[Midnightbsd-cvs] mports [19134] trunk/x11-servers: update xorg server
laffer1 at midnightbsd.org
laffer1 at midnightbsd.org
Wed May 27 23:00:01 EDT 2015
Revision: 19134
http://svnweb.midnightbsd.org/mports/?rev=19134
Author: laffer1
Date: 2015-05-27 23:00:00 -0400 (Wed, 27 May 2015)
Log Message:
-----------
update xorg server
Modified Paths:
--------------
trunk/x11-servers/mga_hal/Makefile
trunk/x11-servers/mga_hal/pkg-plist
trunk/x11-servers/x2vnc/Makefile
trunk/x11-servers/x2x/Makefile
trunk/x11-servers/xorg-dmx/pkg-plist
trunk/x11-servers/xorg-nestserver/Makefile
trunk/x11-servers/xorg-nestserver/distinfo
trunk/x11-servers/xorg-server/Makefile
trunk/x11-servers/xorg-server/distinfo
trunk/x11-servers/xorg-server/files/patch-Xserver-hw-xfree86-os-support-bsd-i386_video.c
trunk/x11-servers/xorg-server/files/patch-xkb_Makefile.in
trunk/x11-servers/xorg-server/pkg-plist
trunk/x11-servers/xorg-vfbserver/Makefile
trunk/x11-servers/xorg-vfbserver/distinfo
Added Paths:
-----------
trunk/x11-servers/xorg-server/files/extra-arch-i386
trunk/x11-servers/xorg-server/files/extra-arch-ia64
trunk/x11-servers/xorg-server/files/extra-arch-powerpc
trunk/x11-servers/xorg-server/files/extra-arch-sparc64
trunk/x11-servers/xorg-server/files/patch-CVE-2014-8092-1-4
trunk/x11-servers/xorg-server/files/patch-CVE-2014-8092-2-4
trunk/x11-servers/xorg-server/files/patch-CVE-2014-8092-3-4
trunk/x11-servers/xorg-server/files/patch-CVE-2014-8092-4-4
trunk/x11-servers/xorg-server/files/patch-CVE-2014-8092-pt5
trunk/x11-servers/xorg-server/files/patch-CVE-2014-8092-pt6
trunk/x11-servers/xorg-server/files/patch-CVE-2014-8093-1-6
trunk/x11-servers/xorg-server/files/patch-CVE-2014-8093-2-6
trunk/x11-servers/xorg-server/files/patch-CVE-2014-8093-3-6
trunk/x11-servers/xorg-server/files/patch-CVE-2014-8093-4-6
trunk/x11-servers/xorg-server/files/patch-CVE-2014-8093-5-6
trunk/x11-servers/xorg-server/files/patch-CVE-2014-8093-6-6
trunk/x11-servers/xorg-server/files/patch-CVE-2014-8094
trunk/x11-servers/xorg-server/files/patch-CVE-2014-8095
trunk/x11-servers/xorg-server/files/patch-CVE-2014-8096
trunk/x11-servers/xorg-server/files/patch-CVE-2014-8097
trunk/x11-servers/xorg-server/files/patch-CVE-2014-8097-pt2
trunk/x11-servers/xorg-server/files/patch-CVE-2014-8098-1-8
trunk/x11-servers/xorg-server/files/patch-CVE-2014-8098-2-8
trunk/x11-servers/xorg-server/files/patch-CVE-2014-8098-3-8
trunk/x11-servers/xorg-server/files/patch-CVE-2014-8098-4-8
trunk/x11-servers/xorg-server/files/patch-CVE-2014-8098-6-8
trunk/x11-servers/xorg-server/files/patch-CVE-2014-8098-7-8
trunk/x11-servers/xorg-server/files/patch-CVE-2014-8098-8-8
trunk/x11-servers/xorg-server/files/patch-CVE-2014-8099
trunk/x11-servers/xorg-server/files/patch-CVE-2014-8100-1-2
trunk/x11-servers/xorg-server/files/patch-CVE-2014-8100-2-2
trunk/x11-servers/xorg-server/files/patch-CVE-2014-8101
trunk/x11-servers/xorg-server/files/patch-CVE-2014-8102
trunk/x11-servers/xorg-server/files/patch-CVE-2015-0255
trunk/x11-servers/xorg-server/files/patch-config_config-backends.h
trunk/x11-servers/xorg-server/files/patch-config_config.c
trunk/x11-servers/xorg-server/files/patch-config_devd.c
trunk/x11-servers/xorg-server/files/patch-hw_xfree86_common_xf86Config.c
trunk/x11-servers/xorg-server/files/patch-hw_xfree86_common_xf86Globals.c
trunk/x11-servers/xorg-server/files/patch-hw_xfree86_common_xf86Xinput.c
trunk/x11-servers/xorg-server/files/patch-hw_xfree86_loader_loadmod.c
trunk/x11-servers/xorg-server/files/patch-hw_xfree86_modes_xf86Crtc.c
Removed Paths:
-------------
trunk/x11-servers/xorg-server/files/extra-Xext-xace.c
trunk/x11-servers/xorg-server/files/extra-Xserver-hw-xfree86-common-xf86Config.c
trunk/x11-servers/xorg-server/files/extra-Xserver-os-xprintf.c
trunk/x11-servers/xorg-server/files/extra-clang
trunk/x11-servers/xorg-server/files/extra-config_devd.c
trunk/x11-servers/xorg-server/files/extra-configure
trunk/x11-servers/xorg-server/files/extra-dix_events.c
trunk/x11-servers/xorg-server/files/extra-include_eventstr.h
trunk/x11-servers/xorg-server/files/extra-new-arch-i386
trunk/x11-servers/xorg-server/files/extra-new-bad-impl
trunk/x11-servers/xorg-server/files/extra-new-dix_dixfonts.c
trunk/x11-servers/xorg-server/files/extra-old-arch-i386
trunk/x11-servers/xorg-server/files/extra-old-dix_dixfonts.c
trunk/x11-servers/xorg-server/files/extra-os-utils.c
trunk/x11-servers/xorg-server/files/patch-xorgconf.cpp
Modified: trunk/x11-servers/mga_hal/Makefile
===================================================================
--- trunk/x11-servers/mga_hal/Makefile 2015-05-28 02:59:29 UTC (rev 19133)
+++ trunk/x11-servers/mga_hal/Makefile 2015-05-28 03:00:00 UTC (rev 19134)
@@ -3,7 +3,7 @@
PORTNAME= mga_hal
PORTVERSION= 4.4.0
-PORTREVISION= 1
+PORTREVISION= 2
CATEGORIES= x11-servers
MASTER_SITES= ftp://ftp.matrox.com/pub/mga/archive/linux/%SUBDIR%/:i386,amd64
MASTER_SITE_SUBDIR= 2006/:i386 2006/64bit/:amd64
@@ -19,6 +19,10 @@
RESTRICTED= Matrox drivers may not be distributed.
+
+
+OPTIONS_DEFINE= DOCS
+
.include <bsd.port.pre.mk>
.if ${ARCH} == "i386"
@@ -32,10 +36,8 @@
XORG_VERSION= 6.9.0
do-install:
-.if !defined(NOPORTDOCS)
${MKDIR} ${DOCSDIR}
${INSTALL_DATA} ${WRKSRC}/docs/readme.txt ${DOCSDIR}
-.endif
${MKDIR} ${PREFIX}/lib/modules/drivers
${INSTALL_DATA} ${WRKSRC}/xserver/${XORG_VERSION}/mga_hal_drv.so \
${PREFIX}/lib/modules/drivers/
Modified: trunk/x11-servers/mga_hal/pkg-plist
===================================================================
--- trunk/x11-servers/mga_hal/pkg-plist 2015-05-28 02:59:29 UTC (rev 19133)
+++ trunk/x11-servers/mga_hal/pkg-plist 2015-05-28 03:00:00 UTC (rev 19134)
@@ -1,6 +1,3 @@
%%PORTDOCS%%%%DOCSDIR%%/readme.txt
lib/modules/drivers/mga_hal_drv.so
lib/modules/drivers/mga_drv.so
- at dirrmtry lib/modules/drivers
- at dirrmtry lib/modules
-%%PORTDOCS%%@dirrm %%DOCSDIR%%
Modified: trunk/x11-servers/x2vnc/Makefile
===================================================================
--- trunk/x11-servers/x2vnc/Makefile 2015-05-28 02:59:29 UTC (rev 19133)
+++ trunk/x11-servers/x2vnc/Makefile 2015-05-28 03:00:00 UTC (rev 19134)
@@ -2,13 +2,14 @@
PORTNAME= x2vnc
PORTVERSION= 1.72
-PORTREVISION= 2
+PORTREVISION= 3
CATEGORIES= x11-servers
MASTER_SITES= http://fredrik.hubbe.net/x2vnc/
DISTNAME= ${PORTNAME}-1.7.2
MAINTAINER= ports at MidnightBSD.org
-COMMENT= A program to link multiple X and VNC servers together
+COMMENT= Program to link multiple X and VNC servers together
+
LICENSE= gpl2
GNU_CONFIGURE= yes
@@ -16,7 +17,8 @@
LDFLAGS+= -L${LOCALBASE}/lib
USE_XORG= x11 xext xrandr xxf86dga ice xinerama xrandr xrender xscrnsaver sm
-MAN1= x2vnc.1
-PLIST_FILES= bin/x2vnc
+PLIST_FILES= bin/x2vnc \
+ man/man1/x2vnc.1.gz
+
.include <bsd.port.mk>
Modified: trunk/x11-servers/x2x/Makefile
===================================================================
--- trunk/x11-servers/x2x/Makefile 2015-05-28 02:59:29 UTC (rev 19133)
+++ trunk/x11-servers/x2x/Makefile 2015-05-28 03:00:00 UTC (rev 19134)
@@ -2,19 +2,32 @@
PORTNAME= x2x
PORTVERSION= 1.27
-PORTREVISION= 4
+PORTREVISION= 5
CATEGORIES= x11-servers
-MASTER_SITES= http://cloud.github.com/downloads/dottedmag/x2x/
+MASTER_SITES= GHC
MAINTAINER= ports at MidnightBSD.org
COMMENT= A program to link multiple X servers together
LICENSE= unknown
+LICENSE= mit
+
+USE_GITHUB= yes
+GH_ACCOUNT= dottedmag
+
+WRKSRC= ${WRKDIR}/${DISTNAME}
+
+USES= imake
USE_XORG= x11 xext xtst
-USE_IMAKE= yes
-USE_GMAKE= yes
-MAKE_ENV= MAKE=${GMAKE}
-MAN1= x2x.1
-PLIST_FILES= bin/x2x
+PLIST_FILES= bin/x2x man/man1/x2x.1.gz
+
+post-extract:
+ @${LN} -sf x2x.1 ${WRKSRC}/x2x.man
+
+post-patch:
+ @${REINPLACE_CMD} -e \
+ '/CC =/s|^|XCOMM| ; \
+ /CDEBUGFLAGS =/s|^|XCOMM|' ${WRKSRC}/Imakefile
+
.include <bsd.port.mk>
Modified: trunk/x11-servers/xorg-dmx/pkg-plist
===================================================================
--- trunk/x11-servers/xorg-dmx/pkg-plist 2015-05-28 02:59:29 UTC (rev 19133)
+++ trunk/x11-servers/xorg-dmx/pkg-plist 2015-05-28 03:00:00 UTC (rev 19134)
@@ -1,8 +1,7 @@
bin/Xdmx
-%%OLD%%bin/xdmx
bin/dmxaddinput
bin/dmxaddscreen
-%%NEW%%bin/dmxinfo
+bin/dmxinfo
bin/dmxreconfig
bin/dmxresize
bin/dmxrminput
Modified: trunk/x11-servers/xorg-nestserver/Makefile
===================================================================
--- trunk/x11-servers/xorg-nestserver/Makefile 2015-05-28 02:59:29 UTC (rev 19133)
+++ trunk/x11-servers/xorg-nestserver/Makefile 2015-05-28 03:00:00 UTC (rev 19134)
@@ -1,14 +1,47 @@
# $MidnightBSD$
PORTNAME= xorg-nestserver
-PORTREVISION= 1
+PORTVERSION= 1.14.7
+PORTREVISION= 2
+PORTEPOCH= 1
+CATEGORIES= x11-servers
+MASTER_SITES= XORG/individual/xserver
+DISTNAME= xorg-server-${PORTVERSION}
+DIST_SUBDIR= xorg/xserver
MAINTAINER= ports at MidnightBSD.org
COMMENT= Nesting X server from X.Org
LICENSE= mit
-MASTERDIR= ${.CURDIR}/../xorg-server
-DESCR= ${.CURDIR}/pkg-descr
+USES= tar:bzip2 pkgconfig
+GNU_CONFIGURE= yes
+CONFIGURE_ARGS= --disable-dmx \
+ --disable-xephyr \
+ --enable-xnest \
+ --disable-xfbdev \
+ --disable-kdrive \
+ --disable-xfake \
+ --disable-screensaver \
+ --disable-xwin \
+ --disable-xwayland \
+ --disable-xorg \
+ --without-xmlto \
+ --disable-docs \
+ --disable-devel-docs \
+ --localstatedir=/var \
+ --without-dtrace \
+ --without-doxygen \
+ --disable-libpciaccess \
+ --disable-glx \
+ --disable-dri \
+ --disable-config-hal \
+ --disable-libdrm \
+ --disable-glx-tls \
+ --disable-vbe \
+ --disable-vgahw \
+ --disable-xvfb \
+ --with-fontrootdir=${PREFIX}/share/fonts
+
USE_XORG= x11 xf86driproto glproto randrproto renderproto fixesproto \
damageproto xcmiscproto xextproto xf86miscproto inputproto \
xf86vidmodeproto xf86bigfontproto scrnsaverproto bigreqsproto \
@@ -17,20 +50,11 @@
xineramaproto xinerama evieproto xkbfile xfont fontenc xkbui \
xxf86misc xxf86vm xaw7 xmu xpm xext pixman xtrans
-CONFIGURE_ARGS= --disable-dmx --disable-xvfb \
- --without-xmlto --disable-docs --disable-devel-docs \
- --localstatedir=/var --without-dtrace
+PLIST_FILES= bin/Xnest \
+ man/man1/Xnest.1.gz
-SLAVE_PORT= yes
-PLIST_FILES= bin/Xnest
-MAN1= Xnest.1
-
do-install:
- ${INSTALL_PROGRAM} ${WRKSRC}/hw/xnest/Xnest ${PREFIX}/bin/
-.if defined(WITH_NEW_XORG)
- ${INSTALL_MAN} ${WRKSRC}/hw/xnest/man/Xnest.1 ${PREFIX}/man/man1/
-.else
- ${INSTALL_MAN} ${WRKSRC}/hw/xnest/Xnest.1 ${PREFIX}/man/man1/
-.endif
+ ${INSTALL_PROGRAM} ${WRKSRC}/hw/xnest/Xnest ${STAGEDIR}${PREFIX}/bin/
+ ${INSTALL_MAN} ${WRKSRC}/hw/xnest/man/Xnest.1 ${STAGEDIR}${PREFIX}/man/man1/
-.include "${MASTERDIR}/Makefile"
+.include <bsd.port.mk>
Modified: trunk/x11-servers/xorg-nestserver/distinfo
===================================================================
--- trunk/x11-servers/xorg-nestserver/distinfo 2015-05-28 02:59:29 UTC (rev 19133)
+++ trunk/x11-servers/xorg-nestserver/distinfo 2015-05-28 03:00:00 UTC (rev 19134)
@@ -1,2 +1,2 @@
-SHA256 (xorg/xserver/xorg-server-1.10.4.tar.bz2) = fafc16b97b9a61b62dfaa74e8d336baa0cea752ce9ed8103c4d212baa8031ca5
-SIZE (xorg/xserver/xorg-server-1.10.4.tar.bz2) = 5386174
+SHA256 (xorg/xserver/xorg-server-1.14.7.tar.bz2) = fcf66fa6ad86227613d2d3e8ae13ded297e2a1e947e9060a083eaf80d323451f
+SIZE (xorg/xserver/xorg-server-1.14.7.tar.bz2) = 5520884
Modified: trunk/x11-servers/xorg-server/Makefile
===================================================================
--- trunk/x11-servers/xorg-server/Makefile 2015-05-28 02:59:29 UTC (rev 19133)
+++ trunk/x11-servers/xorg-server/Makefile 2015-05-28 03:00:00 UTC (rev 19134)
@@ -1,12 +1,11 @@
# $MidnightBSD$
PORTNAME?= xorg-server
-PORTVERSION= ${XORG_VERSION}
-PORTREVISION?= ${XORG_REVISION}
+PORTVERSION= 1.14.7
+PORTREVISION?= 5
PORTEPOCH?= 1
CATEGORIES= x11-servers
-MASTER_SITES= XORG
-MASTER_SITE_SUBDIR= individual/xserver
+MASTER_SITES= XORG/individual/xserver
DISTNAME= xorg-server-${PORTVERSION}
MAINTAINER= ports at MidnightBSD.org
@@ -21,41 +20,20 @@
XORG_CAT= xserver
SLAVE_PORT?= no
-OPTIONS_DEFINE= AIGLX SUID
+OPTIONS_SUB= yes
+OPTIONS_DEFINE= SUID
OPTIONS_RADIO= CONF
-OPTIONS_RADIO_CONF= HAL DEVD
-AIGLX_DESC= Compile with Accelerated Indirect GLX support
+OPTIONS_RADIO_CONF= HAL DEVD
SUID_DESC= Install the Xorg server with setuid bit set
HAL_DESC= Compile with HAL config support
-DEVD_DESC= Use devd for autoconfiguration of input devices (experimental)
-OPTIONS_DEFAULT=AIGLX SUID HAL
+DEVD_DESC= Use devd for autoconfiguration of input devices
+OPTIONS_DEFAULT=SUID DEVD
OPTIONS_EXCLUDE_sparc64= HAL
.include <bsd.mport.options.mk>
-.if defined(WITH_NEW_XORG)
-XORG_VERSION= 1.12.4
-XORG_REVISION= 2
-PLIST_SUB+= OLD="@comment " NEW=""
-EXTRA_PATCHES+= ${FILESDIR}/extra-clang \
- ${FILESDIR}/extra-configure \
- ${FILESDIR}/extra-new-bad-impl \
- ${FILESDIR}/extra-new-dix_dixfonts.c
-.else
-XORG_VERSION= 1.7.7
-XORG_REVISION= 8
-PLIST_SUB+= OLD="" NEW="@comment "
-EXTRA_PATCHES+= ${FILESDIR}/extra-Xext-xace.c \
- ${FILESDIR}/extra-Xserver-os-xprintf.c \
- ${FILESDIR}/extra-include_eventstr.h \
- ${FILESDIR}/extra-os-utils.c \
- ${FILESDIR}/extra-dix_events.c \
- ${FILESDIR}/extra-Xserver-hw-xfree86-common-xf86Config.c \
- ${FILESDIR}/extra-old-dix_dixfonts.c
-.endif
-
-USES= gmake libtool:keepla perl5 tar:bzip2
+USES= gmake libtool perl5 tar:bzip2
USE_PERL5= build
USE_GL= gl
USE_XORG?= xf86driproto glproto xdmcp x11 xkbfile xxf86misc xxf86vm xaw7 \
@@ -97,60 +75,33 @@
CONFIGURE_ARGS+= --enable-config-hal=no
.endif
-.if ${PORT_OPTIONS:MDEVD}
-EXTRA_PATCHES+= ${FILESDIR}/extra-config_devd.c
-.endif
+# We handle Xorg setuid in the plist. This allows to build xorg-server as a user.
