diff.css" type="text/css" /><link rel="stylesheet" href="/index.cgi/chrome/common/css/code.css" type="text/css" /><link rel="stylesheet" href="/index.cgi/chrome/notebox/css/notebox.css" type="text/css" /> + <link rel="shortcut icon" href="/index.cgi/chrome/common/trac.ico" type="image/x-icon" /> + <link rel="icon" href="/index.cgi/chrome/common/trac.ico" type="image/x-icon" /> + <link type="application/opensearchdescription+xml" rel="search" href="/index.cgi/search/opensearch" title="Search gentoo" /> + <script type="text/javascript" src="/index.cgi/chrome/common/js/jquery.js"></script><script type="text/javascript" src="/index.cgi/chrome/common/js/trac.js"></script><script type="text/javascript" src="/index.cgi/chrome/common/js/search.js"></script><script type="text/javascript" src="/index.cgi/chrome/common/js/diff.js"></script> + <!--[if lt IE 7]> + <script type="text/javascript" src="/index.cgi/chrome/common/js/ie_pre7_hacks.js"></script> + <![endif]--> + </head> + <body> + <div id="banner"> + <div id="header"> + <a id="logo" href="http://gentoo.mindzoo.de/"><img src="/index.cgi/chrome/site/gentoo.png" alt="OpenmokoGentoo" /></a> + </div> + <form id="search" action="/index.cgi/search" method="get"> + <div> + <label for="proj-search">Search:</label> + <input type="text" id="proj-search" name="q" size="18" value="" /> + <input type="submit" value="Search" /> + </div> + </form> + <div id="metanav" class="nav"> + <ul> + <li class="first"><a href="/index.cgi/login">Login</a></li><li><a href="/index.cgi/prefs">Preferences</a></li><li><a href="/index.cgi/wiki/TracGuide">Help/Guide</a></li><li><a href="/index.cgi/about">About Trac</a></li><li class="last"><a href="/index.cgi/register">Register</a></li> + </ul> + </div> + </div> + <div id="mainnav" class="nav"> + <ul> + <li class="first"><a href="/index.cgi/wiki">Wiki</a></li><li><a href="/index.cgi/timeline">Timeline</a></li><li><a href="/index.cgi/roadmap">Roadmap</a></li><li><a href="/index.cgi/browser">Browse Source</a></li><li><a href="/index.cgi/report">View Tickets</a></li><li><a href="/index.cgi/search">Search</a></li><li class="last"><a href="/index.cgi/tags">Tags</a></li> + </ul> + </div> + <div id="main"> + <div id="ctxtnav" class="nav"> + <h2>Context Navigation</h2> + <ul> + <li class="first last"><a href="/index.cgi/ticket/114">Back to Ticket #114</a></li> + </ul> + <hr /> + </div> + <div id="content" class="attachment"> + <h1><a href="/index.cgi/ticket/114">Ticket #114</a>: tslib-1.0-check.patch</h1> + <table id="info" summary="Description"> + <tbody> + <tr> + <th scope="col"> + File tslib-1.0-check.patch, <span title="590 bytes">0.6 kB</span> + (added by tomboy64, <a class="timeline" href="/index.cgi/timeline?from=2009-03-18T09%3A09%3A30Z%2B0100&precision=second" title="2009-03-18T09:09:30Z+0100 in Timeline">8 weeks</a> ago) + </th> + </tr> + <tr> + <td class="message searchable"> + + </td> + </tr> + </tbody> + </table> + <div id="preview" class="searchable"> + <div class="diff"> + <ul class="entries"> + <li class="entry"> + <h2> + <a>configure.ac</a> + </h2> + <table class="inline" summary="Differences" cellspacing="0"> + <colgroup><col class="lineno" /><col class="lineno" /><col class="content" /></colgroup> + <thead> + <tr> + <th title="File configure.ac 2009-03-18 07:06:37.000000000 +0100"> + old + </th> + <th title="File configure.ac.new 2009-03-18 08:55:57.000000000 +0100"> + new + </th> + <th> </th> + </tr> + </thead> + <tbody class="unmod"> + <tr> + <th>1930</th><th>1930</th><td class="l"><span> AC_CHECK_LIB([rt], [nanosleep], XEPHYR_LIBS="$XEPHYR_LIBS -lrt"))</span> </td> + </tr><tr> + <th>1931</th><th>1931</th><td class="l"><span> </span> </td> + </tr><tr> + <th>1932</th><th>1932</th><td class="l"><span> if test "x$TSLIB" = xyes; then</span> </td> + </tr> + </tbody><tbody class="mod"> + <tr class="first"> + <th>1933</th><th> </th><td class="l"><span> PKG_CHECK_MODULES([TSLIB], [tslib-<del>0</del>.0], [HAVE_TSLIB="yes"], [HAVE_TSLIB="no"])</span> </td> + </tr> + <tr class="last"> + <th> </th><th>1933</th><td class="r"><span> PKG_CHECK_MODULES([TSLIB], [tslib-<ins>1</ins>.0], [HAVE_TSLIB="yes"], [HAVE_TSLIB="no"])</span> </td> + </tr> + </tbody><tbody class="unmod"> + <tr> + <th>1934</th><th>1934</th><td class="l"><span> if test "x$HAVE_TSLIB" = xno; then</span> </td> + </tr><tr> + <th>1935</th><th>1935</th><td class="l"><span> AC_MSG_ERROR([tslib must be installed to build the tslib driver. See http://tslib.berlios.de/])</span> </td> + </tr><tr> + <th>1936</th><th>1936</th><td class="l"><span> fi</span> </td> + </tr> + </tbody> + </table> + </li> + </ul> +</div> + </div> + </div> + <div id="altlinks"> + <h3>Download in other formats:</h3> + <ul> + <li class="last first"> + <a rel="nofollow" href="/index.cgi/raw-attachment/ticket/114/tslib-1.0-check.patch">Original Format</a> + </li> + </ul> + </div> + </div> + <div id="footer" lang="en" xml:lang="en"><hr /> + <a id="tracpowered" href="http://trac.edgewall.org/"><img src="/index.cgi/chrome/common/trac_logo_mini.png" height="30" width="107" alt="Trac Powered" /></a> + <p class="left"> + Powered by <a href="/index.cgi/about"><strong>Trac 0.11.1</strong></a><br /> + By <a href="http://www.edgewall.org/">Edgewall Software</a>. + </p> + <p class="right">Visit the Trac open source project at<br /><a href="http://trac.edgewall.org/">http://trac.edgewall.org/</a></p> + </div> + </body> +</html>
\ No newline at end of file diff --git a/x11-base/xorg-server/files/use-composite-for-unequal-depths.patch b/x11-base/xorg-server/files/use-composite-for-unequal-depths.patch new file mode 100644 index 0000000..fd2c5ad --- /dev/null +++ b/x11-base/xorg-server/files/use-composite-for-unequal-depths.patch @@ -0,0 +1,124 @@ +Gentoo bug #191964 +freedesktop.org bug #7447 attachment #11368 +Fixed in 1.4 and newer + +diff --git a/composite/compalloc.c b/composite/compalloc.c +index f555411..006e808 100644 +--- a/composite/compalloc.c ++++ b/composite/compalloc.c +@@ -461,7 +461,6 @@ compNewPixmap (WindowPtr pWin, int x, int y, int w, int h) + ScreenPtr pScreen = pWin->drawable.pScreen; + WindowPtr pParent = pWin->parent; + PixmapPtr pPixmap; +- GCPtr pGC; + + pPixmap = (*pScreen->CreatePixmap) (pScreen, w, h, pWin->drawable.depth); + +@@ -471,25 +470,63 @@ compNewPixmap (WindowPtr pWin, int x, int y, int w, int h) + pPixmap->screen_x = x; + pPixmap->screen_y = y; + +- pGC = GetScratchGC (pWin->drawable.depth, pScreen); +- +- /* +- * Copy bits from the parent into the new pixmap so that it will +- * have "reasonable" contents in case for background None areas. +- */ +- if (pGC) ++ if (pParent->drawable.depth == pWin->drawable.depth) + { +- XID val = IncludeInferiors; ++ GCPtr pGC = GetScratchGC (pWin->drawable.depth, pScreen); + +- ValidateGC(&pPixmap->drawable, pGC); +- dixChangeGC (serverClient, pGC, GCSubwindowMode, &val, NULL); +- (*pGC->ops->CopyArea) (&pParent->drawable, +- &pPixmap->drawable, +- pGC, +- x - pParent->drawable.x, +- y - pParent->drawable.y, +- w, h, 0, 0); +- FreeScratchGC (pGC); ++ /* ++ * Copy bits from the parent into the new pixmap so that it will ++ * have "reasonable" contents in case for background None areas. ++ */ ++ if (pGC) ++ { ++ XID val = IncludeInferiors; ++ ++ ValidateGC(&pPixmap->drawable, pGC); ++ dixChangeGC (serverClient, pGC, GCSubwindowMode, &val, NULL); ++ (*pGC->ops->CopyArea) (&pParent->drawable, ++ &pPixmap->drawable, ++ pGC, ++ x - pParent->drawable.x, ++ y - pParent->drawable.y, ++ w, h, 0, 0); ++ FreeScratchGC (pGC); ++ } ++ } ++ else ++ { ++ PictFormatPtr pSrcFormat = compWindowFormat (pParent); ++ PictFormatPtr pDstFormat = compWindowFormat (pWin); ++ XID inferiors = IncludeInferiors; ++ int error; ++ ++ PicturePtr pSrcPicture = CreatePicture (None, ++ &pParent->drawable, ++ pSrcFormat, ++ CPSubwindowMode, ++ &inferiors, ++ serverClient, &error); ++ ++ PicturePtr pDstPicture = CreatePicture (None, ++ &pPixmap->drawable, ++ pDstFormat, ++ 0, 0, ++ serverClient, &error); ++ ++ if (pSrcPicture && pDstPicture) ++ { ++ CompositePicture (PictOpSrc, ++ pSrcPicture, ++ NULL, ++ pDstPicture, ++ x - pParent->drawable.x, ++ y - pParent->drawable.y, ++ 0, 0, 0, 0, w, h); ++ } ++ if (pSrcPicture) ++ FreePicture (pSrcPicture, 0); ++ if (pDstPicture) ++ FreePicture (pDstPicture, 0); + } + return pPixmap; + } +diff --git a/composite/compint.h b/composite/compint.h +index 38b1777..f69595c 100644 +--- a/composite/compint.h ++++ b/composite/compint.h +@@ -237,6 +237,9 @@ compCheckTree (ScreenPtr pScreen); + #define compCheckTree(s) + #endif + ++PictFormatPtr ++compWindowFormat (WindowPtr pWin); ++ + void + compSetPixmap (WindowPtr pWin, PixmapPtr pPixmap); + +diff --git a/composite/compwindow.c b/composite/compwindow.c +index a4c4e6f..bfd2946 100644 +--- a/composite/compwindow.c ++++ b/composite/compwindow.c +@@ -685,7 +685,7 @@ compGetWindowVisual (WindowPtr pWin) + return 0; + } + +-static PictFormatPtr ++PictFormatPtr + compWindowFormat (WindowPtr pWin) + { + ScreenPtr pScreen = pWin->drawable.pScreen; diff --git a/x11-base/xorg-server/files/xorg-server-1.4.0.90-automake-1.10.1-fixup.patch b/x11-base/xorg-server/files/xorg-server-1.4.0.90-automake-1.10.1-fixup.patch new file mode 100644 index 0000000..3d34b34 --- /dev/null +++ b/x11-base/xorg-server/files/xorg-server-1.4.0.90-automake-1.10.1-fixup.patch @@ -0,0 +1,13 @@ +--- configure.ac.orig 2008-04-17 16:53:09.000000000 -0500 ++++ configure.ac 2008-04-17 16:53:29.000000000 -0500 +@@ -1962,7 +1962,9 @@ + + AC_SUBST([DIX_CFLAGS]) + +-AC_SUBST([libdir exec_prefix prefix]) ++AC_SUBST([libdir]) ++AC_SUBST([exec_prefix]) ++AC_SUBST([prefix]) + + # Man page sections - used in config utils & generating man pages + XORG_MANPAGE_SECTIONS diff --git a/x11-base/xorg-server/files/xorg-server-sam225bw-quirks.patch b/x11-base/xorg-server/files/xorg-server-sam225bw-quirks.patch new file mode 100644 index 0000000..ca5bbb4 --- /dev/null +++ b/x11-base/xorg-server/files/xorg-server-sam225bw-quirks.patch @@ -0,0 +1,14 @@ +--- hw/xfree86/modes/xf86EdidModes.c 2007-05-02 01:23:52.000000000 +0200 ++++ hw/xfree86/modes/xf86EdidModes.c.new 