+CONFIGURE_ARGS+=--disable-install-setuid
-.if ${PORT_OPTIONS:MAIGLX}
-CONFIGURE_ARGS+= --enable-aiglx=yes
-.else
-CONFIGURE_ARGS+= --enable-aiglx=no
+.if ${ARCH} == armv6
+EXTRA_PATCHES+= ${FILESDIR}/extra-arm-patch-hw__xfree86__os-support__bsd__Makefile.in
+EXTRA_PATCHES+= ${FILESDIR}/extra-arm-patch-include__servermd.h
.endif
-# We handle Xorg setuid in the plist. This allows to build xorg-server as a user
-CONFIGURE_ARGS+=--enable-install-setuid=no
-.if ${PORT_OPTIONS:MSUID}
-PLIST_SUB+= SUID=""
-.else
-PLIST_SUB+= SUID="@comment "
-.endif
-
.if ${ARCH} == i386
-.if defined(WITH_NEW_XORG)
-EXTRA_PATCHES+= ${FILESDIR}/extra-new-arch-i386
-.else
-EXTRA_PATCHES+= ${FILESDIR}/extra-old-arch-i386
+EXTRA_PATCHES+= ${FILESDIR}/extra-arch-i386
.endif
-.endif
.if ${ARCH} == ia64
-PLIST_SUB+= IA64_NA="@comment "
-EXTRA_PATCHES= ${.CURDIR}/files/extra-arch-ia64
-.else
-PLIST_SUB+= IA64_NA=""
+EXTRA_PATCHES+= ${FILESDIR}/extra-arch-ia64
.endif
.if ${ARCH} == powerpc || ${ARCH} == powerpc64
-PLIST_SUB+= PPC_NA="@comment "
-EXTRA_PATCHES= ${.CURDIR}/files/extra-arch-powerpc
-.else
-PLIST_SUB+= PPC_NA=""
+EXTRA_PATCHES+= ${FILESDIR}/extra-arch-powerpc
.endif
.if ${ARCH} == sparc64
PLIST_SUB+= SPARC64=""
-PLIST_SUB+= SPARC64_NA="@comment "
+EXTRA_PATCHES+= ${FILESDIR}/extra-arch-sparc64
.else
PLIST_SUB+= SPARC64="@comment "
-PLIST_SUB+= SPARC64_NA=""
.endif
-.if ${ARCH} == amd64 || ${ARCH} == i386 || ${ARCH} == sparc64
-PLIST_SUB+= AMD64_I386_SPARC64=""
-.else
-PLIST_SUB+= AMD64_I386_SPARC64="@comment "
-.endif
-
.if ${PORT_OPTIONS:MSUID}
pre-everything::
@${ECHO_MSG} "By default, the X Server installs as a set-user-id root binary. When run by"
@@ -168,29 +119,24 @@
@${REINPLACE_CMD} -e 's|@GLX_TRUE at GLXMODS =|@GLX_BOGUS at GLXMODS =|g' \
-e 's|^LTLIBRARIES = |LTLIBRARIES = libglx.la |g' \
${WRKSRC}/hw/xfree86/dixmods/Makefile.in
-.if ${PORT_OPTIONS:MDEVD}
- @${ECHO_CMD} -e "\nint config_devd_init(void);\nvoid config_devd_fini(void);" \
- >> ${WRKSRC}/config/config-backends.h
-.endif
-
+
post-configure:
.if ${PORT_OPTIONS:MDEVD}
@${REINPLACE_CMD} -e 's|config\.c|config.c devd.c|g' \
-e 's|config\.lo|config.lo devd.lo|g' \
${WRKSRC}/config/Makefile
+ @${REINPLACE_CMD} -e 's|^/\* #undef CONFIG_UDEV \*/|#define CONFIG_DEVD 1|' \
+ ${WRKSRC}/include/dix-config.h
.endif
.if ${SLAVE_PORT} == "no"
-pre-install:
- ${MKDIR} ${PREFIX}/lib/xorg/modules/extensions/.xorg
+post-install:
+# The .xorg dir because else the xorg-server might not load the correct
+# libglx module.
+ @${MKDIR} ${STAGEDIR}${PREFIX}/lib/xorg/modules/extensions/.xorg
${INSTALL_LIB} ${WRKSRC}/hw/xfree86/dixmods/.libs/libglx.so \
- ${PREFIX}/lib/xorg/modules/extensions/.xorg/
+ ${STAGEDIR}${PREFIX}/lib/xorg/modules/extensions/.xorg/
+ @${MKDIR} ${STAGEDIR}${PREFIX}/etc/X11/xorg.conf.d
+.endif # ! SLAVE_PORT
-post-install:
-.if defined(WITH_NEW_XORG)
- @${MKDIR} ${PREFIX}/share/X11/xorg.conf.d
-.endif
- @PKG_PREFIX=${PREFIX} ${SH} ${PKGINSTALL} ${PKGNAME} POST-INSTALL
-.endif
-
.include <bsd.port.post.mk>
Modified: trunk/x11-servers/xorg-server/distinfo
===================================================================
--- trunk/x11-servers/xorg-server/distinfo 2015-05-28 02:59:29 UTC (rev 19133)
+++ trunk/x11-servers/xorg-server/distinfo 2015-05-28 03:00:00 UTC (rev 19134)
@@ -1,4 +1,2 @@
-SHA256 (xorg/xserver/xorg-server-1.7.7.tar.bz2) = 54c4d32bfeb8852adbea3ddae6981f3bc2eadb330124d9b35226c617c01926ff
-SIZE (xorg/xserver/xorg-server-1.7.7.tar.bz2) = 4939257
-SHA256 (xorg/xserver/xorg-server-1.12.4.tar.bz2) = 8ac07c35306ba3fb3c0972722dd4e919303039eca1d40ac7862560e0b2c94cf7
-SIZE (xorg/xserver/xorg-server-1.12.4.tar.bz2) = 5444761
+SHA256 (xorg/xserver/xorg-server-1.14.7.tar.bz2) = fcf66fa6ad86227613d2d3e8ae13ded297e2a1e947e9060a083eaf80d323451f
+SIZE (xorg/xserver/xorg-server-1.14.7.tar.bz2) = 5520884
Deleted: trunk/x11-servers/xorg-server/files/extra-Xext-xace.c
===================================================================
--- trunk/x11-servers/xorg-server/files/extra-Xext-xace.c 2015-05-28 02:59:29 UTC (rev 19133)
+++ trunk/x11-servers/xorg-server/files/extra-Xext-xace.c 2015-05-28 03:00:00 UTC (rev 19134)
@@ -1,229 +0,0 @@
-From 6dae7f3792611aace1df0cca63bf50c50d93de43 Mon Sep 17 00:00:00 2001
-From: Chris Wilson <chris at chris-wilson.co.uk>
-Date: Tue, 10 Aug 2010 18:30:20 +0000
-Subject: xace: Invalid reference to out-of-scope data.
-
-The callback data passed by reference to the hook was allocated on stack
-within the scope of the case statement. The compiler is free to reuse
-any of that stack space whilst making the function call so we may end up
-passing garbage into the callback.
-
-References:
-
- Bug 18451 - Xorg server 1.5.2 SEGV during XFixesGetCursorImage()
- https://bugs.freedesktop.org/show_bug.cgi?id=18451
-
-v2: Drop the unrelated hunk that snuck in when ammending the commit
-message.
-
-Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
-Reviewed-by: Alan Coopersmith <alan.coopersmith at oracle.com>
-Signed-off-by: Keith Packard <keithp at keithp.com>
----
-diff --git a/Xext/xace.c b/Xext/xace.c
-index e10d837..c757cad 100644
---- Xext/xace.c
-+++ Xext/xace.c
-@@ -87,7 +87,18 @@ void XaceHookAuditEnd(ClientPtr ptr, int result)
- */
- int XaceHook(int hook, ...)
- {
-- pointer calldata; /* data passed to callback */
-+ union {
-+ XaceResourceAccessRec res;
-+ XaceDeviceAccessRec dev;
-+ XaceSendAccessRec send;
-+ XaceReceiveAccessRec recv;
-+ XaceClientAccessRec client;
-+ XaceExtAccessRec ext;
-+ XaceServerAccessRec server;
-+ XaceScreenAccessRec screen;
-+ XaceAuthAvailRec auth;
-+ XaceKeyAvailRec key;
-+ } u;
- int *prv = NULL; /* points to return value from callback */
- va_list ap; /* argument list */
- va_start(ap, hook);
-@@ -99,117 +110,86 @@ int XaceHook(int hook, ...)
- */
- switch (hook)
- {
-- case XACE_RESOURCE_ACCESS: {
-- XaceResourceAccessRec rec;
-- rec.client = va_arg(ap, ClientPtr);
-- rec.id = va_arg(ap, XID);
-- rec.rtype = va_arg(ap, RESTYPE);
-- rec.res = va_arg(ap, pointer);
-- rec.ptype = va_arg(ap, RESTYPE);
-- rec.parent = va_arg(ap, pointer);
-- rec.access_mode = va_arg(ap, Mask);
-- rec.status = Success; /* default allow */
-- calldata = &rec;
-- prv = &rec.status;
-+ case XACE_RESOURCE_ACCESS:
-+ u.res.client = va_arg(ap, ClientPtr);
-+ u.res.id = va_arg(ap, XID);
-+ u.res.rtype = va_arg(ap, RESTYPE);
-+ u.res.res = va_arg(ap, pointer);
-+ u.res.ptype = va_arg(ap, RESTYPE);
-+ u.res.parent = va_arg(ap, pointer);
-+ u.res.access_mode = va_arg(ap, Mask);
-+ u.res.status = Success; /* default allow */
-+ prv = &u.res.status;
- break;
-- }
-- case XACE_DEVICE_ACCESS: {
-- XaceDeviceAccessRec rec;
-- rec.client = va_arg(ap, ClientPtr);
-- rec.dev = va_arg(ap, DeviceIntPtr);
-- rec.access_mode = va_arg(ap, Mask);
-- rec.status = Success; /* default allow */
-- calldata = &rec;
-- prv = &rec.status;
-+ case XACE_DEVICE_ACCESS:
-+ u.dev.client = va_arg(ap, ClientPtr);
-+ u.dev.dev = va_arg(ap, DeviceIntPtr);
-+ u.dev.access_mode = va_arg(ap, Mask);
-+ u.dev.status = Success; /* default allow */
-+ prv = &u.dev.status;
- break;
-- }
-- case XACE_SEND_ACCESS: {
-- XaceSendAccessRec rec;
-- rec.client = va_arg(ap, ClientPtr);
-- rec.dev = va_arg(ap, DeviceIntPtr);
-- rec.pWin = va_arg(ap, WindowPtr);
-- rec.events = va_arg(ap, xEventPtr);
-- rec.count = va_arg(ap, int);
-- rec.status = Success; /* default allow */
-- calldata = &rec;
-- prv = &rec.status;
-+ case XACE_SEND_ACCESS:
-+ u.send.client = va_arg(ap, ClientPtr);
-+ u.send.dev = va_arg(ap, DeviceIntPtr);
-+ u.send.pWin = va_arg(ap, WindowPtr);
-+ u.send.events = va_arg(ap, xEventPtr);
-+ u.send.count = va_arg(ap, int);
-+ u.send.status = Success; /* default allow */
-+ prv = &u.send.status;
- break;
-- }
-- case XACE_RECEIVE_ACCESS: {
-- XaceReceiveAccessRec rec;
-- rec.client = va_arg(ap, ClientPtr);
-- rec.pWin = va_arg(ap, WindowPtr);
-- rec.events = va_arg(ap, xEventPtr);
-- rec.count = va_arg(ap, int);
-- rec.status = Success; /* default allow */
-- calldata = &rec;
-- prv = &rec.status;
-+ case XACE_RECEIVE_ACCESS:
-+ u.recv.client = va_arg(ap, ClientPtr);
-+ u.recv.pWin = va_arg(ap, WindowPtr);
-+ u.recv.events = va_arg(ap, xEventPtr);
-+ u.recv.count = va_arg(ap, int);
-+ u.recv.status = Success; /* default allow */
-+ prv = &u.recv.status;
- break;
-- }
-- case XACE_CLIENT_ACCESS: {
-- XaceClientAccessRec rec;
-- rec.client = va_arg(ap, ClientPtr);
-- rec.target = va_arg(ap, ClientPtr);
-- rec.access_mode = va_arg(ap, Mask);
-- rec.status = Success; /* default allow */
-- calldata = &rec;
-- prv = &rec.status;
-+ case XACE_CLIENT_ACCESS:
-+ u.client.client = va_arg(ap, ClientPtr);
-+ u.client.target = va_arg(ap, ClientPtr);
-+ u.client.access_mode = va_arg(ap, Mask);
-+ u.client.status = Success; /* default allow */
-+ prv = &u.client.status;
- break;
-- }
-- case XACE_EXT_ACCESS: {
-- XaceExtAccessRec rec;
-- rec.client = va_arg(ap, ClientPtr);
-- rec.ext = va_arg(ap, ExtensionEntry*);
-- rec.access_mode = DixGetAttrAccess;
-- rec.status = Success; /* default allow */
-- calldata = &rec;
-- prv = &rec.status;
-+ case XACE_EXT_ACCESS:
-+ u.ext.client = va_arg(ap, ClientPtr);
-+ u.ext.ext = va_arg(ap, ExtensionEntry*);
-+ u.ext.access_mode = DixGetAttrAccess;
-+ u.ext.status = Success; /* default allow */
-+ prv = &u.ext.status;
- break;
-- }
-- case XACE_SERVER_ACCESS: {
-- XaceServerAccessRec rec;
-- rec.client = va_arg(ap, ClientPtr);
-- rec.access_mode = va_arg(ap, Mask);
-- rec.status = Success; /* default allow */
-- calldata = &rec;
-- prv = &rec.status;
-+ case XACE_SERVER_ACCESS:
-+ u.server.client = va_arg(ap, ClientPtr);
-+ u.server.access_mode = va_arg(ap, Mask);
-+ u.server.status = Success; /* default allow */
-+ prv = &u.server.status;
- break;
-- }
- case XACE_SCREEN_ACCESS:
-- case XACE_SCREENSAVER_ACCESS: {
-- XaceScreenAccessRec rec;
-- rec.client = va_arg(ap, ClientPtr);
-- rec.screen = va_arg(ap, ScreenPtr);
-- rec.access_mode = va_arg(ap, Mask);
-- rec.status = Success; /* default allow */
-- calldata = &rec;
-- prv = &rec.status;
-+ case XACE_SCREENSAVER_ACCESS:
-+ u.screen.client = va_arg(ap, ClientPtr);
-+ u.screen.screen = va_arg(ap, ScreenPtr);
-+ u.screen.access_mode = va_arg(ap, Mask);
-+ u.screen.status = Success; /* default allow */
-+ prv = &u.screen.status;
- break;
-- }
-- case XACE_AUTH_AVAIL: {
-- XaceAuthAvailRec rec;
-- rec.client = va_arg(ap, ClientPtr);
-- rec.authId = va_arg(ap, XID);
-- calldata = &rec;
-+ case XACE_AUTH_AVAIL:
-+ u.auth.client = va_arg(ap, ClientPtr);
-+ u.auth.authId = va_arg(ap, XID);
- break;
-- }
-- case XACE_KEY_AVAIL: {
-- XaceKeyAvailRec rec;
-- rec.event = va_arg(ap, xEventPtr);
-- rec.keybd = va_arg(ap, DeviceIntPtr);
-- rec.count = va_arg(ap, int);
-- calldata = &rec;
-+ case XACE_KEY_AVAIL:
-+ u.key.event = va_arg(ap, xEventPtr);
-+ u.key.keybd = va_arg(ap, DeviceIntPtr);
-+ u.key.count = va_arg(ap, int);
- break;
-- }
-- default: {
-+ default:
- va_end(ap);
- return 0; /* unimplemented hook number */
-- }
- }
- va_end(ap);
-
- /* call callbacks and return result, if any. */
-- CallCallbacks(&XaceHooks[hook], calldata);
-+ CallCallbacks(&XaceHooks[hook], &u);
- return prv ? *prv : Success;
- }
-
---
-cgit v0.9.0.2-2-gbebe
Deleted: trunk/x11-servers/xorg-server/files/extra-Xserver-hw-xfree86-common-xf86Config.c
===================================================================
--- trunk/x11-servers/xorg-server/files/extra-Xserver-hw-xfree86-common-xf86Config.c 2015-05-28 02:59:29 UTC (rev 19133)
+++ trunk/x11-servers/xorg-server/files/extra-Xserver-hw-xfree86-common-xf86Config.c 2015-05-28 03:00:00 UTC (rev 19134)
@@ -1,11 +0,0 @@
---- hw/xfree86/common/xf86Config.c.orig Fri Jun 23 12:32:32 2006
-+++ hw/xfree86/common/xf86Config.c Fri Jun 23 12:32:46 2006
-@@ -1042,7 +1042,7 @@
- else
- xf86Info.estimateSizesAggressively = 0;
-
-- xf86Info.aiglx = TRUE;
-+ xf86Info.aiglx = FALSE;
- xf86Info.aiglxFrom = X_DEFAULT;
- if (xf86GetOptValBool(FlagOptions, FLAG_AIGLX, &value)) {
- xf86Info.aiglx = value;
Deleted: trunk/x11-servers/xorg-server/files/extra-Xserver-os-xprintf.c
===================================================================
--- trunk/x11-servers/xorg-server/files/extra-Xserver-os-xprintf.c 2015-05-28 02:59:29 UTC (rev 19133)
+++ trunk/x11-servers/xorg-server/files/extra-Xserver-os-xprintf.c 2015-05-28 03:00:00 UTC (rev 19134)
@@ -1,12 +0,0 @@
-diff -u -p programs/Xserver/os/xprintf.c.orig programs/Xserver/os/xprintf.c
---- os/xprintf.c.orig Sun Jul 3 17:53:52 2005
-+++ os/xprintf.c Thu Jan 26 12:47:37 2006
-@@ -39,7 +39,7 @@
- # ifdef __va_copy
- # define va_copy __va_copy
- # else
--# error "no working va_copy was found"
-+# define va_copy(dest, src) ((dest) = (src))
- # endif
- #endif
-
Added: trunk/x11-servers/xorg-server/files/extra-arch-i386
===================================================================
--- trunk/x11-servers/xorg-server/files/extra-arch-i386 (rev 0)
+++ trunk/x11-servers/xorg-server/files/extra-arch-i386 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,11 @@
+--- hw/xfree86/common/compiler.h.orig 2012-05-17 19:09:03.000000000 +0200
++++ hw/xfree86/common/compiler.h 2013-01-18 13:59:18.366436857 +0100
+@@ -1335,7 +1335,7 @@
+
+ #if !defined(__SUNPRO_C)
+ #if !defined(FAKEIT) && !defined(__mc68000__) && !defined(__arm__) && !defined(__sh__) && !defined(__hppa__) && !defined(__s390__) && !defined(__m32r__)
+-#ifdef GCCUSESGAS
++#if defined(GCCUSESGAS) || defined(__clang__)
+
+ /*
+ * If gcc uses gas rather than the native assembler, the syntax of these
Property changes on: trunk/x11-servers/xorg-server/files/extra-arch-i386
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Added: trunk/x11-servers/xorg-server/files/extra-arch-ia64
===================================================================
--- trunk/x11-servers/xorg-server/files/extra-arch-ia64 (rev 0)
+++ trunk/x11-servers/xorg-server/files/extra-arch-ia64 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,221 @@
+--- configure.dist 2009-06-18 17:05:59.000000000 -0700
++++ configure 2009-06-18 17:08:47.000000000 -0700
+@@ -1097,6 +1097,8 @@
+ SPARC64_VIDEO_TRUE
+ PPC_VIDEO_FALSE
+ PPC_VIDEO_TRUE
++IA64_VIDEO_FALSE
++IA64_VIDEO_TRUE
+ I386_VIDEO_FALSE
+ I386_VIDEO_TRUE
+ ARM_VIDEO_FALSE
+@@ -19134,6 +19136,7 @@
+ GLX_ARCH_DEFINES="-D__GLX_ALIGN64"
+ ;;
+ ia64*)
++ IA64_VIDEO=yes
+ GLX_ARCH_DEFINES="-D__GLX_ALIGN64"
+ ;;
+ s390*)
+@@ -19166,6 +19169,14 @@
+ I386_VIDEO_FALSE=
+ fi
+
++ if test "x$IA64_VIDEO" = xyes; then
++ IA64_VIDEO_TRUE=
++ IA64_VIDEO_FALSE='#'
++else
++ IA64_VIDEO_TRUE='#'
++ IA64_VIDEO_FALSE=
++fi
++
+ if test "x$PPC_VIDEO" = xyes; then
+ PPC_VIDEO_TRUE=
+ PPC_VIDEO_FALSE='#'
+--- hw/xfree86/common/compiler.h.orig 2011-06-11 18:55:47.000000000 +0200
++++ hw/xfree86/common/compiler.h 2011-07-21 20:34:44.000000000 +0200
+@@ -397,12 +397,10 @@
+ #include <machine/pio.h>
+ #endif /* __NetBSD__ */
+
+-# elif defined(linux) && defined(__ia64__)
++# elif (defined(linux) || defined(__FreeBSD__)) && defined(__ia64__)
+
+ # include <inttypes.h>
+
+-# include <sys/io.h>
+-
+ # undef outb
+ # undef outw
+ # undef outl
+--- hw/xfree86/os-support/bsd/Makefile.in.dist 2009-06-18 17:45:13.000000000 -0700
++++ hw/xfree86/os-support/bsd/Makefile.in 2009-06-18 17:45:19.000000000 -0700
+@@ -63,6 +63,7 @@
+ @ALPHA_VIDEO_FALSE@@ARM_VIDEO_FALSE@@I386_VIDEO_FALSE@@PPC_VIDEO_FALSE@@SPARC64_VIDEO_TRUE at am__objects_1 = sparc64_video.lo \
+ @ALPHA_VIDEO_FALSE@@ARM_VIDEO_FALSE@@I386_VIDEO_FALSE@@PPC_VIDEO_FALSE@@SPARC64_VIDEO_TRUE@ ioperm_noop.lo
+ @ALPHA_VIDEO_FALSE@@ARM_VIDEO_FALSE@@I386_VIDEO_FALSE@@PPC_VIDEO_TRUE at am__objects_1 = ppc_video.lo
++ at IA64_VIDEO_TRUE@am__objects_1 = ia64_video.lo
+ @ALPHA_VIDEO_FALSE@@ARM_VIDEO_FALSE@@I386_VIDEO_TRUE at am__objects_1 = i386_video.lo
+ @ALPHA_VIDEO_FALSE@@ARM_VIDEO_TRUE at am__objects_1 = arm_video.lo
+ @ALPHA_VIDEO_TRUE at am__objects_1 = alpha_video.lo bsd_ev56.lo \
+@@ -393,6 +394,7 @@
+
+ @ARM_VIDEO_TRUE at ARCH_SOURCES = arm_video.c
+ @I386_VIDEO_TRUE at ARCH_SOURCES = i386_video.c
++ at IA64_VIDEO_TRUE@ARCH_SOURCES = ia64_video.c
+ @PPC_VIDEO_TRUE at ARCH_SOURCES = ppc_video.c
+
+ # Cheat here and piggyback other sparc64 bits on SPARC64_VIDEO.
+--- /dev/null 2009-06-18 18:27:23.000000000 -0700
++++ hw/xfree86/os-support/bsd/ia64_video.c 2009-06-18 18:26:02.000000000 -0700
+@@ -0,0 +1,150 @@
++#ifdef HAVE_XORG_CONFIG_H
++#include <xorg-config.h>
++#endif
++
++#include <X11/X.h>
++#include "xf86.h"
++#include "xf86Priv.h"
++
++#include "xf86_OSlib.h"
++#include "xf86OSpriv.h"
++
++#include "bus/Pci.h"
++
++#ifndef MAP_FAILED
++#define MAP_FAILED ((caddr_t)-1)
++#endif
++
++
++/***************************************************************************/
++/* Video Memory Mapping section */
++/***************************************************************************/
++
++#define DEV_MEM "/dev/mem"
++
++static pointer ia64MapVidMem(int, unsigned long, unsigned long, int flags);
++static void ia64UnmapVidMem(int, pointer, unsigned long);
++
++Bool xf86EnableIO(void);
++void xf86DisableIO(void);
++
++void
++xf86OSInitVidMem(VidMemInfoPtr pVidMem)
++{
++ pVidMem->linearSupported = TRUE;
++ pVidMem->mapMem = ia64MapVidMem;
++ pVidMem->unmapMem = ia64UnmapVidMem;
++ pVidMem->initialised = TRUE;
++ xf86EnableIO();
++}
++
++
++_X_EXPORT volatile unsigned char *ioBase = MAP_FAILED;
++
++static pointer
++ia64MapVidMem(int ScreenNum, unsigned long Base, unsigned long Size, int flags)
++{
++ int fd = xf86Info.screenFd;
++ pointer base;
++#ifdef DEBUG
++ xf86MsgVerb(X_INFO, 3, "mapVidMem %lx, %lx, fd = %d",
++ Base, Size, fd);
++#endif
++
++ base = mmap(0, Size,
++ (flags & VIDMEM_READONLY) ?
++ PROT_READ : (PROT_READ | PROT_WRITE),
++ MAP_SHARED, fd, Base);
++ if (base == MAP_FAILED)
++ FatalError("%s: could not mmap screen [s=%lx,a=%lx] (%s)",
++ "xf86MapVidMem", Size, Base, strerror(errno));
++
++ return base;
++}
++
++static void
++ia64UnmapVidMem(int ScreenNum, pointer Base, unsigned long Size)
++{
++ munmap(Base, Size);
++}
++
++_X_EXPORT int
++xf86ReadBIOS(unsigned long Base, unsigned long Offset, unsigned char *Buf,
++ int Len)
++{
++ int rv;
++ static int kmem = -1;
++
++ if (kmem == -1) {
++ kmem = open(DEV_MEM, 2);
++ if (kmem == -1) {
++ FatalError("xf86ReadBIOS: open %s", DEV_MEM);
++ }
++ }
++
++#ifdef DEBUG
++ xf86MsgVerb(X_INFO, 3, "xf86ReadBIOS() %lx %lx, %x\n",
++ Base, Offset, Len);
++#endif
++
++
++ lseek(kmem, Base + Offset, 0);
++ rv = read(kmem, Buf, Len);
++
++ return rv;
++}
++
++Bool xf86EnableIO()
++{
++ int fd = xf86Info.screenFd;
++
++ xf86MsgVerb(X_WARNING, 3, "xf86EnableIO %d\n", fd);
++ if (ioBase == MAP_FAILED)
++ {
++ ioBase=mmap(NULL, 0x10000, PROT_READ|PROT_WRITE, MAP_SHARED, fd,
++ 0);
++ xf86MsgVerb(X_INFO, 3, "xf86EnableIO: %p\n", ioBase);
++ if (ioBase == MAP_FAILED) {
++ xf86MsgVerb(X_WARNING, 3, "Can't map IO space!\n");
++ return FALSE;
++ }
++ }
++ return TRUE;
++}
++
++void xf86DisableIO()
++{
++
++ if (ioBase != MAP_FAILED)
++ {
++ munmap((void *)(uintptr_t)(void *)ioBase, 0x10000);
++ ioBase = MAP_FAILED;
++ }
++}
++
++void outb(unsigned long port, unsigned char val)
++{
++}
++
++void outw(unsigned long port, unsigned short val)
++{
++}
++
++void outl(unsigned long port, unsigned int val)
++{
++}
++
++unsigned int inb(unsigned long port)
++{
++ return 0xff;
++}
++
++unsigned int inw(unsigned long port)
++{
++ return 0xffff;
++}
++
++unsigned int inl(unsigned long port)
++{
++ return 0xffffffff;
++}
Property changes on: trunk/x11-servers/xorg-server/files/extra-arch-ia64
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Added: trunk/x11-servers/xorg-server/files/extra-arch-powerpc
===================================================================
--- trunk/x11-servers/xorg-server/files/extra-arch-powerpc (rev 0)
+++ trunk/x11-servers/xorg-server/files/extra-arch-powerpc 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,70 @@
+--- hw/xfree86/os-support/bsd/ppc_video.c.orig 2014-07-22 07:52:58.000000000 -0700
++++ hw/xfree86/os-support/bsd/ppc_video.c 2014-07-22 08:00:21.000000000 -0700
+@@ -44,6 +44,8 @@
+ #define DEV_MEM "/dev/xf86"
+ #endif
+
++static int kmem = -1;
++
+ static pointer ppcMapVidMem(int, unsigned long, unsigned long, int flags);
+ static void ppcUnmapVidMem(int, pointer, unsigned long);
+
+@@ -68,6 +70,17 @@
+ int fd = xf86Info.consoleFd;
+ pointer base;
+
++#ifdef __FreeBSD__
++ if (kmem == -1) {
++ kmem = open(DEV_MEM, 2);
++ if (kmem == -1) {
++ FatalError("mapVidMem: open %s", DEV_MEM);
++ }
++ }
++
++ fd = kmem;
++#endif
++
+ #ifdef DEBUG
+ xf86MsgVerb(X_INFO, 3, "mapVidMem %lx, %lx, fd = %d", Base, Size, fd);
+ #endif
+@@ -93,7 +106,6 @@
+ int Len)
+ {
+ int rv;
+- static int kmem = -1;
+
+ if (kmem == -1) {
+ kmem = open(DEV_MEM, 2);
+@@ -118,6 +130,8 @@
+ int fd = xf86Info.consoleFd;
+
+ xf86MsgVerb(X_WARNING, 3, "xf86EnableIO %d\n", fd);
++
++#ifndef __FreeBSD__
+ if (ioBase == MAP_FAILED) {
+ ioBase = mmap(NULL, 0x10000, PROT_READ | PROT_WRITE, MAP_SHARED, fd,
+ 0xf2000000);
+@@ -127,6 +141,12 @@
+ return FALSE;
+ }
+ }
++#endif
++ /*
++ * Note that outl() etc. check for ioBase == MAP_FAILED, so leaving it that
++ * way (e.g. on FreeBSD) is non-fatal.
++ */
++
+ return TRUE;
+ }
+
+@@ -134,8 +154,10 @@
+ xf86DisableIO()
+ {
+
++#ifndef __FreeBSD__
+ if (ioBase != MAP_FAILED) {
+ munmap(__UNVOLATILE(ioBase), 0x10000);
+ ioBase = MAP_FAILED;
+ }
++#endif
+ }
Property changes on: trunk/x11-servers/xorg-server/files/extra-arch-powerpc
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Added: trunk/x11-servers/xorg-server/files/extra-arch-sparc64
===================================================================
--- trunk/x11-servers/xorg-server/files/extra-arch-sparc64 (rev 0)
+++ trunk/x11-servers/xorg-server/files/extra-arch-sparc64 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,12 @@
+--- hw/xfree86/os-support/bsd/bsd_init.c.orig 2012-05-17 19:09:03.000000000 +0200
++++ hw/xfree86/os-support/bsd/bsd_init.c 2013-09-01 20:45:36.000000000 +0200
+@@ -230,6 +230,9 @@
+ * Add cases for other *BSD that behave the same.
+ */
+ #if defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
++#if defined(__sparc64__)
++ pci_system_init_dev_mem(fd);
++#endif
+ uname(&uts);
+ i = atof(uts.release) * 100;
+ if (i >= 310)
Property changes on: trunk/x11-servers/xorg-server/files/extra-arch-sparc64
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Deleted: trunk/x11-servers/xorg-server/files/extra-clang
===================================================================
--- trunk/x11-servers/xorg-server/files/extra-clang 2015-05-28 02:59:29 UTC (rev 19133)
+++ trunk/x11-servers/xorg-server/files/extra-clang 2015-05-28 03:00:00 UTC (rev 19134)
@@ -1,98 +0,0 @@
---- dix/events.c.orig 2012-07-09 02:32:59.000000000 +0200
-+++ dix/events.c 2012-07-22 14:34:46.000000000 +0200
-@@ -5189,7 +5189,8 @@
- InitEvents(void)
- {
- int i;
-- QdEventPtr qe, tmp;
-+ QdEventPtr qe = NULL;
-+ QdEventPtr tmp;
-
- inputInfo.numDevices = 0;
- inputInfo.devices = (DeviceIntPtr) NULL;
---- hw/xfree86/common/xf86Xinput.c.orig 2012-06-26 08:24:18.000000000 +0200
-+++ hw/xfree86/common/xf86Xinput.c 2012-07-22 14:34:46.000000000 +0200
-@@ -524,7 +524,7 @@
- MatchAttrToken(const char *attr, struct xorg_list *patterns,
- int (*compare) (const char *attr, const char *pattern))
- {
-- const xf86MatchGroup *group;
-+ const xf86MatchGroup *group = NULL;
-
- /* If there are no patterns, accept the match */
- if (xorg_list_is_empty(patterns))
---- hw/xfree86/dri2/dri2.c.orig 2012-07-09 02:32:59.000000000 +0200
-+++ hw/xfree86/dri2/dri2.c 2012-07-22 14:38:42.000000000 +0200
-@@ -239,7 +239,7 @@
- static DRI2DrawableRefPtr
- DRI2LookupDrawableRef(DRI2DrawablePtr pPriv, XID id)
- {
-- DRI2DrawableRefPtr ref;
-+ DRI2DrawableRefPtr ref = NULL;
-
- xorg_list_for_each_entry(ref, &pPriv->reference_list, link) {
- if (ref->id == id)
-@@ -306,7 +306,8 @@
- {
- DRI2DrawablePtr pPriv = p;
- DRI2ScreenPtr ds = pPriv->dri2_screen;
-- DRI2DrawableRefPtr ref, next;
-+ DRI2DrawableRefPtr ref = NULL;
-+ DRI2DrawableRefPtr next;
- WindowPtr pWin;
- PixmapPtr pPixmap;
- DrawablePtr pDraw;
-@@ -587,7 +588,7 @@
- DRI2InvalidateDrawable(DrawablePtr pDraw)
- {
- DRI2DrawablePtr pPriv = DRI2GetDrawable(pDraw);
-- DRI2DrawableRefPtr ref;
-+ DRI2DrawableRefPtr ref = NULL;
-
- if (!pPriv || !pPriv->needInvalidate)
- return;
---- test/list.c.orig 2012-06-26 06:12:51.000000000 +0200
-+++ test/list.c 2012-07-22 14:34:46.000000000 +0200
-@@ -187,7 +187,7 @@
- {
- struct parent parent = { 0 };
- struct child child[3];
-- struct child *c;
-+ struct child *c = NULL;
- int i = 0;
-
- xorg_list_init(&parent.children);
---- xfixes/cursor.c.orig 2012-07-06 07:17:19.000000000 +0200
-+++ xfixes/cursor.c 2012-07-22 14:34:46.000000000 +0200
-@@ -1143,7 +1143,7 @@
- barrier_find_nearest(CursorScreenPtr cs, int dir,
- int x1, int y1, int x2, int y2)
- {
-- struct PointerBarrierClient *c;
-+ struct PointerBarrierClient *c = NULL;
- struct PointerBarrier *nearest = NULL;
- double min_distance = INT_MAX; /* can't get higher than that in X anyway */
-
---- hw/xfree86/parser/InputClass.c.orig 2013-07-04 11:45:42.139818164 +0200
-+++ hw/xfree86/parser/InputClass.c 2013-07-04 11:46:29.034806839 +0200
-@@ -362,7 +362,8 @@
- XF86ConfInputClassPtr prev;
-
- while (ptr) {
-- xf86MatchGroup *group, *next;
-+ xf86MatchGroup *group = NULL;
-+ xf86MatchGroup *next;
- char **list;
-
- TestFree(ptr->identifier);
---- hw/xfree86/loader/loadmod.c.orig 2013-07-04 11:48:11.160800614 +0200
-+++ hw/xfree86/loader/loadmod.c 2013-07-04 11:48:32.000800157 +0200
-@@ -472,7 +472,7 @@
- char **elem;
- const char **subdirs;
- const char **s;
-- PatternPtr patterns;
-+ PatternPtr patterns = NULL;
- PatternPtr p;
- DIR *d;
- struct dirent *dp;
Deleted: trunk/x11-servers/xorg-server/files/extra-config_devd.c
===================================================================
--- trunk/x11-servers/xorg-server/files/extra-config_devd.c 2015-05-28 02:59:29 UTC (rev 19133)
+++ trunk/x11-servers/xorg-server/files/extra-config_devd.c 2015-05-28 03:00:00 UTC (rev 19134)
@@ -1,481 +0,0 @@
---- /dev/null 2013-08-03 00:44:23.000000000 +0200
-+++ config/devd.c 2013-08-03 00:45:15.162836806 +0200
-@@ -0,0 +1,478 @@
-+/*
-+ * Copyright © 2012 Baptiste Daroussin
-+ *
-+ * Permission is hereby granted, free of charge, to any person obtaining a
-+ * copy of this software and associated documentation files (the "Software"),
-+ * to deal in the Software without restriction, including without limitation
-+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
-+ * and/or sell copies of the Software, and to permit persons to whom the
-+ * Software is furnished to do so, subject to the following conditions:
-+ *
-+ * The above copyright notice and this permission notice (including the next
-+ * paragraph) shall be included in all copies or substantial portions of the
-+ * Software.
-+ *
-+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
-+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
-+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
-+ * DEALINGS IN THE SOFTWARE.
-+ *
-+ * Author: Baptiste Daroussin <bapt at FreeBSD.org>
-+ */
-+
-+#ifdef HAVE_DIX_CONFIG_H
-+#include <dix-config.h>
-+#endif
-+
-+#include <sys/types.h>
-+#include <sys/socket.h>
-+#include <sys/sysctl.h>
-+#include <sys/un.h>
-+
-+#include <ctype.h>
-+#include <stdlib.h>
-+#include <stdio.h>
-+#include <stdarg.h>
-+#include <stdbool.h>
-+#include <unistd.h>
-+
-+#include "input.h"
-+#include "inputstr.h"
-+#include "hotplug.h"
-+#include "config-backends.h"
-+#include "os.h"
-+
-+#define DEVD_SOCK_PATH "/var/run/devd.pipe"
-+
-+#define DEVD_EVENT_ADD '+'
-+#define DEVD_EVENT_REMOVE '-'
-+
-+static int sock_devd = -1;
-+
-+#if XORG_VERSION_CURRENT < 10800000
-+enum {
-+ ATTR_KEYBOARD,
-+ ATTR_POINTER,
-+ ATTR_JOYSTICK,
-+ ATTR_TOUCHPAD,
-+ ATTR_TOUCHSCREEN,
-+};
-+#endif
-+
-+struct hw_type {
-+ const char *driver;
-+ int flag;
-+ const char *xdriver;
-+};
-+
-+static struct hw_type hw_types[] = {
-+ { "ukbd", ATTR_KEYBOARD, "kdb" },
-+ { "atkbd", ATTR_KEYBOARD, "kdb" },
-+ { "ums", ATTR_POINTER, "mouse" },
-+ { "psm", ATTR_POINTER, "mouse" },
-+ { "uhid", ATTR_POINTER, "mouse" },
-+ { "joy", ATTR_JOYSTICK, NULL },
-+ { "atp", ATTR_TOUCHPAD, NULL },
-+ { "uep", ATTR_TOUCHSCREEN, NULL },
-+ { NULL, -1, NULL },
-+};
-+
-+#if XORG_VERSION_CURRENT < 10800000
-+static void
-+add_option(InputOption **options, const char *key, const char *value)
-+{
-+ if (!value || *value == '\0')
-+ return;
-+
-+ for (; *options; options = &(*options)->next)
-+ ;
-+ *options = calloc(sizeof(**options), 1);
-+ if (!*options) /* Yeesh. */
-+ return;
-+ (*options)->key = xstrdup(key);
-+ (*options)->value = xstrdup(value);
-+ (*options)->next = NULL;
-+}
-+
-+static void
-+remove_device(DeviceIntPtr dev)
-+{
-+ /* this only gets called for devices that have already been added */
-+ LogMessage(X_INFO, "config/devd: removing device %s\n", dev->name);
-+
-+ /* Call PIE here so we don't try to dereference a device that's
-+ * already been removed. */
-+ OsBlockSignals();
-+ ProcessInputEvents();
-+ DeleteInputDeviceRequest(dev);
-+ OsReleaseSignals();
-+}
-+
-+static bool
-+device_is_duplicate(char *config_info)
-+{
-+ DeviceIntPtr dev;
-+
-+ for (dev = inputInfo.devices; dev; dev = dev->next)
-+ if (dev->config_info && (strcmp(dev->config_info, config_info) == 0))
-+ return true;
-+
-+ for (dev = inputInfo.off_devices; dev; dev = dev->next)
-+ if (dev->config_info && (strcmp(dev->config_info, config_info) == 0))
-+ return true;
-+
-+ return false;
-+}
-+
-+#endif
-+
-+static bool
-+sysctl_exists(const char *format, ...)
-+{
-+ va_list args;
-+ char *name = NULL;
-+ size_t len;
-+ int ret;
-+
-+ if (format == NULL)
-+ return false;
-+
-+ va_start(args, format);
-+ vasprintf(&name, format, args);
-+ va_end(args);
-+
-+ ret = sysctlbyname(name, NULL, &len, NULL, 0);
-+
-+ if (ret == -1)
-+ len = 0;
-+
-+ free(name);
-+ return (len > 0);
-+}
-+
-+static char *
-+sysctl_get_str(const char *format, ...)