2007-05-02 01:24:09.000000000 +0200 +@@ -92,6 +92,11 @@ + DDC->vendor.prod_id == 638) + return TRUE; + ++ /* Samsung SyncMaster 225BW */ ++ if (memcmp (DDC->vendor.name, "SAM", 4) == 0 && ++ DDC->vendor.prod_id == 596) ++ return TRUE; ++ + return FALSE; + } + diff --git a/x11-base/xorg-server/files/xorg-x11-server-1.0.1-fpic-libxf86config.patch b/x11-base/xorg-server/files/xorg-x11-server-1.0.1-fpic-libxf86config.patch new file mode 100644 index 0000000..a6a35f9 --- /dev/null +++ b/x11-base/xorg-server/files/xorg-x11-server-1.0.1-fpic-libxf86config.patch @@ -0,0 +1,11 @@ +--- xorg-server-1.0.1/hw/xfree86/parser/Makefile.am.xf86configfpic 2006-03-06 13:57:45.000000000 -0500 ++++ xorg-server-1.0.1/hw/xfree86/parser/Makefile.am 2006-03-06 13:59:11.000000000 -0500 +@@ -23,7 +23,7 @@ + DRI.c \ + Extensions.c + +-AM_CFLAGS = $(XORG_CFLAGS) ++AM_CFLAGS = $(XORG_CFLAGS) -fPIC + + EXTRA_DIST = \ + Configint.h \ diff --git a/x11-base/xorg-server/files/xorg-xserver-1.4-cve-2008-1377.diff b/x11-base/xorg-server/files/xorg-xserver-1.4-cve-2008-1377.diff new file mode 100644 index 0000000..4eb7e1d --- /dev/null +++ b/x11-base/xorg-server/files/xorg-xserver-1.4-cve-2008-1377.diff @@ -0,0 +1,88 @@ +diff --git a/Xext/security.c b/Xext/security.c +index ba057de..f34c463 100644 +--- a/Xext/security.c ++++ b/Xext/security.c +@@ -651,15 +651,19 @@ SProcSecurityGenerateAuthorization( + register char n; + CARD32 *values; + unsigned long nvalues; ++ int values_offset; + + swaps(&stuff->length, n); + REQUEST_AT_LEAST_SIZE(xSecurityGenerateAuthorizationReq); + swaps(&stuff->nbytesAuthProto, n); + swaps(&stuff->nbytesAuthData, n); + swapl(&stuff->valueMask, n); +- values = (CARD32 *)(&stuff[1]) + +- ((stuff->nbytesAuthProto + (unsigned)3) >> 2) + +- ((stuff->nbytesAuthData + (unsigned)3) >> 2); ++ values_offset = ((stuff->nbytesAuthProto + (unsigned)3) >> 2) + ++ ((stuff->nbytesAuthData + (unsigned)3) >> 2); ++ if (values_offset > ++ stuff->length - (sz_xSecurityGenerateAuthorizationReq >> 2)) ++ return BadLength; ++ values = (CARD32 *)(&stuff[1]) + values_offset; + nvalues = (((CARD32 *)stuff) + stuff->length) - values; + SwapLongs(values, nvalues); + return ProcSecurityGenerateAuthorization(client); +diff --git a/record/record.c b/record/record.c +index 0ed8f84..9a166d6 100644 +--- a/record/record.c ++++ b/record/record.c +@@ -2656,7 +2656,7 @@ SProcRecordQueryVersion(ClientPtr client) + } /* SProcRecordQueryVersion */ + + +-static void ++static int + SwapCreateRegister(xRecordRegisterClientsReq *stuff) + { + register char n; +@@ -2667,11 +2667,17 @@ SwapCreateRegister(xRecordRegisterClientsReq *stuff) + swapl(&stuff->nClients, n); + swapl(&stuff->nRanges, n); + pClientID = (XID *)&stuff[1]; ++ if (stuff->nClients > stuff->length - (sz_xRecordRegisterClientsReq >> 2)) ++ return BadLength; + for (i = 0; i < stuff->nClients; i++, pClientID++) + { + swapl(pClientID, n); + } ++ if (stuff->nRanges > stuff->length - (sz_xRecordRegisterClientsReq >> 2) ++ - stuff->nClients) ++ return BadLength; + RecordSwapRanges((xRecordRange *)pClientID, stuff->nRanges); ++ return Success; + } /* SwapCreateRegister */ + + +@@ -2679,11 +2685,13 @@ static int + SProcRecordCreateContext(ClientPtr client) + { + REQUEST(xRecordCreateContextReq); ++ int status; + register char n; + + swaps(&stuff->length, n); + REQUEST_AT_LEAST_SIZE(xRecordCreateContextReq); +- SwapCreateRegister((pointer)stuff); ++ if ((status = SwapCreateRegister((pointer)stuff)) != Success) ++ return status; + return ProcRecordCreateContext(client); + } /* SProcRecordCreateContext */ + +@@ -2692,11 +2700,13 @@ static int + SProcRecordRegisterClients(ClientPtr client) + { + REQUEST(xRecordRegisterClientsReq); ++ int status; + register char n; + + swaps(&stuff->length, n); + REQUEST_AT_LEAST_SIZE(xRecordRegisterClientsReq); +- SwapCreateRegister((pointer)stuff); ++ if ((status = SwapCreateRegister((pointer)stuff)) != Success) ++ return status; + return ProcRecordRegisterClients(client); + } /* SProcRecordRegisterClients */ + diff --git a/x11-base/xorg-server/files/xorg-xserver-1.4-cve-2008-1379.diff b/x11-base/xorg-server/files/xorg-xserver-1.4-cve-2008-1379.diff new file mode 100644 index 0000000..180d126 --- /dev/null +++ b/x11-base/xorg-server/files/xorg-xserver-1.4-cve-2008-1379.diff @@ -0,0 +1,24 @@ +diff --git a/Xext/shm.c b/Xext/shm.c +index ac587be..e08df36 100644 +--- a/Xext/shm.c ++++ b/Xext/shm.c +@@ -831,8 +831,17 @@ ProcShmPutImage(client) + return BadValue; + } + +- VERIFY_SHMSIZE(shmdesc, stuff->offset, length * stuff->totalHeight, +- client); ++ /* ++ * There's a potential integer overflow in this check: ++ * VERIFY_SHMSIZE(shmdesc, stuff->offset, length * stuff->totalHeight, ++ * client); ++ * the version below ought to avoid it ++ */ ++ if (stuff->totalHeight != 0 && ++ length > (shmdesc->size - stuff->offset)/stuff->totalHeight) { ++ client->errorValue = stuff->totalWidth; ++ return BadValue; ++ } + if (stuff->srcX > stuff->totalWidth) + { + client->errorValue = stuff->srcX; diff --git a/x11-base/xorg-server/files/xorg-xserver-1.4-cve-2008-2360.diff b/x11-base/xorg-server/files/xorg-xserver-1.4-cve-2008-2360.diff new file mode 100644 index 0000000..f14afce --- /dev/null +++ b/x11-base/xorg-server/files/xorg-xserver-1.4-cve-2008-2360.diff @@ -0,0 +1,32 @@ +diff --git a/render/glyph.c b/render/glyph.c +index 583a52b..42ae65d 100644 +--- a/render/glyph.c ++++ b/render/glyph.c +@@ -42,6 +42,12 @@ + #include "picturestr.h" + #include "glyphstr.h" + ++#if HAVE_STDINT_H ++#include <stdint.h> ++#elif !defined(UINT32_MAX) ++#define UINT32_MAX 0xffffffffU ++#endif ++ + /* + * From Knuth -- a good choice for hash/rehash values is p, p-2 where + * p and p-2 are both prime. These tables are sized to have an extra 10% +@@ -626,8 +632,12 @@ AllocateGlyph (xGlyphInfo *gi, int fdepth) + int size; + GlyphPtr glyph; + int i; +- +- size = gi->height * PixmapBytePad (gi->width, glyphDepths[fdepth]); ++ size_t padded_width; ++ ++ padded_width = PixmapBytePad (gi->width, glyphDepths[fdepth]); ++ if (gi->height && padded_width > (UINT32_MAX - sizeof(GlyphRec))/gi->height) ++ return 0; ++ size = gi->height * padded_width; + glyph = (GlyphPtr) xalloc (size + sizeof (GlyphRec)); + if (!glyph) + return 0; diff --git a/x11-base/xorg-server/files/xorg-xserver-1.4-cve-2008-2361.diff b/x11-base/xorg-server/files/xorg-xserver-1.4-cve-2008-2361.diff new file mode 100644 index 0000000..0749331 --- /dev/null +++ b/x11-base/xorg-server/files/xorg-xserver-1.4-cve-2008-2361.diff @@ -0,0 +1,13 @@ +diff --git a/render/render.c b/render/render.c +index caaa278..b53e878 100644 +--- a/render/render.c ++++ b/render/render.c +@@ -1504,6 +1504,8 @@ ProcRenderCreateCursor (ClientPtr client) + pScreen = pSrc->pDrawable->pScreen; + width = pSrc->pDrawable->width; + height = pSrc->pDrawable->height; ++ if (height && width > UINT32_MAX/(height*sizeof(CARD32))) ++ return BadAlloc; + if ( stuff->x > width + || stuff->y > height ) + return (BadMatch); diff --git a/x11-base/xorg-server/files/xorg-xserver-1.4-cve-2008-2362.diff b/x11-base/xorg-server/files/xorg-xserver-1.4-cve-2008-2362.diff new file mode 100644 index 0000000..a254d7a --- /dev/null +++ b/x11-base/xorg-server/files/xorg-xserver-1.4-cve-2008-2362.diff @@ -0,0 +1,63 @@ +diff --git a/render/render.c b/render/render.c +index 74c5f63..b53e878 100644 +--- a/render/render.c ++++ b/render/render.c +@@ -1920,6 +1920,8 @@ static int ProcRenderCreateLinearGradient (ClientPtr client) + LEGAL_NEW_RESOURCE(stuff->pid, client); + + len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq); ++ if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor))) ++ return BadLength; + if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor))) + return BadLength; + +@@ -2493,18 +2495,18 @@ SProcRenderCreateSolidFill(ClientPtr client) + return (*ProcRenderVector[stuff->renderReqType]) (client); + } + +-static void swapStops(void *stuff, int n) ++static void swapStops(void *stuff, int num) + { +- int i; ++ int i, n; + CARD32 *stops; + CARD16 *colors; + stops = (CARD32 *)(stuff); +- for (i = 0; i < n; ++i) { ++ for (i = 0; i < num; ++i) { + swapl(stops, n); + ++stops; + } + colors = (CARD16 *)(stops); +- for (i = 0; i < 4*n; ++i) { ++ for (i = 0; i < 4*num; ++i) { + swaps(stops, n); + ++stops; + } +@@ -2527,6 +2529,8 @@ SProcRenderCreateLinearGradient (ClientPtr client) + swapl(&stuff->nStops, n); + + len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq); ++ if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor))) ++ return BadLength; + if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor))) + return BadLength; + +@@ -2554,6 +2558,8 @@ SProcRenderCreateRadialGradient (ClientPtr client) + swapl(&stuff->nStops, n); + + len = (client->req_len << 2) - sizeof(xRenderCreateRadialGradientReq); ++ if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor))) ++ return BadLength; + if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor))) + return BadLength; + +@@ -2578,6 +2584,8 @@ SProcRenderCreateConicalGradient (ClientPtr client) + swapl(&stuff->nStops, n); + + len = (client->req_len << 2) - sizeof(xRenderCreateConicalGradientReq); ++ if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor))) ++ return BadLength; + if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor))) + return BadLength; + diff --git a/x11-base/xorg-server/files/xprint.init b/x11-base/xorg-server/files/xprint.init new file mode 100644 index 0000000..e5fed1b --- /dev/null +++ b/x11-base/xorg-server/files/xprint.init @@ -0,0 +1,30 @@ +#!/sbin/runscript +# Copyright 1999-2004 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/x11-base/xorg-server/files/xprint.init,v 1.1 2006/03/24 18:45:00 spyderous Exp $ + +opts="${opts} get_xpserverlist lsprinters" + +depend() { + use cupsd +} + +start() { + ebegin "Starting xprint" + /usr/lib/misc/xprint start > /dev/null + eend $? +} + +get_xpserverlist() { + /usr/lib/misc/xprint get_xpserverlist +} + +lsprinters() { + /usr/lib/misc/xprint lsprinters +} + +stop() { + ebegin "Stopping xprint" + /usr/lib/misc/xprint stop > /dev/null + eend $? +} |