-+{
-+ va_list args;
-+ char *name = NULL;
-+ char *dest = NULL;
-+ size_t len;
-+
-+ if (format == NULL)
-+ return NULL;
-+
-+ va_start(args, format);
-+ vasprintf(&name, format, args);
-+ va_end(args);
-+
-+ if (sysctlbyname(name, NULL, &len, NULL, 0) == 0) {
-+ dest = malloc(len + 1);
-+ if (sysctlbyname(name, dest, &len, NULL, 0) == 0)
-+ dest[len] = '\0';
-+ else {
-+ free(dest);
-+ dest = NULL;
-+ }
-+ }
-+
-+ free(name);
-+ return dest;
-+}
-+
-+static void
-+device_added(char *line)
-+{
-+ char *walk;
-+ char *path;
-+ char *vendor;
-+ char *product = NULL;
-+ char *config_info = NULL;
-+ InputOption *options = NULL;
-+#if XORG_VERSION_CURRENT > 10800000
-+ InputAttributes attrs = {};
-+#else
-+ InputOption *tmpo;
-+#endif
-+ DeviceIntPtr dev = NULL;
-+ int i, rc;
-+
-+ walk = strchr(line, ' ');
-+ if (walk != NULL)
-+ walk[0] = '\0';
-+
-+ for (i = 0; hw_types[i].driver != NULL; i++) {
-+ if (strncmp(line, hw_types[i].driver,
-+ strlen(hw_types[i].driver)) == 0 &&
-+ isnumber(*(line + strlen(hw_types[i].driver)))) {
-+#if XORG_VERSION_CURRENT > 10800000
-+ attrs.flags |= hw_types[i].flag;
-+#endif
-+ break;
-+ }
-+ }
-+ if (hw_types[i].driver == NULL) {
-+ LogMessageVerb(X_INFO, 10, "config/devd: ignoring device %s\n", line);
-+ return;
-+ }
-+
-+#if XORG_VERSION_CURRENT < 10800000
-+ if (hw_types[i].xdriver == NULL) {
-+ LogMessageVerb(X_INFO, 10, "config/devd: ignoring device %s\n", line);
-+ return;
-+ }
-+#endif
-+ if (asprintf(&path, "/dev/%s", line) == -1)
-+ return;
-+
-+#if XORG_VERSION_CURRENT < 10800000
-+ options = calloc(sizeof(*options), 1);
-+ if (!options)
-+ return;
-+
-+ add_option(&options, "_source", "server/devd");
-+#else
-+ options = input_option_new(NULL, "_source", "server/devd");
-+ if (!options)
-+ return;
-+#endif
-+
-+ vendor = sysctl_get_str("dev.%s.%s.%%desc", hw_types[i].driver, line + strlen(hw_types[i].driver));
-+ if (vendor == NULL) {
-+#if XORG_VERSION_CURRENT > 10800000
-+ attrs.vendor = strdup("(unnamed)");
-+#endif
-+ } else {
-+ if ((product = strchr(vendor, ' ')) != NULL) {
-+ product[0] = '\0';
-+ product++;
-+ }
-+#if XORG_VERSION_CURRENT > 10800000
-+ attrs.vendor = strdup(vendor);
-+#endif
-+ if (product != NULL && (walk = strchr(product, ',')) != NULL)
-+ walk[0] = '\0';
-+#if XORG_VERSION_CURRENT > 10800000
-+ attrs.product = strdup(product != NULL ? product : "(unnamed)");
-+ options = input_option_new(options, "name", product != NULL ? product : "(unnamed)");
-+#else
-+ add_option(&options, "name", product != NULL ? product : "(unnamed)");
-+#endif
-+ }
-+#if XORG_VERSION_CURRENT > 10800000
-+ attrs.usb_id = NULL;
-+ options = input_option_new(options, "path", path);
-+ options = input_option_new(options, "device", path);
-+#else
-+ add_option(&options, "path", path);
-+ add_option(&options, "device", path);
-+#endif
-+
-+#if XORG_VERSION_CURRENT < 10800000
-+ add_option(&options, "driver", hw_types[i].xdriver);
-+#endif
-+
-+ if (asprintf(&config_info, "devd:%s", line) == -1) {
-+ config_info = NULL;
-+ goto unwind;
-+ }
-+
-+ if (device_is_duplicate(config_info)) {
-+ LogMessage(X_WARNING, "config/devd: device %s already added. "
-+ "Ignoring.\n", product != NULL ? product : "(unnamed)");
-+ goto unwind;
-+ }
-+
-+#if XORG_VERSION_CURRENT < 10800000
-+ add_option(&options, "config_info", config_info);
-+#else
-+ options = input_option_new(options, "config_info", config_info);
-+#endif
-+ LogMessage(X_INFO, "config/devd: Adding input device %s (%s)\n",
-+ product != NULL ? product : "(unnamed)", path);
-+
-+#if XORG_VERSION_CURRENT > 10800000
-+ rc = NewInputDeviceRequest(options, &attrs, &dev);
-+#else
-+ rc = NewInputDeviceRequest(options, &dev);
-+#endif
-+
-+ if (rc != Success)
-+ goto unwind;
-+
-+ unwind:
-+ free(config_info);
-+#if XORG_VERSION_CURRENT < 10800000
-+ while ((tmpo = options)) {
-+ options = tmpo->next;
-+ free(tmpo->key); /* NULL if dev != NULL */
-+ free(tmpo->value); /* NULL if dev != NULL */
-+ free(tmpo);
-+ }
-+#else
-+ input_option_free_list(&options);
-+#endif
-+
-+#if XORG_VERSION_CURRENT > 10800000
-+ free(attrs.usb_id);
-+ free(attrs.product);
-+ free(attrs.device);
-+ free(attrs.vendor);
-+#endif
-+
-+ return;
-+}
-+
-+static void
-+device_removed(char *line)
-+{
-+ char *walk;
-+ char *value;
-+#if XORG_VERSION_CURRENT < 10800000
-+ DeviceIntPtr dev, next;
-+#endif
-+
-+ walk = strchr(line, ' ');
-+ if (walk != NULL)
-+ walk[0] = '\0';
-+
-+ if (asprintf(&value, "devd:%s", line) == -1)
-+ return;
-+
-+#if XORG_VERSION_CURRENT > 10800000
-+ remove_devices("dev", value);
-+#else
-+ for (dev = inputInfo.devices; dev; dev = next) {
-+ next = dev->next;
-+ if (dev->config_info && strcmp(dev->config_info, value) == 0)
-+ remove_device(dev);
-+ }
-+ for (dev = inputInfo.off_devices; dev; dev = next) {
-+ next = dev->next;
-+ if (dev->config_info && strcmp(dev->config_info, value) == 0)
-+ remove_device(dev);
-+ }
-+#endif
-+
-+ free(value);
-+}
-+
-+static ssize_t
-+socket_getline(int fd, char **out)
-+{
-+ char *buf;
-+ ssize_t ret, cap, sz = 0;
-+ char c;
-+
-+ cap = 1024;
-+ buf = malloc(cap * sizeof(char));
-+ if (!buf)
-+ return -1;
-+
-+ for (;;) {
-+ ret = read(sock_devd, &c, 1);
-+ if (ret < 1) {
-+ free(buf);
-+ return -1;
-+ }
-+
-+ if (c == '\n')
-+ break;
-+
-+ if (sz + 1 >= cap) {
-+ cap *= 2;
-+ buf = realloc(buf, cap *sizeof(char));
-+ }
-+ buf[sz] = c;
-+ sz++;
-+ }
-+
-+ buf[sz] = '\0';
-+ if (sz > 0)
-+ *out = buf;
-+ else
-+ free(buf);
-+
-+ return sz; /* number of bytes in the line, not counting the line break*/
-+}
-+
-+static void
-+wakeup_handler(pointer data, int err, pointer read_mask)
-+{
-+ char *line = NULL;
-+
-+ if (err < 0)
-+ return;
-+
-+ if (FD_ISSET(sock_devd, (fd_set *)read_mask)) {
-+ if (socket_getline(sock_devd, &line) < 0)
-+ return;
-+
-+ switch(*line) {
-+ case DEVD_EVENT_ADD:
-+ device_added(line++);
-+ break;
-+ case DEVD_EVENT_REMOVE:
-+ device_removed(line++);
-+ break;
-+ default:
-+ break;
-+ }
-+ free(line);
-+ }
-+}
-+
-+static void
-+block_handler(pointer data, struct timeval **tv, pointer read_mask)
-+{
-+}
-+
-+int
-+config_devd_init(void)
-+{
-+ struct sockaddr_un devd;
-+ char devicename[1024];
-+ int i, j;
-+
-+ /* first scan the sysctl to determine the hardware if needed */
-+
-+ for (i = 0; hw_types[i].driver != NULL; i++) {
-+ for (j = 0; sysctl_exists("dev.%s.%i.%%desc", hw_types[i].driver, j); j++) {
-+ snprintf(devicename, 1024, "%s%i", hw_types[i].driver, j);
-+ device_added(devicename);
-+ }
-+
-+ }
-+ sock_devd = socket(AF_UNIX, SOCK_STREAM, 0);
-+ if (sock_devd < 0) {
-+ ErrorF("config/devd: Fail opening stream socket");
-+ return 0;
-+ }
-+
-+ devd.sun_family = AF_UNIX;
-+ strlcpy(devd.sun_path, DEVD_SOCK_PATH, sizeof(devd.sun_path));
-+
-+ if (connect(sock_devd, (struct sockaddr *) &devd, sizeof(struct sockaddr_un)) < 0) {
-+ close(sock_devd);
-+ ErrorF("config/devd: Fail to connect to devd");
-+ return 0;
-+ }
-+
-+ RegisterBlockAndWakeupHandlers(block_handler, wakeup_handler, NULL);
-+ AddGeneralSocket(sock_devd);
-+
-+ return 1;
-+}
-+
-+void
-+config_devd_fini(void)
-+{
-+ if (sock_devd < 0)
-+ return;
-+
-+ RemoveGeneralSocket(sock_devd);
-+ RemoveBlockAndWakeupHandlers(block_handler, wakeup_handler, NULL);
-+ close(sock_devd);
-+}
Deleted: trunk/x11-servers/xorg-server/files/extra-configure
===================================================================
--- trunk/x11-servers/xorg-server/files/extra-configure 2015-05-28 02:59:29 UTC (rev 19133)
+++ trunk/x11-servers/xorg-server/files/extra-configure 2015-05-28 03:00:00 UTC (rev 19134)
@@ -1,11 +0,0 @@
---- configure.orig 2013-09-07 22:11:27.210621324 +0200
-+++ configure 2013-09-07 22:11:52.912624338 +0200
-@@ -22839,7 +22839,7 @@
- }
- _ACEOF
- if ac_fn_c_try_compile "$LINENO"; then :
-- ac_cv_tls=$kw
-+ ac_cv_tls=$kw; break ;
- fi
- rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
- done
Deleted: trunk/x11-servers/xorg-server/files/extra-dix_events.c
===================================================================
--- trunk/x11-servers/xorg-server/files/extra-dix_events.c 2015-05-28 02:59:29 UTC (rev 19133)
+++ trunk/x11-servers/xorg-server/files/extra-dix_events.c 2015-05-28 03:00:00 UTC (rev 19134)
@@ -1,89 +0,0 @@
---- dix/events.c.orig 2010-05-04 02:47:57.000000000 +0200
-+++ dix/events.c 2012-04-24 12:59:22.000000000 +0200
-@@ -3440,7 +3440,6 @@ CheckPassiveGrabsOnWindow(
- {
- DeviceIntPtr gdev;
- XkbSrvInfoPtr xkbi = NULL;
-- Mask mask = 0;
-
- gdev= grab->modifierDevice;
- if (grab->grabtype == GRABTYPE_CORE)
-@@ -3555,9 +3554,6 @@ CheckPassiveGrabsOnWindow(
- }
- xE = &core;
- count = 1;
-- mask = grab->eventMask;
-- if (grab->ownerEvents)
-- mask |= pWin->eventMask;
- } else if (match & XI2_MATCH)
- {
- rc = EventToXI2((InternalEvent*)event, &xE);
-@@ -3569,34 +3565,6 @@ CheckPassiveGrabsOnWindow(
- continue;
- }
- count = 1;
--
-- /* FIXME: EventToXI2 returns NULL for enter events, so
-- * dereferencing the event is bad. Internal event types are
-- * aligned with core events, so the else clause is valid.
-- * long-term we should use internal events for enter/focus
-- * as well */
-- if (xE)
-- mask = grab->xi2mask[device->id][((xGenericEvent*)xE)->evtype/8];
-- else if (event->type == XI_Enter || event->type == XI_FocusIn)
-- mask = grab->xi2mask[device->id][event->type/8];
--
-- if (grab->ownerEvents && wOtherInputMasks(grab->window))
-- {
-- InputClientsPtr icp =
-- wOtherInputMasks(grab->window)->inputClients;
--
-- while(icp)
-- {
-- if (rClient(icp) == rClient(grab))
-- {
-- int evtype = (xE) ? ((xGenericEvent*)xE)->evtype : event->type;
-- mask |= icp->xi2mask[device->id][evtype/8];
-- break;
-- }
--
-- icp = icp->next;
-- }
-- }
- } else
- {
- rc = EventToXI((InternalEvent*)event, &xE, &count);
-@@ -3607,23 +3575,6 @@ CheckPassiveGrabsOnWindow(
- "(%d, %d).\n", device->name, event->type, rc);
- continue;
- }
-- mask = grab->eventMask;
-- if (grab->ownerEvents && wOtherInputMasks(grab->window))
-- {
-- InputClientsPtr icp =
-- wOtherInputMasks(grab->window)->inputClients;
--
-- while(icp)
-- {
-- if (rClient(icp) == rClient(grab))
-- {
-- mask |= icp->mask[device->id];
-- break;
-- }
--
-- icp = icp->next;
-- }
-- }
- }
-
- (*grabinfo->ActivateGrab)(device, grab, currentTime, TRUE);
-@@ -3632,7 +3583,8 @@ CheckPassiveGrabsOnWindow(
- {
- FixUpEventFromWindow(device, xE, grab->window, None, TRUE);
-
-- TryClientEvents(rClient(grab), device, xE, count, mask,
-+ TryClientEvents(rClient(grab), device, xE, count,
-+ GetEventFilter(device, xE),
- GetEventFilter(device, xE), grab);
- }
-
Deleted: trunk/x11-servers/xorg-server/files/extra-include_eventstr.h
===================================================================
--- trunk/x11-servers/xorg-server/files/extra-include_eventstr.h 2015-05-28 02:59:29 UTC (rev 19133)
+++ trunk/x11-servers/xorg-server/files/extra-include_eventstr.h 2015-05-28 03:00:00 UTC (rev 19134)
@@ -1,14 +0,0 @@
---- include/eventstr.h.orig 2012-02-05 19:23:06.000000000 +0100
-+++ include/eventstr.h 2012-02-05 19:23:35.000000000 +0100
-@@ -91,9 +91,9 @@
- uint32_t button; /**< Button number */
- uint32_t key; /**< Key code */
- } detail;
-- uint16_t root_x; /**< Pos relative to root window in integral data */
-+ int16_t root_x; /**< Pos relative to root window in integral data */
- float root_x_frac; /**< Pos relative to root window in frac part */
-- uint16_t root_y; /**< Pos relative to root window in integral part */
-+ int16_t root_y; /**< Pos relative to root window in integral part */
- float root_y_frac; /**< Pos relative to root window in frac part */
- uint8_t buttons[(MAX_BUTTONS + 7)/8]; /**< Button mask */
- struct {
Deleted: trunk/x11-servers/xorg-server/files/extra-new-arch-i386
===================================================================
--- trunk/x11-servers/xorg-server/files/extra-new-arch-i386 2015-05-28 02:59:29 UTC (rev 19133)
+++ trunk/x11-servers/xorg-server/files/extra-new-arch-i386 2015-05-28 03:00:00 UTC (rev 19134)
@@ -1,11 +0,0 @@
---- hw/xfree86/common/compiler.h.orig 2012-05-17 19:09:03.000000000 +0200
-+++ hw/xfree86/common/compiler.h 2013-01-18 13:59:18.366436857 +0100
-@@ -1335,7 +1335,7 @@
-
- #if !defined(__SUNPRO_C)
- #if !defined(FAKEIT) && !defined(__mc68000__) && !defined(__arm__) && !defined(__sh__) && !defined(__hppa__) && !defined(__s390__) && !defined(__m32r__)
--#ifdef GCCUSESGAS
-+#if defined(GCCUSESGAS) || defined(__clang__)
-
- /*
- * If gcc uses gas rather than the native assembler, the syntax of these
Deleted: trunk/x11-servers/xorg-server/files/extra-new-bad-impl
===================================================================
--- trunk/x11-servers/xorg-server/files/extra-new-bad-impl 2015-05-28 02:59:29 UTC (rev 19133)
+++ trunk/x11-servers/xorg-server/files/extra-new-bad-impl 2015-05-28 03:00:00 UTC (rev 19134)
@@ -1,38 +0,0 @@
-Fix BadImplemented triggered in GDK 3
-
-Lead:
-https://bbs.archlinux.org/viewtopic.php?id=162012
-Debian bug:
-http://lists.debian.org/debian-x/2012/12/msg00133.html
-
---- Xi/xiselectev.c.orig 2012-05-17 19:09:01.000000000 +0200
-+++ Xi/xiselectev.c 2012-12-18 10:29:38.804469850 +0100
-@@ -175,17 +175,24 @@
- if (inputMasks)
- iclient = inputMasks->inputClients;
- for (; iclient; iclient = iclient->next) {
-- DeviceIntPtr dummy;
-+ DeviceIntPtr devTest;
-+ DeviceIntRec dummyTest;
-
- if (CLIENT_ID(iclient->resource) == client->index)
- continue;
-
-- dixLookupDevice(&dummy, evmask->deviceid, serverClient,
-+ if (evmask->deviceid == XIAllDevices ||
-+ evmask->deviceid == XIAllMasterDevices) {
-+ dummyTest.id = evmask->deviceid;
-+ devTest = &dummyTest;
-+ }
-+ else
-+ dixLookupDevice(&devTest, evmask->deviceid, serverClient,
- DixReadAccess);
-- if (!dummy)
-+ if (!devTest)
- return BadImplementation; /* this shouldn't happen */
-
-- if (xi2mask_isset(iclient->xi2mask, dummy, XI_TouchBegin))
-+ if (xi2mask_isset(iclient->xi2mask, devTest, XI_TouchBegin))
- return BadAccess;
- }
- }
Deleted: trunk/x11-servers/xorg-server/files/extra-new-dix_dixfonts.c
===================================================================
--- trunk/x11-servers/xorg-server/files/extra-new-dix_dixfonts.c 2015-05-28 02:59:29 UTC (rev 19133)
+++ trunk/x11-servers/xorg-server/files/extra-new-dix_dixfonts.c 2015-05-28 03:00:00 UTC (rev 19134)
@@ -1,41 +0,0 @@
---- dix/dixfonts.c.orig 2012-05-17 19:09:01.000000000 +0200
-+++ dix/dixfonts.c 2013-10-09 10:49:38.158284440 +0200
-@@ -1414,6 +1414,7 @@
- GC *pGC;
- unsigned char *data;
- ITclosurePtr new_closure;
-+ ITclosurePtr old_closure;
-
- /* We're putting the client to sleep. We need to
- save some state. Similar problem to that handled
-@@ -1425,12 +1426,14 @@
- err = BadAlloc;
- goto bail;
- }
-+ old_closure = c;
- *new_closure = *c;
- c = new_closure;
-
- data = malloc(c->nChars * itemSize);
- if (!data) {
- free(c);
-+ c = old_closure;
- err = BadAlloc;
- goto bail;
- }
-@@ -1441,6 +1444,7 @@
- if (!pGC) {
- free(c->data);
- free(c);
-+ c = old_closure;
- err = BadAlloc;
- goto bail;
- }
-@@ -1453,6 +1457,7 @@
- FreeScratchGC(pGC);
- free(c->data);
- free(c);
-+ c = old_closure;
- err = BadAlloc;
- goto bail;
- }
Deleted: trunk/x11-servers/xorg-server/files/extra-old-arch-i386
===================================================================
--- trunk/x11-servers/xorg-server/files/extra-old-arch-i386 2015-05-28 02:59:29 UTC (rev 19133)
+++ trunk/x11-servers/xorg-server/files/extra-old-arch-i386 2015-05-28 03:00:00 UTC (rev 19134)
@@ -1,11 +0,0 @@
---- hw/xfree86/common/compiler.h.orig 2010-05-04 02:47:58.000000000 +0200
-+++ hw/xfree86/common/compiler.h 2013-01-18 13:07:35.785442739 +0100
-@@ -1021,7 +1021,7 @@
-
- # if !defined(__SUNPRO_C)
- # if !defined(FAKEIT) && !defined(__mc68000__) && !defined(__arm__) && !defined(__sh__) && !defined(__hppa__) && !defined(__s390__) && !defined(__m32r__)
--# ifdef GCCUSESGAS
-+# if defined(GCCUSESGAS) || defined(__clang__)
-
- /*
- * If gcc uses gas rather than the native assembler, the syntax of these
Deleted: trunk/x11-servers/xorg-server/files/extra-old-dix_dixfonts.c
===================================================================
--- trunk/x11-servers/xorg-server/files/extra-old-dix_dixfonts.c 2015-05-28 02:59:29 UTC (rev 19133)
+++ trunk/x11-servers/xorg-server/files/extra-old-dix_dixfonts.c 2015-05-28 03:00:00 UTC (rev 19134)
@@ -1,42 +0,0 @@
---- dix/dixfonts.c.orig 2010-05-04 02:47:57.000000000 +0200
-+++ dix/dixfonts.c 2013-10-09 10:54:40.488267646 +0200
-@@ -1508,6 +1508,7 @@
- GC *pGC;
- unsigned char *data;
- ITclosurePtr new_closure;
-+ ITclosurePtr old_closure;
-
- /* We're putting the client to sleep. We need to
- save some state. Similar problem to that handled
-@@ -1520,6 +1521,7 @@
- err = BadAlloc;
- goto bail;
- }
-+ old_closure = c;
- *new_closure = *c;
- c = new_closure;
-
-@@ -1527,6 +1529,7 @@
- if (!data)
- {
- xfree(c);
-+ c = old_closure;
- err = BadAlloc;
- goto bail;
- }
-@@ -1538,6 +1541,7 @@
- {
- xfree(c->data);
- xfree(c);
-+ c = old_closure;
- err = BadAlloc;
- goto bail;
- }
-@@ -1551,6 +1555,7 @@
- FreeScratchGC(pGC);
- xfree(c->data);
- xfree(c);
-+ c = old_closure;
- err = BadAlloc;
- goto bail;
- }
Deleted: trunk/x11-servers/xorg-server/files/extra-os-utils.c
===================================================================
--- trunk/x11-servers/xorg-server/files/extra-os-utils.c 2015-05-28 02:59:29 UTC (rev 19133)
+++ trunk/x11-servers/xorg-server/files/extra-os-utils.c 2015-05-28 03:00:00 UTC (rev 19134)
@@ -1,20 +0,0 @@
---- os/utils.c.orig 2010-05-04 02:48:00.000000000 +0200
-+++ os/utils.c 2011-10-18 20:08:10.000000000 +0200
-@@ -315,7 +315,7 @@
- FatalError("Could not create lock file in %s\n", tmp);
- (void) sprintf(pid_str, "%10ld\n", (long)getpid());
- (void) write(lfd, pid_str, 11);
-- (void) chmod(tmp, 0444);
-+ (void) fchmod(tmp, 0444);
- (void) close(lfd);
-
- /*
-@@ -336,7 +336,7 @@
- /*
- * Read the pid from the existing file
- */
-- lfd = open(LockFile, O_RDONLY);
-+ lfd = open(LockFile, O_RDONLY|O_NOFOLLOW);
- if (lfd < 0) {
- unlink(tmp);
- FatalError("Can't read lock file %s\n", LockFile);
Added: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8092-1-4
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-CVE-2014-8092-1-4 (rev 0)
+++ trunk/x11-servers/xorg-server/files/patch-CVE-2014-8092-1-4 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,37 @@
+From eeae42d60bf3d5663ea088581f6c28a82cd17829 Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith at oracle.com>
+Date: Wed, 22 Jan 2014 21:11:16 -0800
+Subject: [PATCH 01/40] dix: integer overflow in ProcPutImage() [CVE-2014-8092
+ 1/4]
+
+ProcPutImage() calculates a length field from a width, left pad and depth
+specified by the client (if the specified format is XYPixmap).
+
+The calculations for the total amount of memory the server needs for the
+pixmap can overflow a 32-bit number, causing out-of-bounds memory writes
+on 32-bit systems (since the length is stored in a long int variable).
+
+Reported-by: Ilja Van Sprundel <ivansprundel at ioactive.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
+Reviewed-by: Peter Hutterer <peter.hutterer at who-t.net>
+---
+ dix/dispatch.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/dix/dispatch.c b/dix/dispatch.c
+index d844a09..55b978d 100644
+--- dix/dispatch.c
++++ dix/dispatch.c
+@@ -2000,6 +2000,9 @@ ProcPutImage(ClientPtr client)
+ tmpImage = (char *) &stuff[1];
+ lengthProto = length;
+
++ if (lengthProto >= (INT32_MAX / stuff->height))
++ return BadLength;
++
+ if ((bytes_to_int32(lengthProto * stuff->height) +
+ bytes_to_int32(sizeof(xPutImageReq))) != client->req_len)
+ return BadLength;
+--
+2.1.2
+
Property changes on: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8092-1-4
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Added: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8092-2-4
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-CVE-2014-8092-2-4 (rev 0)
+++ trunk/x11-servers/xorg-server/files/patch-CVE-2014-8092-2-4 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,49 @@
+From bc8e20430b6f6378daf6ce4329029248a88af08b Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith at oracle.com>
+Date: Mon, 6 Jan 2014 23:30:14 -0800
+Subject: [PATCH 02/40] dix: integer overflow in GetHosts() [CVE-2014-8092 2/4]
+
+GetHosts() iterates over all the hosts it has in memory, and copies
+them to a buffer. The buffer length is calculated by iterating over
+all the hosts and adding up all of their combined length. There is a
+potential integer overflow, if there are lots and lots of hosts (with
+a combined length of > ~4 gig). This should be possible by repeatedly
+calling ProcChangeHosts() on 64bit machines with enough memory.
+
+This patch caps the list at 1mb, because multi-megabyte hostname
+lists for X access control are insane.
+
+Reported-by: Ilja Van Sprundel <ivansprundel at ioactive.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
+Reviewed-by: Peter Hutterer <peter.hutterer at who-t.net>
+---
+ os/access.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/os/access.c b/os/access.c
+index 5c510de..f393c8d 100644
+--- os/access.c
++++ os/access.c
+@@ -1296,6 +1296,10 @@ GetHosts(void **data, int *pnHosts, int *pLen, BOOL * pEnabled)
+ for (host = validhosts; host; host = host->next) {
+ nHosts++;
+ n += pad_to_int32(host->len) + sizeof(xHostEntry);
++ /* Could check for INT_MAX, but in reality having more than 1mb of
++ hostnames in the access list is ridiculous */
++ if (n >= 1048576)
++ break;
+ }
+ if (n) {
+ *data = ptr = malloc(n);
+@@ -1304,6 +1308,8 @@ GetHosts(void **data, int *pnHosts, int *pLen, BOOL * pEnabled)
+ }
+ for (host = validhosts; host; host = host->next) {
+ len = host->len;
++ if ((ptr + sizeof(xHostEntry) + len) > (data + n))
++ break;
+ ((xHostEntry *) ptr)->family = host->family;
+ ((xHostEntry *) ptr)->length = len;
+ ptr += sizeof(xHostEntry);
+--
+2.1.2
+
Property changes on: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8092-2-4
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Added: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8092-3-4
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-CVE-2014-8092-3-4 (rev 0)
+++ trunk/x11-servers/xorg-server/files/patch-CVE-2014-8092-3-4 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,128 @@
+From 97015a07b9e15d8ec5608b95d95ec0eb51202acb Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith at oracle.com>
+Date: Wed, 22 Jan 2014 22:37:15 -0800
+Subject: [PATCH 03/40] dix: integer overflow in RegionSizeof() [CVE-2014-8092
+ 3/4]
+
+RegionSizeof contains several integer overflows if a large length
+value is passed in. Once we fix it to return 0 on overflow, we
+also have to fix the callers to handle this error condition
+
+v2: Fixed limit calculation in RegionSizeof as pointed out by jcristau.
+
+Reported-by: Ilja Van Sprundel <ivansprundel at ioactive.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
+Reviewed-by: Peter Hutterer <peter.hutterer at who-t.net>
+Reviewed-by: Julien Cristau <jcristau at debian.org>
+---
+ dix/region.c | 20 +++++++++++++-------
+ include/regionstr.h | 10 +++++++---
+ 2 files changed, 20 insertions(+), 10 deletions(-)
+
+diff --git a/dix/region.c b/dix/region.c
+index ce1014e..04e5901 100644
+--- dix/region.c
++++ dix/region.c
+@@ -169,7 +169,6 @@ Equipment Corporation.
+ ((r1)->y1 <= (r2)->y1) && \
+ ((r1)->y2 >= (r2)->y2) )
+
+-#define xallocData(n) malloc(RegionSizeof(n))
+ #define xfreeData(reg) if ((reg)->data && (reg)->data->size) free((reg)->data)
+
+ #define RECTALLOC_BAIL(pReg,n,bail) \
+@@ -205,8 +204,9 @@ if (!(pReg)->data || (((pReg)->data->numRects + (n)) > (pReg)->data->size)) \
+ #define DOWNSIZE(reg,numRects) \
+ if (((numRects) < ((reg)->data->size >> 1)) && ((reg)->data->size > 50)) \
+ { \
+- RegDataPtr NewData; \
+- NewData = (RegDataPtr)realloc((reg)->data, RegionSizeof(numRects)); \
++ size_t NewSize = RegionSizeof(numRects); \
++ RegDataPtr NewData = \
++ (NewSize > 0) ? realloc((reg)->data, NewSize) : NULL ; \
+ if (NewData) \
+ { \
+ NewData->size = (numRects); \
+@@ -345,17 +345,20 @@ Bool
+ RegionRectAlloc(RegionPtr pRgn, int n)
+ {
+ RegDataPtr data;
++ size_t rgnSize;
+
+ if (!pRgn->data) {
+ n++;
+- pRgn->data = xallocData(n);
++ rgnSize = RegionSizeof(n);
++ pRgn->data = (rgnSize > 0) ? malloc(rgnSize) : NULL;
+ if (!pRgn->data)
+ return RegionBreak(pRgn);
+ pRgn->data->numRects = 1;
+ *RegionBoxptr(pRgn) = pRgn->extents;
+ }
+ else if (!pRgn->data->size) {
+- pRgn->data = xallocData(n);
++ rgnSize = RegionSizeof(n);
++ pRgn->data = (rgnSize > 0) ? malloc(rgnSize) : NULL;
+ if (!pRgn->data)
+ return RegionBreak(pRgn);
+ pRgn->data->numRects = 0;
+@@ -367,7 +370,8 @@ RegionRectAlloc(RegionPtr pRgn, int n)
+ n = 250;
+ }
+ n += pRgn->data->numRects;
+- data = (RegDataPtr) realloc(pRgn->data, RegionSizeof(n));
++ rgnSize = RegionSizeof(n);
++ data = (rgnSize > 0) ? realloc(pRgn->data, rgnSize) : NULL;
+ if (!data)
+ return RegionBreak(pRgn);
+ pRgn->data = data;
+@@ -1312,6 +1316,7 @@ RegionFromRects(int nrects, xRectangle *prect, int ctype)
+ {
+
+ RegionPtr pRgn;
++ size_t rgnSize;
+ RegDataPtr pData;
+ BoxPtr pBox;
+ int i;
+@@ -1338,7 +1343,8 @@ RegionFromRects(int nrects, xRectangle *prect, int ctype)
+ }
+ return pRgn;
+ }
+- pData = xallocData(nrects);
++ rgnSize = RegionSizeof(nrects);
++ pData = (rgnSize > 0) ? malloc(rgnSize) : NULL;
+ if (!pData) {
+ RegionBreak(pRgn);
+ return pRgn;
+diff --git a/include/regionstr.h b/include/regionstr.h
+index 515e93f..079375d 100644
+--- include/regionstr.h
++++ include/regionstr.h
+@@ -127,7 +127,10 @@ RegionEnd(RegionPtr reg)
+ static inline size_t
+ RegionSizeof(size_t n)
+ {
+- return (sizeof(RegDataRec) + ((n) * sizeof(BoxRec)));
++ if (n < ((INT_MAX - sizeof(RegDataRec)) / sizeof(BoxRec)))
++ return (sizeof(RegDataRec) + ((n) * sizeof(BoxRec)));
++ else
++ return 0;
+ }
+
+ static inline void
+@@ -138,9 +141,10 @@ RegionInit(RegionPtr _pReg, BoxPtr _rect, int _size)
+ (_pReg)->data = (RegDataPtr) NULL;
+ }
+ else {
++ size_t rgnSize;
+ (_pReg)->extents = RegionEmptyBox;
+- if (((_size) > 1) && ((_pReg)->data =
+- (RegDataPtr) malloc(RegionSizeof(_size)))) {
++ if (((_size) > 1) && ((rgnSize = RegionSizeof(_size)) > 0) &&
++ (((_pReg)->data = (RegDataPtr) malloc(rgnSize)) != NULL)) {
+ (_pReg)->data->size = (_size);
+ (_pReg)->data->numRects = 0;
+ }
+--
+2.1.2
+
Property changes on: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8092-3-4
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Added: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8092-4-4
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-CVE-2014-8092-4-4 (rev 0)
+++ trunk/x11-servers/xorg-server/files/patch-CVE-2014-8092-4-4 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,34 @@
+From e0e11644622a589129a01e11e5d105dc74a098de Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith at oracle.com>
+Date: Wed, 22 Jan 2014 23:44:46 -0800
+Subject: [PATCH 04/40] dix: integer overflow in REQUEST_FIXED_SIZE()
+ [CVE-2014-8092 4/4]
+
+Force use of 64-bit integers when evaluating data provided by clients
+in 32-bit fields which can overflow when added or multiplied during
+checks.
+
+Reported-by: Ilja Van Sprundel <ivansprundel at ioactive.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
+Reviewed-by: Peter Hutterer <peter.hutterer at who-t.net>
+---
+ include/dix.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/include/dix.h b/include/dix.h
+index 991a3ce..e0c6ed8 100644
+--- include/dix.h
++++ include/dix.h
+@@ -76,7 +76,8 @@ SOFTWARE.
+
+ #define REQUEST_FIXED_SIZE(req, n)\
+ if (((sizeof(req) >> 2) > client->req_len) || \
+- (((sizeof(req) + (n) + 3) >> 2) != client->req_len)) \
++ ((n >> 2) >= client->req_len) || \
++ ((((uint64_t) sizeof(req) + (n) + 3) >> 2) != (uint64_t) client->req_len)) \
+ return(BadLength)
+
+ #define LEGAL_NEW_RESOURCE(id,client)\
+--
+2.1.2
+
Property changes on: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8092-4-4
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Added: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8092-pt5
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-CVE-2014-8092-pt5 (rev 0)
+++ trunk/x11-servers/xorg-server/files/patch-CVE-2014-8092-pt5 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,32 @@
+From 9802a0162f738de03585ca3f3b8a8266494f7d45 Mon Sep 17 00:00:00 2001
+From: Keith Packard <keithp at keithp.com>
+Date: Tue, 9 Dec 2014 09:30:59 -0800
+Subject: [PATCH 38/40] Missing parens in REQUEST_FIXED_SIZE macro
+ [CVE-2014-8092 pt. 5]
+
+The 'n' parameter must be surrounded by parens in both places to
+prevent precedence from mis-computing things.
+
+Signed-off-by: Keith Packard <keithp at keithp.com>
+Reviewed-by: Alan Coopersmith <alan.coopersmith at oracle.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
+---
+ include/dix.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/dix.h b/include/dix.h
+index 21176a8..921156b 100644
+--- include/dix.h
++++ include/dix.h
+@@ -80,7 +80,7 @@ SOFTWARE.
+
+ #define REQUEST_FIXED_SIZE(req, n)\
+ if (((sizeof(req) >> 2) > client->req_len) || \
+- ((n >> 2) >= client->req_len) || \
++ (((n) >> 2) >= client->req_len) || \
+ ((((uint64_t) sizeof(req) + (n) + 3) >> 2) != (uint64_t) client->req_len)) \
+ return(BadLength)
+
+--
+2.1.2
+
Property changes on: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8092-pt5
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Added: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8092-pt6
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-CVE-2014-8092-pt6 (rev 0)
+++ trunk/x11-servers/xorg-server/files/patch-CVE-2014-8092-pt6 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,35 @@
+From 1559a94395258fd73e369f1a2c98a44bfe21a486 Mon Sep 17 00:00:00 2001
+From: Keith Packard <keithp at keithp.com>
+Date: Tue, 9 Dec 2014 09:31:00 -0800
+Subject: [PATCH 39/40] dix: GetHosts bounds check using wrong pointer value
+ [CVE-2014-8092 pt. 6]
+
+GetHosts saves the pointer to allocated memory in *data, and then
+wants to bounds-check writes to that region, but was mistakenly using
+a bare 'data' instead of '*data'. Also, data is declared as void **,
+so we need a cast to turn it into a byte pointer so we can actually do
+pointer comparisons.
+
+Signed-off-by: Keith Packard <keithp at keithp.com>
+Reviewed-by: Alan Coopersmith <alan.coopersmith at oracle.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
+---
+ os/access.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/os/access.c b/os/access.c
+index f393c8d..28f2d32 100644
+--- os/access.c
++++ os/access.c
+@@ -1308,7 +1308,7 @@ GetHosts(void **data, int *pnHosts, int *pLen, BOOL * pEnabled)
+ }
+ for (host = validhosts; host; host = host->next) {
+ len = host->len;
+- if ((ptr + sizeof(xHostEntry) + len) > (data + n))
++ if ((ptr + sizeof(xHostEntry) + len) > ((unsigned char *) *data + n))
+ break;
+ ((xHostEntry *) ptr)->family = host->family;
+ ((xHostEntry *) ptr)->length = len;
+--
+2.1.2
+
Property changes on: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8092-pt6
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Added: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8093-1-6
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-CVE-2014-8093-1-6 (rev 0)
+++ trunk/x11-servers/xorg-server/files/patch-CVE-2014-8093-1-6 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,47 @@
+From 23fe7718bb171e71db2d1a30505c2ca2988799d9 Mon Sep 17 00:00:00 2001
+From: Adam Jackson <ajax at redhat.com>
+Date: Mon, 10 Nov 2014 12:13:36 -0500
+Subject: [PATCH 19/40] glx: Be more paranoid about variable-length requests
+ [CVE-2014-8093 1/6]
+
+If the size computation routine returns -1 we should just reject the
+request outright. Clamping it to zero could give an attacker the
+opportunity to also mangle cmdlen in such a way that the subsequent
+length check passes, and the request would get executed, thus passing
+data we wanted to reject to the renderer.
+
+Reviewed-by: Keith Packard <keithp at keithp.com>
+Reviewed-by: Julien Cristau <jcristau at debian.org>
+Reviewed-by: Michal Srb <msrb at suse.com>
+Reviewed-by: Andy Ritger <aritger at nvidia.com>
+Signed-off-by: Adam Jackson <ajax at redhat.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
+---
+ glx/glxcmds.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/glx/glxcmds.c b/glx/glxcmds.c
+index 009fd9b..ea42e2a 100644
+--- glx/glxcmds.c
++++ glx/glxcmds.c
+@@ -2062,7 +2062,7 @@ __glXDisp_Render(__GLXclientState * cl, GLbyte * pc)
+ extra = (*entry.varsize) (pc + __GLX_RENDER_HDR_SIZE,
+ client->swapped);
+ if (extra < 0) {
+- extra = 0;
++ return BadLength;
+ }
+ if (cmdlen != __GLX_PAD(entry.bytes + extra)) {
+ return BadLength;
+@@ -2179,7 +2179,7 @@ __glXDisp_RenderLarge(__GLXclientState * cl, GLbyte * pc)
+ extra = (*entry.varsize) (pc + __GLX_RENDER_LARGE_HDR_SIZE,
+ client->swapped);
+ if (extra < 0) {
+- extra = 0;
++ return BadLength;
+ }
+ /* large command's header is 4 bytes longer, so add 4 */
+ if (cmdlen != __GLX_PAD(entry.bytes + 4 + extra)) {
+--
+2.1.2
+
Property changes on: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8093-1-6
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Added: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8093-2-6
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-CVE-2014-8093-2-6 (rev 0)
+++ trunk/x11-servers/xorg-server/files/patch-CVE-2014-8093-2-6 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,165 @@
+From ab2ba9338aa5e85b4487bc7fbe69985c76483e01 Mon Sep 17 00:00:00 2001
+From: Adam Jackson <ajax at redhat.com>
+Date: Mon, 10 Nov 2014 12:13:37 -0500
+Subject: [PATCH 20/40] glx: Be more strict about rejecting invalid image sizes
+ [CVE-2014-8093 2/6]
+
+Before this we'd just clamp the image size to 0, which was just
+hideously stupid; if the parameters were such that they'd overflow an
+integer, you'd allocate a small buffer, then pass huge values into (say)
+ReadPixels, and now you're scribbling over arbitrary server memory.
+
+Reviewed-by: Keith Packard <keithp at keithp.com>
+Reviewed-by: Julien Cristau <jcristau at debian.org>
+Reviewed-by: Michal Srb <msrb at suse.com>
+Reviewed-by: Andy Ritger <aritger at nvidia.com>
+Signed-off-by: Adam Jackson <ajax at redhat.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
+---
+ glx/singlepix.c | 16 ++++++++--------
+ glx/singlepixswap.c | 16 ++++++++--------
+ 2 files changed, 16 insertions(+), 16 deletions(-)
+
+diff --git a/glx/singlepix.c b/glx/singlepix.c
+index 506fdaa..8b6c261 100644
+--- glx/singlepix.c
++++ glx/singlepix.c
+@@ -65,7 +65,7 @@ __glXDisp_ReadPixels(__GLXclientState * cl, GLbyte * pc)
+ lsbFirst = *(GLboolean *) (pc + 25);
+ compsize = __glReadPixels_size(format, type, width, height);
+ if (compsize < 0)
+- compsize = 0;
++ return BadLength;
+
+ glPixelStorei(GL_PACK_SWAP_BYTES, swapBytes);
+ glPixelStorei(GL_PACK_LSB_FIRST, lsbFirst);
+@@ -124,7 +124,7 @@ __glXDisp_GetTexImage(__GLXclientState * cl, GLbyte * pc)
+ compsize =
+ __glGetTexImage_size(target, level, format, type, width, height, depth);
+ if (compsize < 0)
+- compsize = 0;
++ return BadLength;
+
+ glPixelStorei(GL_PACK_SWAP_BYTES, swapBytes);
+ __GLX_GET_ANSWER_BUFFER(answer, cl, compsize, 1);
+@@ -218,9 +218,9 @@ GetSeparableFilter(__GLXclientState * cl, GLbyte * pc, GLXContextTag tag)
+ compsize2 = __glGetTexImage_size(target, 1, format, type, height, 1, 1);
+
+ if (compsize < 0)
+- compsize = 0;
++ return BadLength;
+ if (compsize2 < 0)
+- compsize2 = 0;
++ return BadLength;
+ compsize = __GLX_PAD(compsize);
+ compsize2 = __GLX_PAD(compsize2);
+
+@@ -296,7 +296,7 @@ GetConvolutionFilter(__GLXclientState * cl, GLbyte * pc, GLXContextTag tag)
+ */
+ compsize = __glGetTexImage_size(target, 1, format, type, width, height, 1);
+ if (compsize < 0)
+- compsize = 0;
++ return BadLength;
+
+ glPixelStorei(GL_PACK_SWAP_BYTES, swapBytes);
+ __GLX_GET_ANSWER_BUFFER(answer, cl, compsize, 1);
+@@ -365,7 +365,7 @@ GetHistogram(__GLXclientState * cl, GLbyte * pc, GLXContextTag tag)
+ */
+ compsize = __glGetTexImage_size(target, 1, format, type, width, 1, 1);
+ if (compsize < 0)
+- compsize = 0;
++ return BadLength;
+
+ glPixelStorei(GL_PACK_SWAP_BYTES, swapBytes);
+ __GLX_GET_ANSWER_BUFFER(answer, cl, compsize, 1);
+@@ -426,7 +426,7 @@ GetMinmax(__GLXclientState * cl, GLbyte * pc, GLXContextTag tag)
+
+ compsize = __glGetTexImage_size(target, 1, format, type, 2, 1, 1);
+ if (compsize < 0)
+- compsize = 0;
++ return BadLength;
+
+ glPixelStorei(GL_PACK_SWAP_BYTES, swapBytes);
+ __GLX_GET_ANSWER_BUFFER(answer, cl, compsize, 1);
+@@ -491,7 +491,7 @@ GetColorTable(__GLXclientState * cl, GLbyte * pc, GLXContextTag tag)
+ */
+ compsize = __glGetTexImage_size(target, 1, format, type, width, 1, 1);
+ if (compsize < 0)
+- compsize = 0;
++ return BadLength;
+
+ glPixelStorei(GL_PACK_SWAP_BYTES, swapBytes);
+ __GLX_GET_ANSWER_BUFFER(answer, cl, compsize, 1);
+diff --git a/glx/singlepixswap.c b/glx/singlepixswap.c
+index 8469101..8dc304f 100644
+--- glx/singlepixswap.c
++++ glx/singlepixswap.c
+@@ -75,7 +75,7 @@ __glXDispSwap_ReadPixels(__GLXclientState * cl, GLbyte * pc)
+ lsbFirst = *(GLboolean *) (pc + 25);
+ compsize = __glReadPixels_size(format, type, width, height);
+ if (compsize < 0)
+- compsize = 0;
++ return BadLength;
+
+ glPixelStorei(GL_PACK_SWAP_BYTES, !swapBytes);
+ glPixelStorei(GL_PACK_LSB_FIRST, lsbFirst);
+@@ -144,7 +144,7 @@ __glXDispSwap_GetTexImage(__GLXclientState * cl, GLbyte * pc)
+ compsize =
+ __glGetTexImage_size(target, level, format, type, width, height, depth);
+ if (compsize < 0)
+- compsize = 0;
++ return BadLength;
+
+ glPixelStorei(GL_PACK_SWAP_BYTES, !swapBytes);
+ __GLX_GET_ANSWER_BUFFER(answer, cl, compsize, 1);
+@@ -252,9 +252,9 @@ GetSeparableFilter(__GLXclientState * cl, GLbyte * pc, GLXContextTag tag)
+ compsize2 = __glGetTexImage_size(target, 1, format, type, height, 1, 1);
+
+ if (compsize < 0)
+- compsize = 0;
++ return BadLength;
+ if (compsize2 < 0)
+- compsize2 = 0;
++ return BadLength;
+ compsize = __GLX_PAD(compsize);
+ compsize2 = __GLX_PAD(compsize2);
+
+@@ -338,7 +338,7 @@ GetConvolutionFilter(__GLXclientState * cl, GLbyte * pc, GLXContextTag tag)
+ */
+ compsize = __glGetTexImage_size(target, 1, format, type, width, height, 1);
+ if (compsize < 0)
+- compsize = 0;
++ return BadLength;
+
+ glPixelStorei(GL_PACK_SWAP_BYTES, !swapBytes);
+ __GLX_GET_ANSWER_BUFFER(answer, cl, compsize, 1);
+@@ -415,7 +415,7 @@ GetHistogram(__GLXclientState * cl, GLbyte * pc, GLXContextTag tag)
+ */
+ compsize = __glGetTexImage_size(target, 1, format, type, width, 1, 1);
+ if (compsize < 0)
+- compsize = 0;
++ return BadLength;
+
+ glPixelStorei(GL_PACK_SWAP_BYTES, !swapBytes);
+ __GLX_GET_ANSWER_BUFFER(answer, cl, compsize, 1);
+@@ -483,7 +483,7 @@ GetMinmax(__GLXclientState * cl, GLbyte * pc, GLXContextTag tag)
+
+ compsize = __glGetTexImage_size(target, 1, format, type, 2, 1, 1);
+ if (compsize < 0)
+- compsize = 0;
++ return BadLength;
+
+ glPixelStorei(GL_PACK_SWAP_BYTES, !swapBytes);
+ __GLX_GET_ANSWER_BUFFER(answer, cl, compsize, 1);
+@@ -554,7 +554,7 @@ GetColorTable(__GLXclientState * cl, GLbyte * pc, GLXContextTag tag)
+ */
+ compsize = __glGetTexImage_size(target, 1, format, type, width, 1, 1);
+ if (compsize < 0)
+- compsize = 0;
++ return BadLength;
+
+ glPixelStorei(GL_PACK_SWAP_BYTES, !swapBytes);
+ __GLX_GET_ANSWER_BUFFER(answer, cl, compsize, 1);
+--
+2.1.2
+
Property changes on: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8093-2-6
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Added: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8093-3-6
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-CVE-2014-8093-3-6 (rev 0)
+++ trunk/x11-servers/xorg-server/files/patch-CVE-2014-8093-3-6 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,59 @@
+From 717a1b37767b41e14859e5022ae9e679152821a9 Mon Sep 17 00:00:00 2001
+From: Adam Jackson <ajax at redhat.com>
+Date: Mon, 10 Nov 2014 12:13:38 -0500
+Subject: [PATCH 21/40] glx: Additional paranoia in __glXGetAnswerBuffer /
+ __GLX_GET_ANSWER_BUFFER (v2) [CVE-2014-8093 3/6]
+
+If the computed reply size is negative, something went wrong, treat it
+as an error.
+
+v2: Be more careful about size_t being unsigned (Matthieu Herrb)
+v3: SIZE_MAX not SIZE_T_MAX (Alan Coopersmith)
+
+Reviewed-by: Julien Cristau <jcristau at debian.org>
+Reviewed-by: Michal Srb <msrb at suse.com>
+Reviewed-by: Andy Ritger <aritger at nvidia.com>
+Signed-off-by: Adam Jackson <ajax at redhat.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
+---
+ glx/indirect_util.c | 7 ++++++-
+ glx/unpack.h | 3 ++-
+ 2 files changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/glx/indirect_util.c b/glx/indirect_util.c
+index 926e57c..de81491 100644
+--- glx/indirect_util.c
++++ glx/indirect_util.c
+@@ -76,9 +76,14 @@ __glXGetAnswerBuffer(__GLXclientState * cl, size_t required_size,
+ const unsigned mask = alignment - 1;
+
+ if (local_size < required_size) {
+- const size_t worst_case_size = required_size + alignment;
++ size_t worst_case_size;
+ intptr_t temp_buf;
+
++ if (required_size < SIZE_MAX - alignment)
++ worst_case_size = required_size + alignment;
++ else
++ return NULL;
++
+ if (cl->returnBufSize < worst_case_size) {
+ void *temp = realloc(cl->returnBuf, worst_case_size);
+
+diff --git a/glx/unpack.h b/glx/unpack.h
+index 52fba74..2b1ebcf 100644
+--- glx/unpack.h
++++ glx/unpack.h
+@@ -83,7 +83,8 @@ extern xGLXSingleReply __glXReply;
+ ** pointer.
+ */
+ #define __GLX_GET_ANSWER_BUFFER(res,cl,size,align) \
+- if ((size) > sizeof(answerBuffer)) { \
++ if (size < 0) return BadLength; \
++ else if ((size) > sizeof(answerBuffer)) { \
+ int bump; \
+ if ((cl)->returnBufSize < (size)+(align)) { \
+ (cl)->returnBuf = (GLbyte*)realloc((cl)->returnBuf, \
+--
+2.1.2
+
Property changes on: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8093-3-6
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Added: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8093-4-6
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-CVE-2014-8093-4-6 (rev 0)
+++ trunk/x11-servers/xorg-server/files/patch-CVE-2014-8093-4-6 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,82 @@
+From 2a5cbc17fc72185bf0fa06fef26d1f782de72595 Mon Sep 17 00:00:00 2001
+From: Adam Jackson <ajax at redhat.com>
+Date: Mon, 10 Nov 2014 12:13:40 -0500
+Subject: [PATCH 23/40] glx: Add safe_{add,mul,pad} (v3) [CVE-2014-8093 4/6]
+
+These are paranoid about integer overflow, and will return -1 if their
+operation would overflow a (signed) integer or if either argument is
+negative.
+
+Note that RenderLarge requests are sized with a uint32_t so in principle
+this could be sketchy there, but dix limits bigreqs to 128M so you
+shouldn't ever notice, and honestly if you're sending more than 2G of
+rendering commands you're already doing something very wrong.
+
+v2: Use INT_MAX for consistency with the rest of the server (jcristau)
+v3: Reject negative arguments (anholt)
+
+Reviewed-by: Keith Packard <keithp at keithp.com>
+Reviewed-by: Julien Cristau <jcristau at debian.org>
+Reviewed-by: Michal Srb <msrb at suse.com>
+Reviewed-by: Andy Ritger <aritger at nvidia.com>
+Signed-off-by: Adam Jackson <ajax at redhat.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
+---
+ glx/glxserver.h | 41 +++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 41 insertions(+)
+
+diff --git a/glx/glxserver.h b/glx/glxserver.h
+index a324b29..9482601 100644
+--- glx/glxserver.h
++++ glx/glxserver.h
+@@ -228,6 +228,47 @@ extern void glxSwapQueryServerStringReply(ClientPtr client,
+ * Routines for computing the size of variably-sized rendering commands.
+ */
+
++static _X_INLINE int
++safe_add(int a, int b)
++{
++ if (a < 0 || b < 0)
++ return -1;
++
++ if (INT_MAX - a < b)
++ return -1;
++
++ return a + b;
++}
++
++static _X_INLINE int
++safe_mul(int a, int b)
++{
++ if (a < 0 || b < 0)
++ return -1;
++
++ if (a == 0 || b == 0)
++ return 0;
++
++ if (a > INT_MAX / b)
++ return -1;
++
++ return a * b;
++}
++
++static _X_INLINE int
++safe_pad(int a)
++{
++ int ret;
++
++ if (a < 0)
++ return -1;
++
++ if ((ret = safe_add(a, 3)) < 0)
++ return -1;
++
++ return ret & (GLuint)~3;
++}
++
+ extern int __glXTypeSize(GLenum enm);
+ extern int __glXImageSize(GLenum format, GLenum type,
+ GLenum target, GLsizei w, GLsizei h, GLsizei d,
+--
+2.1.2
+
Property changes on: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8093-4-6
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Added: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8093-5-6
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-CVE-2014-8093-5-6 (rev 0)
+++ trunk/x11-servers/xorg-server/files/patch-CVE-2014-8093-5-6 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,225 @@
+From 698888e6671d54c7ae41e9d456f7f5483a3459d2 Mon Sep 17 00:00:00 2001
+From: Adam Jackson <ajax at redhat.com>
+Date: Mon, 10 Nov 2014 12:13:42 -0500
+Subject: [PATCH 25/40] glx: Integer overflow protection for non-generated
+ render requests (v3) [CVE-2014-8093 5/6]
+
+v2:
+Fix constants in __glXMap2fReqSize (Michal Srb)
+Validate w/h/d for proxy targets too (Keith Packard)
+
+v3:
+Fix Map[12]Size to correctly reject order == 0 (Julien Cristau)
+
+Reviewed-by: Keith Packard <keithp at keithp.com>
+Reviewed-by: Michal Srb <msrb at suse.com>
+Reviewed-by: Andy Ritger <aritger at nvidia.com>
+Signed-off-by: Adam Jackson <ajax at redhat.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
+---
+ glx/rensize.c | 77 +++++++++++++++++++++++++++++++----------------------------
+ 1 file changed, 41 insertions(+), 36 deletions(-)
+
+diff --git a/glx/rensize.c b/glx/rensize.c
+index 9ff73c7..d46334a 100644
+--- glx/rensize.c
++++ glx/rensize.c
+@@ -43,19 +43,11 @@
+ (((a & 0xff000000U)>>24) | ((a & 0xff0000U)>>8) | \
+ ((a & 0xff00U)<<8) | ((a & 0xffU)<<24))
+
+-static int
+-Map1Size(GLint k, GLint order)
+-{
+- if (order <= 0 || k < 0)
+- return -1;
+- return k * order;
+-}
+-
+ int
+ __glXMap1dReqSize(const GLbyte * pc, Bool swap)
+ {
+ GLenum target;
+- GLint order, k;
++ GLint order;
+
+ target = *(GLenum *) (pc + 16);
+ order = *(GLint *) (pc + 20);
+@@ -63,15 +55,16 @@ __glXMap1dReqSize(const GLbyte * pc, Bool swap)
+ target = SWAPL(target);
+ order = SWAPL(order);
+ }
+- k = __glMap1d_size(target);
+- return 8 * Map1Size(k, order);
++ if (order < 1)
++ return -1;
++ return safe_mul(8, safe_mul(__glMap1d_size(target), order));
+ }
+
+ int
+ __glXMap1fReqSize(const GLbyte * pc, Bool swap)
+ {
+ GLenum target;
+- GLint order, k;
++ GLint order;
+
+ target = *(GLenum *) (pc + 0);
+ order = *(GLint *) (pc + 12);
+@@ -79,23 +72,24 @@ __glXMap1fReqSize(const GLbyte * pc, Bool swap)
+ target = SWAPL(target);
+ order = SWAPL(order);
+ }
+- k = __glMap1f_size(target);
+- return 4 * Map1Size(k, order);
++ if (order < 1)
++ return -1;
++ return safe_mul(4, safe_mul(__glMap1f_size(target), order));
+ }
+
+ static int
+ Map2Size(int k, int majorOrder, int minorOrder)
+ {
+- if (majorOrder <= 0 || minorOrder <= 0 || k < 0)
++ if (majorOrder < 1 || minorOrder < 1)
+ return -1;
+- return k * majorOrder * minorOrder;
++ return safe_mul(k, safe_mul(majorOrder, minorOrder));
+ }
+
+ int
+ __glXMap2dReqSize(const GLbyte * pc, Bool swap)
+ {
+ GLenum target;
+- GLint uorder, vorder, k;
++ GLint uorder, vorder;
+
+ target = *(GLenum *) (pc + 32);
+ uorder = *(GLint *) (pc + 36);
+@@ -105,15 +99,14 @@ __glXMap2dReqSize(const GLbyte * pc, Bool swap)
+ uorder = SWAPL(uorder);
+ vorder = SWAPL(vorder);
+ }
+- k = __glMap2d_size(target);
+- return 8 * Map2Size(k, uorder, vorder);
++ return safe_mul(8, Map2Size(__glMap2d_size(target), uorder, vorder));
+ }
+
+ int
+ __glXMap2fReqSize(const GLbyte * pc, Bool swap)
+ {
+ GLenum target;
+- GLint uorder, vorder, k;
++ GLint uorder, vorder;
+
+ target = *(GLenum *) (pc + 0);
+ uorder = *(GLint *) (pc + 12);
+@@ -123,8 +116,7 @@ __glXMap2fReqSize(const GLbyte * pc, Bool swap)
+ uorder = SWAPL(uorder);
+ vorder = SWAPL(vorder);
+ }
+- k = __glMap2f_size(target);
+- return 4 * Map2Size(k, uorder, vorder);
++ return safe_mul(4, Map2Size(__glMap2f_size(target), uorder, vorder));
+ }
+
+ /**
+@@ -175,14 +167,16 @@ __glXImageSize(GLenum format, GLenum type, GLenum target,
+ GLint bytesPerElement, elementsPerGroup, groupsPerRow;
+ GLint groupSize, rowSize, padding, imageSize;
+
++ if (w == 0 || h == 0 || d == 0)
++ return 0;
++
+ if (w < 0 || h < 0 || d < 0 ||
+ (type == GL_BITMAP &&
+ (format != GL_COLOR_INDEX && format != GL_STENCIL_INDEX))) {
+ return -1;
+ }
+- if (w == 0 || h == 0 || d == 0)
+- return 0;
+
++ /* proxy targets have no data */
+ switch (target) {
+ case GL_PROXY_TEXTURE_1D:
+ case GL_PROXY_TEXTURE_2D:
+@@ -199,6 +193,12 @@ __glXImageSize(GLenum format, GLenum type, GLenum target,
+ return 0;
+ }
+
++ /* real data has to have real sizes */
++ if (imageHeight < 0 || rowLength < 0 || skipImages < 0 || skipRows < 0)
++ return -1;
++ if (alignment != 1 && alignment != 2 && alignment != 4 && alignment != 8)
++ return -1;
++
+ if (type == GL_BITMAP) {
+ if (rowLength > 0) {
+ groupsPerRow = rowLength;
+@@ -207,11 +207,14 @@ __glXImageSize(GLenum format, GLenum type, GLenum target,
+ groupsPerRow = w;
+ }
+ rowSize = bits_to_bytes(groupsPerRow);
++ if (rowSize < 0)
++ return -1;
+ padding = (rowSize % alignment);
+ if (padding) {
+ rowSize += alignment - padding;
+ }
+- return ((h + skipRows) * rowSize);
++
++ return safe_mul(safe_add(h, skipRows), rowSize);
+ }
+ else {
+ switch (format) {
+@@ -303,6 +306,7 @@ __glXImageSize(GLenum format, GLenum type, GLenum target,
+ default:
+ return -1;
+ }
++ /* known safe by the switches above, not checked */
+ groupSize = bytesPerElement * elementsPerGroup;
+ if (rowLength > 0) {
+ groupsPerRow = rowLength;
+@@ -310,18 +314,21 @@ __glXImageSize(GLenum format, GLenum type, GLenum target,
+ else {
+ groupsPerRow = w;
+ }
+- rowSize = groupsPerRow * groupSize;
++
++ if ((rowSize = safe_mul(groupsPerRow, groupSize)) < 0)
++ return -1;
+ padding = (rowSize % alignment);
+ if (padding) {
+ rowSize += alignment - padding;
+ }
+- if (imageHeight > 0) {
+- imageSize = (imageHeight + skipRows) * rowSize;
+- }
+- else {
+- imageSize = (h + skipRows) * rowSize;
+- }
+- return ((d + skipImages) * imageSize);
++
++ if (imageHeight > 0)
++ h = imageHeight;
++ h = safe_add(h, skipRows);
++
++ imageSize = safe_mul(h, rowSize);
++
++ return safe_mul(safe_add(d, skipImages), imageSize);
+ }
+ }
+
+@@ -445,9 +452,7 @@ __glXSeparableFilter2DReqSize(const GLbyte * pc, Bool swap)
+ /* XXX Should rowLength be used for either or both image? */
+ image1size = __glXImageSize(format, type, 0, w, 1, 1,
+ 0, rowLength, 0, 0, alignment);
+- image1size = __GLX_PAD(image1size);
+ image2size = __glXImageSize(format, type, 0, h, 1, 1,
+ 0, rowLength, 0, 0, alignment);
+- return image1size + image2size;
+-
++ return safe_add(safe_pad(image1size), image2size);
+ }
+--
+2.1.2
+
Property changes on: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8093-5-6
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Added: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8093-6-6
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-CVE-2014-8093-6-6 (rev 0)
+++ trunk/x11-servers/xorg-server/files/patch-CVE-2014-8093-6-6 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,34 @@
+From 7e7630bbb775573eea2a2335adb9d190c3e1e971 Mon Sep 17 00:00:00 2001
+From: Robert Morell <rmorell at nvidia.com>
+Date: Wed, 12 Nov 2014 18:51:43 -0800
+Subject: [PATCH 32/40] glx: Fix mask truncation in __glXGetAnswerBuffer
+ [CVE-2014-8093 6/6]
+
+On a system where sizeof(unsigned) != sizeof(intptr_t), the unary
+bitwise not operation will result in a mask that clears all high bits
+from temp_buf in the expression:
+ temp_buf = (temp_buf + mask) & ~mask;
+
+Signed-off-by: Robert Morell <rmorell at nvidia.com>
+Reviewed-by: Alan Coopersmith <alan.coopersmith at oracle.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
+---
+ glx/indirect_util.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/glx/indirect_util.c b/glx/indirect_util.c
+index de81491..9ba2815 100644
+--- glx/indirect_util.c
++++ glx/indirect_util.c
+@@ -73,7 +73,7 @@ __glXGetAnswerBuffer(__GLXclientState * cl, size_t required_size,
+ void *local_buffer, size_t local_size, unsigned alignment)
+ {
+ void *buffer = local_buffer;
+- const unsigned mask = alignment - 1;
++ const intptr_t mask = alignment - 1;
+
+ if (local_size < required_size) {
+ size_t worst_case_size;
+--
+2.1.2
+
Property changes on: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8093-6-6
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Added: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8094
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-CVE-2014-8094 (rev 0)
+++ trunk/x11-servers/xorg-server/files/patch-CVE-2014-8094 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,35 @@
+From 6692670fde081bbfe9313f17d84037ae9116702a Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith at oracle.com>
+Date: Wed, 22 Jan 2014 23:40:18 -0800
+Subject: [PATCH 05/40] dri2: integer overflow in ProcDRI2GetBuffers()
+ [CVE-2014-8094]
+
+ProcDRI2GetBuffers() tries to validate a length field (count).
+There is an integer overflow in the validation. This can cause
+out of bound reads and memory corruption later on.
+
+Reported-by: Ilja Van Sprundel <ivansprundel at ioactive.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
+Reviewed-by: Peter Hutterer <peter.hutterer at who-t.net>
+Reviewed-by: Julien Cristau <jcristau at debian.org>
+---
+ hw/xfree86/dri2/dri2ext.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/hw/xfree86/dri2/dri2ext.c b/hw/xfree86/dri2/dri2ext.c
+index ffd66fa..221ec53 100644
+--- hw/xfree86/dri2/dri2ext.c
++++ hw/xfree86/dri2/dri2ext.c
+@@ -270,6 +270,9 @@ ProcDRI2GetBuffers(ClientPtr client)
+ unsigned int *attachments;
+
+ REQUEST_FIXED_SIZE(xDRI2GetBuffersReq, stuff->count * 4);
++ if (stuff->count > (INT_MAX / 4))
++ return BadLength;
++
+ if (!validDrawable(client, stuff->drawable, DixReadAccess | DixWriteAccess,
+ &pDrawable, &status))
+ return status;
+--
+2.1.2
+
Property changes on: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8094
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Added: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8095
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-CVE-2014-8095 (rev 0)
+++ trunk/x11-servers/xorg-server/files/patch-CVE-2014-8095 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,551 @@
+From 73c63afb93c0af1bfd1969bf6e71c9edca586c77 Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith at oracle.com>
+Date: Sun, 26 Jan 2014 10:54:41 -0800
+Subject: [PATCH 07/40] Xi: unvalidated lengths in Xinput extension
+ [CVE-2014-8095]
+
+Multiple functions in the Xinput extension handling of requests from
+clients failed to check that the length of the request sent by the
+client was large enough to perform all the required operations and
+thus could read or write to memory outside the bounds of the request
+buffer.
+
+This commit includes the creation of a new REQUEST_AT_LEAST_EXTRA_SIZE
+macro in include/dix.h for the common case of needing to ensure a
+request is large enough to include both the request itself and a
+minimum amount of extra data following the request header.
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
+Reviewed-by: Peter Hutterer <peter.hutterer at who-t.net>
+---
+ Xi/chgdctl.c | 8 ++++++--
+ Xi/chgfctl.c | 2 ++
+ Xi/sendexev.c | 3 +++
+ Xi/xiallowev.c | 2 ++
+ Xi/xichangecursor.c | 2 +-
+ Xi/xichangehierarchy.c | 35 ++++++++++++++++++++++++++++++++---
+ Xi/xigetclientpointer.c | 1 +
+ Xi/xigrabdev.c | 9 ++++++++-
+ Xi/xipassivegrab.c | 12 ++++++++++--
+ Xi/xiproperty.c | 14 ++++++--------
+ Xi/xiquerydevice.c | 1 +
+ Xi/xiquerypointer.c | 2 ++
+ Xi/xiselectev.c | 8 ++++++++
+ Xi/xisetclientpointer.c | 3 ++-
+ Xi/xisetdevfocus.c | 4 ++++
+ Xi/xiwarppointer.c | 2 ++
+ include/dix.h | 4 ++++
+ 17 files changed, 94 insertions(+), 18 deletions(-)
+
+diff --git a/Xi/chgdctl.c b/Xi/chgdctl.c
+index d078aa2..b3ee867 100644
+--- Xi/chgdctl.c
++++ Xi/chgdctl.c
+@@ -78,7 +78,7 @@ SProcXChangeDeviceControl(ClientPtr client)
+
+ REQUEST(xChangeDeviceControlReq);
+ swaps(&stuff->length);
+- REQUEST_AT_LEAST_SIZE(xChangeDeviceControlReq);
++ REQUEST_AT_LEAST_EXTRA_SIZE(xChangeDeviceControlReq, sizeof(xDeviceCtl));
+ swaps(&stuff->control);
+ ctl = (xDeviceCtl *) &stuff[1];
+ swaps(&ctl->control);
+@@ -115,7 +115,7 @@ ProcXChangeDeviceControl(ClientPtr client)
+ xDeviceEnableCtl *e;
+
+ REQUEST(xChangeDeviceControlReq);
+- REQUEST_AT_LEAST_SIZE(xChangeDeviceControlReq);
++ REQUEST_AT_LEAST_EXTRA_SIZE(xChangeDeviceControlReq, sizeof(xDeviceCtl));
+
+ len = stuff->length - bytes_to_int32(sizeof(xChangeDeviceControlReq));
+ ret = dixLookupDevice(&dev, stuff->deviceid, client, DixManageAccess);
+@@ -192,6 +192,10 @@ ProcXChangeDeviceControl(ClientPtr client)
+ break;
+ case DEVICE_ENABLE:
+ e = (xDeviceEnableCtl *) &stuff[1];
++ if ((len != bytes_to_int32(sizeof(xDeviceEnableCtl)))) {
++ ret = BadLength;
++ goto out;
++ }
+
+ if (IsXTestDevice(dev, NULL))
+ status = !Success;
+diff --git a/Xi/chgfctl.c b/Xi/chgfctl.c
+index 6dcf60c..224c2ba 100644
+--- Xi/chgfctl.c
++++ Xi/chgfctl.c
+@@ -467,6 +467,8 @@ ProcXChangeFeedbackControl(ClientPtr client)
+ xStringFeedbackCtl *f = ((xStringFeedbackCtl *) &stuff[1]);
+
+ if (client->swapped) {
++ if (len < bytes_to_int32(sizeof(xStringFeedbackCtl)))
++ return BadLength;
+ swaps(&f->num_keysyms);
+ }
+ if (len !=
+diff --git a/Xi/sendexev.c b/Xi/sendexev.c
+index 3c21386..183f88d 100644
+--- Xi/sendexev.c
++++ Xi/sendexev.c
+@@ -135,6 +135,9 @@ ProcXSendExtensionEvent(ClientPtr client)
+ if (ret != Success)
+ return ret;
+
++ if (stuff->num_events == 0)
++ return ret;
++
+ /* The client's event type must be one defined by an extension. */
+
+ first = ((xEvent *) &stuff[1]);
+diff --git a/Xi/xiallowev.c b/Xi/xiallowev.c
+index ebef233..ca263ef 100644
+--- Xi/xiallowev.c
++++ Xi/xiallowev.c
+@@ -48,6 +48,7 @@ int
+ SProcXIAllowEvents(ClientPtr client)
+ {
+ REQUEST(xXIAllowEventsReq);
++ REQUEST_AT_LEAST_SIZE(xXIAllowEventsReq);
+
+ swaps(&stuff->length);
+ swaps(&stuff->deviceid);
+@@ -55,6 +56,7 @@ SProcXIAllowEvents(ClientPtr client)
+ if (stuff->length > 3) {
+ xXI2_2AllowEventsReq *req_xi22 = (xXI2_2AllowEventsReq *) stuff;
+
++ REQUEST_AT_LEAST_SIZE(xXI2_2AllowEventsReq);
+ swapl(&req_xi22->touchid);
+ swapl(&req_xi22->grab_window);
+ }
+diff --git a/Xi/xichangecursor.c b/Xi/xichangecursor.c
+index 7a1bb7a..8e6255b 100644
+--- Xi/xichangecursor.c
++++ Xi/xichangecursor.c
+@@ -57,11 +57,11 @@ int
+ SProcXIChangeCursor(ClientPtr client)
+ {
+ REQUEST(xXIChangeCursorReq);
++ REQUEST_SIZE_MATCH(xXIChangeCursorReq);
+ swaps(&stuff->length);
+ swapl(&stuff->win);
+ swapl(&stuff->cursor);
+ swaps(&stuff->deviceid);
+- REQUEST_SIZE_MATCH(xXIChangeCursorReq);
+ return (ProcXIChangeCursor(client));
+ }
+
+diff --git a/Xi/xichangehierarchy.c b/Xi/xichangehierarchy.c
+index 9e36354..2732445 100644
+--- Xi/xichangehierarchy.c
++++ Xi/xichangehierarchy.c
+@@ -411,7 +411,7 @@ int
+ ProcXIChangeHierarchy(ClientPtr client)
+ {
+ xXIAnyHierarchyChangeInfo *any;
+- int required_len = sizeof(xXIChangeHierarchyReq);
++ size_t len; /* length of data remaining in request */
+ int rc = Success;
+ int flags[MAXDEVICES] = { 0 };
+
+@@ -421,21 +421,46 @@ ProcXIChangeHierarchy(ClientPtr client)
+ if (!stuff->num_changes)
+ return rc;
+
++ if (stuff->length > (INT_MAX >> 2))
++ return BadAlloc;
++ len = (stuff->length << 2) - sizeof(xXIAnyHierarchyChangeInfo);
++
+ any = (xXIAnyHierarchyChangeInfo *) &stuff[1];
+ while (stuff->num_changes--) {
++ if (len < sizeof(xXIAnyHierarchyChangeInfo)) {
++ rc = BadLength;
++ goto unwind;
++ }
++
+ SWAPIF(swaps(&any->type));
+ SWAPIF(swaps(&any->length));
+
+- required_len += any->length;
+- if ((stuff->length * 4) < required_len)
++ if ((any->length > (INT_MAX >> 2)) || (len < (any->length << 2)))
+ return BadLength;
+
++#define CHANGE_SIZE_MATCH(type) \
++ do { \
++ if ((len < sizeof(type)) || (any->length != (sizeof(type) >> 2))) { \
++ rc = BadLength; \
++ goto unwind; \
++ } \
++ } while(0)
++
+ switch (any->type) {
+ case XIAddMaster:
+ {
+ xXIAddMasterInfo *c = (xXIAddMasterInfo *) any;
+
++ /* Variable length, due to appended name string */
++ if (len < sizeof(xXIAddMasterInfo)) {
++ rc = BadLength;
++ goto unwind;
++ }
+ SWAPIF(swaps(&c->name_len));
++ if (c->name_len > (len - sizeof(xXIAddMasterInfo))) {
++ rc = BadLength;
++ goto unwind;
++ }
+
+ rc = add_master(client, c, flags);
+ if (rc != Success)
+@@ -446,6 +471,7 @@ ProcXIChangeHierarchy(ClientPtr client)
+ {
+ xXIRemoveMasterInfo *r = (xXIRemoveMasterInfo *) any;
+
++ CHANGE_SIZE_MATCH(xXIRemoveMasterInfo);
+ rc = remove_master(client, r, flags);
+ if (rc != Success)
+ goto unwind;
+@@ -455,6 +481,7 @@ ProcXIChangeHierarchy(ClientPtr client)
+ {
+ xXIDetachSlaveInfo *c = (xXIDetachSlaveInfo *) any;
+
++ CHANGE_SIZE_MATCH(xXIDetachSlaveInfo);
+ rc = detach_slave(client, c, flags);
+ if (rc != Success)
+ goto unwind;
+@@ -464,6 +491,7 @@ ProcXIChangeHierarchy(ClientPtr client)
+ {
+ xXIAttachSlaveInfo *c = (xXIAttachSlaveInfo *) any;
+
++ CHANGE_SIZE_MATCH(xXIAttachSlaveInfo);
+ rc = attach_slave(client, c, flags);
+ if (rc != Success)
+ goto unwind;
+@@ -471,6 +499,7 @@ ProcXIChangeHierarchy(ClientPtr client)
+ break;
+ }
+
++ len -= any->length * 4;
+ any = (xXIAnyHierarchyChangeInfo *) ((char *) any + any->length * 4);
+ }
+
+diff --git a/Xi/xigetclientpointer.c b/Xi/xigetclientpointer.c
+index 3c90d58..306dd39 100644
+--- Xi/xigetclientpointer.c
++++ Xi/xigetclientpointer.c
+@@ -50,6 +50,7 @@ int
+ SProcXIGetClientPointer(ClientPtr client)
+ {
+ REQUEST(xXIGetClientPointerReq);
++ REQUEST_SIZE_MATCH(xXIGetClientPointerReq);
+
+ swaps(&stuff->length);
+ swapl(&stuff->win);
+diff --git a/Xi/xigrabdev.c b/Xi/xigrabdev.c
+index 63d95bc..e2a2ae3 100644
+--- Xi/xigrabdev.c
++++ Xi/xigrabdev.c
+@@ -47,6 +47,11 @@ int
+ SProcXIGrabDevice(ClientPtr client)
+ {
+ REQUEST(xXIGrabDeviceReq);
++ /*
++ * Check here for at least the length of the struct we swap, then
++ * let ProcXIGrabDevice check the full size after we swap mask_len.
++ */
++ REQUEST_AT_LEAST_SIZE(xXIGrabDeviceReq);
+
+ swaps(&stuff->length);
+ swaps(&stuff->deviceid);
+@@ -71,7 +76,7 @@ ProcXIGrabDevice(ClientPtr client)
+ unsigned int pointer_mode;
+
+ REQUEST(xXIGrabDeviceReq);
+- REQUEST_AT_LEAST_SIZE(xXIGrabDeviceReq);
++ REQUEST_FIXED_SIZE(xXIGrabDeviceReq, ((size_t) stuff->mask_len) * 4);
+
+ ret = dixLookupDevice(&dev, stuff->deviceid, client, DixGrabAccess);
+ if (ret != Success)
+@@ -131,6 +136,7 @@ int
+ SProcXIUngrabDevice(ClientPtr client)
+ {
+ REQUEST(xXIUngrabDeviceReq);
++ REQUEST_SIZE_MATCH(xXIUngrabDeviceReq);
+
+ swaps(&stuff->length);
+ swaps(&stuff->deviceid);
+@@ -148,6 +154,7 @@ ProcXIUngrabDevice(ClientPtr client)
+ TimeStamp time;
+
+ REQUEST(xXIUngrabDeviceReq);
++ REQUEST_SIZE_MATCH(xXIUngrabDeviceReq);
+
+ ret = dixLookupDevice(&dev, stuff->deviceid, client, DixGetAttrAccess);
+ if (ret != Success)
+--- Xi/xipassivegrab.c.orig 2014-04-15 03:01:56.000000000 +0200
++++ Xi/xipassivegrab.c 2014-12-11 09:00:53.965074134 +0100
+@@ -53,6 +53,7 @@
+ uint32_t *mods;
+
+ REQUEST(xXIPassiveGrabDeviceReq);
++ REQUEST_AT_LEAST_SIZE(xXIPassiveGrabDeviceReq);
+
+ swaps(&stuff->length);
+ swaps(&stuff->deviceid);
+@@ -63,7 +64,9 @@
+ swaps(&stuff->mask_len);
+ swaps(&stuff->num_modifiers);
+
+- mods = (uint32_t *) &stuff[1];
++ REQUEST_FIXED_SIZE(xXIPassiveGrabDeviceReq,
++ ((uint32_t) stuff->mask_len + stuff->num_modifiers) *4);
++ mods = (uint32_t *) &stuff[1] + stuff->mask_len;
+
+ for (i = 0; i < stuff->num_modifiers; i++, mods++) {
+ swapl(mods);
+@@ -92,7 +95,8 @@
+ int mask_len;
+
+ REQUEST(xXIPassiveGrabDeviceReq);
+- REQUEST_AT_LEAST_SIZE(xXIPassiveGrabDeviceReq);
++ REQUEST_FIXED_SIZE(xXIPassiveGrabDeviceReq,
++ ((uint32_t) stuff->mask_len + stuff->num_modifiers) * 4);
+
+ if (stuff->deviceid == XIAllDevices)
+ dev = inputInfo.all_devices;
+@@ -248,6 +252,7 @@
+ uint32_t *modifiers;
+
+ REQUEST(xXIPassiveUngrabDeviceReq);
++ REQUEST_AT_LEAST_SIZE(xXIPassiveUngrabDeviceReq);
+
+ swaps(&stuff->length);
+ swapl(&stuff->grab_window);
+@@ -255,6 +260,8 @@
+ swapl(&stuff->detail);
+ swaps(&stuff->num_modifiers);
+
++ REQUEST_FIXED_SIZE(xXIPassiveUngrabDeviceReq,
++ ((uint32_t) stuff->num_modifiers) << 2);
+ modifiers = (uint32_t *) &stuff[1];
+
+ for (i = 0; i < stuff->num_modifiers; i++, modifiers++)
+@@ -273,7 +280,8 @@
+ int i, rc;
+
+ REQUEST(xXIPassiveUngrabDeviceReq);
+- REQUEST_AT_LEAST_SIZE(xXIPassiveUngrabDeviceReq);
++ REQUEST_FIXED_SIZE(xXIPassiveUngrabDeviceReq,
++ ((uint32_t) stuff->num_modifiers) << 2);
+
+ if (stuff->deviceid == XIAllDevices)
+ dev = inputInfo.all_devices;
+diff --git a/Xi/xiproperty.c b/Xi/xiproperty.c
+index 463607d..8e8e4b0 100644
+--- Xi/xiproperty.c
++++ Xi/xiproperty.c
+@@ -1013,10 +1013,9 @@ int
+ SProcXListDeviceProperties(ClientPtr client)
+ {
+ REQUEST(xListDevicePropertiesReq);
++ REQUEST_SIZE_MATCH(xListDevicePropertiesReq);
+
+ swaps(&stuff->length);
+-
+- REQUEST_SIZE_MATCH(xListDevicePropertiesReq);
+ return (ProcXListDeviceProperties(client));
+ }
+
+@@ -1037,10 +1036,10 @@ int
+ SProcXDeleteDeviceProperty(ClientPtr client)
+ {
+ REQUEST(xDeleteDevicePropertyReq);
++ REQUEST_SIZE_MATCH(xDeleteDevicePropertyReq);
+
+ swaps(&stuff->length);
+ swapl(&stuff->property);
+- REQUEST_SIZE_MATCH(xDeleteDevicePropertyReq);
+ return (ProcXDeleteDeviceProperty(client));
+ }
+
+@@ -1048,13 +1047,13 @@ int
+ SProcXGetDeviceProperty(ClientPtr client)
+ {
+ REQUEST(xGetDevicePropertyReq);
++ REQUEST_SIZE_MATCH(xGetDevicePropertyReq);
+
+ swaps(&stuff->length);
+ swapl(&stuff->property);
+ swapl(&stuff->type);
+ swapl(&stuff->longOffset);
+ swapl(&stuff->longLength);
+- REQUEST_SIZE_MATCH(xGetDevicePropertyReq);
+ return (ProcXGetDeviceProperty(client));
+ }
+
+@@ -1253,11 +1252,10 @@ int
+ SProcXIListProperties(ClientPtr client)
+ {
+ REQUEST(xXIListPropertiesReq);
++ REQUEST_SIZE_MATCH(xXIListPropertiesReq);
+
+ swaps(&stuff->length);
+ swaps(&stuff->deviceid);
+-
+- REQUEST_SIZE_MATCH(xXIListPropertiesReq);
+ return (ProcXIListProperties(client));
+ }
+
+@@ -1279,11 +1277,11 @@ int
+ SProcXIDeleteProperty(ClientPtr client)
+ {
+ REQUEST(xXIDeletePropertyReq);
++ REQUEST_SIZE_MATCH(xXIDeletePropertyReq);
+
+ swaps(&stuff->length);
+ swaps(&stuff->deviceid);
+ swapl(&stuff->property);
+- REQUEST_SIZE_MATCH(xXIDeletePropertyReq);
+ return (ProcXIDeleteProperty(client));
+ }
+
+@@ -1291,6 +1289,7 @@ int
+ SProcXIGetProperty(ClientPtr client)
+ {
+ REQUEST(xXIGetPropertyReq);
++ REQUEST_SIZE_MATCH(xXIGetPropertyReq);
+
+ swaps(&stuff->length);
+ swaps(&stuff->deviceid);
+@@ -1298,7 +1297,6 @@ SProcXIGetProperty(ClientPtr client)
+ swapl(&stuff->type);
+ swapl(&stuff->offset);
+ swapl(&stuff->len);
+- REQUEST_SIZE_MATCH(xXIGetPropertyReq);
+ return (ProcXIGetProperty(client));
+ }
+
+diff --git a/Xi/xiquerydevice.c b/Xi/xiquerydevice.c
+index 4e544f0..67a9a4f 100644
+--- Xi/xiquerydevice.c
++++ Xi/xiquerydevice.c
+@@ -54,6 +54,7 @@ int
+ SProcXIQueryDevice(ClientPtr client)
+ {
+ REQUEST(xXIQueryDeviceReq);
++ REQUEST_SIZE_MATCH(xXIQueryDeviceReq);
+
+ swaps(&stuff->length);
+ swaps(&stuff->deviceid);
+diff --git a/Xi/xiquerypointer.c b/Xi/xiquerypointer.c
+index e9bdd42..7ec0c85 100644
+--- Xi/xiquerypointer.c
++++ Xi/xiquerypointer.c
+@@ -63,6 +63,8 @@ int
+ SProcXIQueryPointer(ClientPtr client)
+ {
+ REQUEST(xXIQueryPointerReq);
++ REQUEST_SIZE_MATCH(xXIQueryPointerReq);
++
+ swaps(&stuff->length);
+ swaps(&stuff->deviceid);
+ swapl(&stuff->win);
+diff --git a/Xi/xiselectev.c b/Xi/xiselectev.c
+index 45a996e..168579f 100644
+--- Xi/xiselectev.c
++++ Xi/xiselectev.c
+@@ -114,6 +114,7 @@ int
+ SProcXISelectEvents(ClientPtr client)
+ {
+ int i;
++ int len;
+ xXIEventMask *evmask;
+
+ REQUEST(xXISelectEventsReq);
+@@ -122,10 +123,17 @@ SProcXISelectEvents(ClientPtr client)
+ swapl(&stuff->win);
+ swaps(&stuff->num_masks);
+
++ len = stuff->length - bytes_to_int32(sizeof(xXISelectEventsReq));
+ evmask = (xXIEventMask *) &stuff[1];
+ for (i = 0; i < stuff->num_masks; i++) {
++ if (len < bytes_to_int32(sizeof(xXIEventMask)))
++ return BadLength;
++ len -= bytes_to_int32(sizeof(xXIEventMask));
+ swaps(&evmask->deviceid);
+ swaps(&evmask->mask_len);
++ if (len < evmask->mask_len)
++ return BadLength;
++ len -= evmask->mask_len;
+ evmask =
+ (xXIEventMask *) (((char *) &evmask[1]) + evmask->mask_len * 4);
+ }
+diff --git a/Xi/xisetclientpointer.c b/Xi/xisetclientpointer.c
+index 38ff51e..24d4a53 100644
+--- Xi/xisetclientpointer.c
++++ Xi/xisetclientpointer.c
+@@ -51,10 +51,11 @@ int
+ SProcXISetClientPointer(ClientPtr client)
+ {
+ REQUEST(xXISetClientPointerReq);
++ REQUEST_SIZE_MATCH(xXISetClientPointerReq);
++
+ swaps(&stuff->length);
+ swapl(&stuff->win);
+ swaps(&stuff->deviceid);
+- REQUEST_SIZE_MATCH(xXISetClientPointerReq);
+ return (ProcXISetClientPointer(client));
+ }
+
+diff --git a/Xi/xisetdevfocus.c b/Xi/xisetdevfocus.c
+index 372ec24..96a9a16 100644
+--- Xi/xisetdevfocus.c
++++ Xi/xisetdevfocus.c
+@@ -44,6 +44,8 @@ int
+ SProcXISetFocus(ClientPtr client)
+ {
+ REQUEST(xXISetFocusReq);
++ REQUEST_AT_LEAST_SIZE(xXISetFocusReq);
++
+ swaps(&stuff->length);
+ swaps(&stuff->deviceid);
+ swapl(&stuff->focus);
+@@ -56,6 +58,8 @@ int
+ SProcXIGetFocus(ClientPtr client)
+ {
+ REQUEST(xXIGetFocusReq);
++ REQUEST_AT_LEAST_SIZE(xXIGetFocusReq);
++
+ swaps(&stuff->length);
+ swaps(&stuff->deviceid);
+
+diff --git a/Xi/xiwarppointer.c b/Xi/xiwarppointer.c
+index 3f051f7..780758a 100644
+--- Xi/xiwarppointer.c
++++ Xi/xiwarppointer.c
+@@ -56,6 +56,8 @@ int
+ SProcXIWarpPointer(ClientPtr client)
+ {
+ REQUEST(xXIWarpPointerReq);
++ REQUEST_SIZE_MATCH(xXIWarpPointerReq);
++
+ swaps(&stuff->length);
+ swapl(&stuff->src_win);
+ swapl(&stuff->dst_win);
+diff --git a/include/dix.h b/include/dix.h
+index e0c6ed8..21176a8 100644
+--- include/dix.h
++++ include/dix.h
+@@ -74,6 +74,10 @@ SOFTWARE.
+ if ((sizeof(req) >> 2) > client->req_len )\
+ return(BadLength)
+
++#define REQUEST_AT_LEAST_EXTRA_SIZE(req, extra) \
++ if (((sizeof(req) + ((uint64_t) extra)) >> 2) > client->req_len ) \
++ return(BadLength)
++
+ #define REQUEST_FIXED_SIZE(req, n)\
+ if (((sizeof(req) >> 2) > client->req_len) || \
+ ((n >> 2) >= client->req_len) || \
+--
+cgit v0.10.2
+
Property changes on: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8095
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Added: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8096
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-CVE-2014-8096 (rev 0)
+++ trunk/x11-servers/xorg-server/files/patch-CVE-2014-8096 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,27 @@
+From 7553082b9b883b5f130044f3d53bce2f0b660e52 Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith at oracle.com>
+Date: Sun, 26 Jan 2014 17:18:54 -0800
+Subject: [PATCH 08/40] xcmisc: unvalidated length in SProcXCMiscGetXIDList()
+ [CVE-2014-8096]
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
+Reviewed-by: Peter Hutterer <peter.hutterer at who-t.net>
+---
+ Xext/xcmisc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/Xext/xcmisc.c b/Xext/xcmisc.c
+index 034bfb6..1e91010 100644
+--- Xext/xcmisc.c
++++ Xext/xcmisc.c
+@@ -167,6 +167,7 @@ static int
+ SProcXCMiscGetXIDList(ClientPtr client)
+ {
+ REQUEST(xXCMiscGetXIDListReq);
++ REQUEST_SIZE_MATCH(xXCMiscGetXIDListReq);
+
+ swaps(&stuff->length);
+ swapl(&stuff->count);
+--
+2.1.2
+
Property changes on: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8096
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Added: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8097
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-CVE-2014-8097 (rev 0)
+++ trunk/x11-servers/xorg-server/files/patch-CVE-2014-8097 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,73 @@
+From 2ef42519c41e793579c9cea699c866fee3d9321f Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith at oracle.com>
+Date: Wed, 22 Jan 2014 23:12:04 -0800
+Subject: [PATCH 06/40] dbe: unvalidated lengths in DbeSwapBuffers calls
+ [CVE-2014-8097]
+
+ProcDbeSwapBuffers() has a 32bit (n) length value that it uses to read
+from a buffer. The length is never validated, which can lead to out of
+bound reads, and possibly returning the data read from out of bounds to
+the misbehaving client via an X Error packet.
+
+SProcDbeSwapBuffers() swaps data (for correct endianness) before
+handing it off to the real proc. While doing the swapping, the
+length field is not validated, which can cause memory corruption.
+
+v2: reorder checks to avoid compilers optimizing out checks for overflow
+that happen after we'd already have done the overflowing multiplications.
+
+Reported-by: Ilja Van Sprundel <ivansprundel at ioactive.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
+Reviewed-by: Peter Hutterer <peter.hutterer at who-t.net>
+---
+ dbe/dbe.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/dbe/dbe.c b/dbe/dbe.c
+index 527588c..df2ad5c 100644
+--- dbe/dbe.c
++++ dbe/dbe.c
+@@ -450,18 +450,20 @@ ProcDbeSwapBuffers(ClientPtr client)
+ DbeSwapInfoPtr swapInfo;
+ xDbeSwapInfo *dbeSwapInfo;
+ int error;
+- register int i, j;
+- int nStuff;
++ unsigned int i, j;
++ unsigned int nStuff;
+
+ REQUEST_AT_LEAST_SIZE(xDbeSwapBuffersReq);
+ nStuff = stuff->n; /* use local variable for performance. */
+
+ if (nStuff == 0) {
++ REQUEST_SIZE_MATCH(xDbeSwapBuffersReq);
+ return Success;
+ }
+
+ if (nStuff > UINT32_MAX / sizeof(DbeSwapInfoRec))
+ return BadAlloc;
++ REQUEST_FIXED_SIZE(xDbeSwapBuffersReq, nStuff * sizeof(xDbeSwapInfo));
+
+ /* Get to the swap info appended to the end of the request. */
+ dbeSwapInfo = (xDbeSwapInfo *) &stuff[1];
+@@ -914,13 +916,16 @@ static int
+ SProcDbeSwapBuffers(ClientPtr client)
+ {
+ REQUEST(xDbeSwapBuffersReq);
+- register int i;
++ unsigned int i;
+ xDbeSwapInfo *pSwapInfo;
+
+ swaps(&stuff->length);
+ REQUEST_AT_LEAST_SIZE(xDbeSwapBuffersReq);
+
+ swapl(&stuff->n);
++ if (stuff->n > UINT32_MAX / sizeof(DbeSwapInfoRec))
++ return BadAlloc;
++ REQUEST_FIXED_SIZE(xDbeSwapBuffersReq, stuff->n * sizeof(xDbeSwapInfo));
+
+ if (stuff->n != 0) {
+ pSwapInfo = (xDbeSwapInfo *) stuff + 1;
+--
+2.1.2
+
Property changes on: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8097
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Added: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8097-pt2
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-CVE-2014-8097-pt2 (rev 0)
+++ trunk/x11-servers/xorg-server/files/patch-CVE-2014-8097-pt2 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,50 @@
+From b20912c3d45cbbde3c443e6c3d9e189092fe65e1 Mon Sep 17 00:00:00 2001
+From: Keith Packard <keithp at keithp.com>
+Date: Tue, 9 Dec 2014 09:30:57 -0800
+Subject: [PATCH 36/40] dbe: Call to DDX SwapBuffers requires address of int,
+ not unsigned int [CVE-2014-8097 pt. 2]
+
+When the local types used to walk the DBE request were changed, this
+changed the type of the parameter passed to the DDX SwapBuffers API,
+but there wasn't a matching change in the API definition.
+
+At this point, with the API frozen, I just stuck a new variable in
+with the correct type. Because we've already bounds-checked nStuff to
+be smaller than UINT32_MAX / sizeof(DbeSwapInfoRec), we know it will
+fit in a signed int without overflow.
+
+Signed-off-by: Keith Packard <keithp at keithp.com
+Reviewed-by: Alan Coopersmith <alan.coopersmith at oracle.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
+---
+ dbe/dbe.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/dbe/dbe.c b/dbe/dbe.c
+index df2ad5c..e5d928d 100644
+--- dbe/dbe.c
++++ dbe/dbe.c
+@@ -452,6 +452,7 @@ ProcDbeSwapBuffers(ClientPtr client)
+ int error;
+ unsigned int i, j;
+ unsigned int nStuff;
++ int nStuff_i; /* DDX API requires int for nStuff */
+
+ REQUEST_AT_LEAST_SIZE(xDbeSwapBuffersReq);
+ nStuff = stuff->n; /* use local variable for performance. */
+@@ -527,9 +528,10 @@ ProcDbeSwapBuffers(ClientPtr client)
+ * could deal with cross-screen synchronization.
+ */
+
+- while (nStuff > 0) {
++ nStuff_i = nStuff;
++ while (nStuff_i > 0) {
+ pDbeScreenPriv = DBE_SCREEN_PRIV_FROM_WINDOW(swapInfo[0].pWindow);
+- error = (*pDbeScreenPriv->SwapBuffers) (client, &nStuff, swapInfo);
++ error = (*pDbeScreenPriv->SwapBuffers) (client, &nStuff_i, swapInfo);
+ if (error != Success) {
+ free(swapInfo);
+ return error;
+--
+2.1.2
+
Property changes on: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8097-pt2
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Added: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8098-1-8
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-CVE-2014-8098-1-8 (rev 0)
+++ trunk/x11-servers/xorg-server/files/patch-CVE-2014-8098-1-8 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,59 @@
+From 13d36923e0ddb077f4854e354c3d5c80590b5d9d Mon Sep 17 00:00:00 2001
+From: Adam Jackson <ajax at redhat.com>
+Date: Mon, 10 Nov 2014 12:13:39 -0500
+Subject: [PATCH 22/40] glx: Fix image size computation for EXT_texture_integer
+ [CVE-2014-8098 1/8]
+
+Without this we'd reject the request with BadLength. Note that some old
+versions of Mesa had a bug in the same place, and would _send_ zero
+bytes of image data; these will now be rejected, correctly.
+
+Reviewed-by: Keith Packard <keithp at keithp.com>
+Reviewed-by: Julien Cristau <jcristau at debian.org>
+Reviewed-by: Michal Srb <msrb at suse.com>
+Reviewed-by: Andy Ritger <aritger at nvidia.com>
+Signed-off-by: Adam Jackson <ajax at redhat.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
+---
+ glx/rensize.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/glx/rensize.c b/glx/rensize.c
+index ba22d10..9ff73c7 100644
+--- glx/rensize.c
++++ glx/rensize.c
+@@ -224,6 +224,11 @@ __glXImageSize(GLenum format, GLenum type, GLenum target,
+ case GL_ALPHA:
+ case GL_LUMINANCE:
+ case GL_INTENSITY:
++ case GL_RED_INTEGER_EXT:
++ case GL_GREEN_INTEGER_EXT:
++ case GL_BLUE_INTEGER_EXT:
++ case GL_ALPHA_INTEGER_EXT:
++ case GL_LUMINANCE_INTEGER_EXT:
+ elementsPerGroup = 1;
+ break;
+ case GL_422_EXT:
+@@ -234,14 +239,19 @@ __glXImageSize(GLenum format, GLenum type, GLenum target,
+ case GL_DEPTH_STENCIL_MESA:
+ case GL_YCBCR_MESA:
+ case GL_LUMINANCE_ALPHA:
++ case GL_LUMINANCE_ALPHA_INTEGER_EXT:
+ elementsPerGroup = 2;
+ break;
+ case GL_RGB:
+ case GL_BGR:
++ case GL_RGB_INTEGER_EXT:
++ case GL_BGR_INTEGER_EXT:
+ elementsPerGroup = 3;
+ break;
+ case GL_RGBA:
+ case GL_BGRA:
++ case GL_RGBA_INTEGER_EXT:
++ case GL_BGRA_INTEGER_EXT:
+ case GL_ABGR_EXT:
+ elementsPerGroup = 4;
+ break;
+--
+2.1.2
+
Property changes on: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8098-1-8
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Added: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8098-2-8
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-CVE-2014-8098-2-8 (rev 0)
+++ trunk/x11-servers/xorg-server/files/patch-CVE-2014-8098-2-8 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,75 @@
+From be09e0c988ffdb0371293af49fb4ea8f49ed324a Mon Sep 17 00:00:00 2001
+From: Julien Cristau <jcristau at debian.org>
+Date: Mon, 10 Nov 2014 12:13:41 -0500
+Subject: [PATCH 24/40] glx: Length checking for GLXRender requests (v2)
+ [CVE-2014-8098 2/8]
+
+v2:
+Remove can't-happen comparison for cmdlen < 0 (Michal Srb)
+
+Reviewed-by: Adam Jackson <ajax at redhat.com>
+Reviewed-by: Michal Srb <msrb at suse.com>
+Reviewed-by: Andy Ritger <aritger at nvidia.com>
+Signed-off-by: Julien Cristau <jcristau at debian.org>
+Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
+---
+ glx/glxcmds.c | 21 ++++++++++-----------
+ 1 file changed, 10 insertions(+), 11 deletions(-)
+
+diff --git a/glx/glxcmds.c b/glx/glxcmds.c
+index ea42e2a..ddd9119 100644
+--- glx/glxcmds.c
++++ glx/glxcmds.c
+@@ -2025,7 +2025,7 @@ __glXDisp_Render(__GLXclientState * cl, GLbyte * pc)
+ left = (req->length << 2) - sz_xGLXRenderReq;
+ while (left > 0) {
+ __GLXrenderSizeData entry;
+- int extra;
++ int extra = 0;
+ __GLXdispatchRenderProcPtr proc;
+ int err;
+
+@@ -2044,6 +2044,9 @@ __glXDisp_Render(__GLXclientState * cl, GLbyte * pc)
+ cmdlen = hdr->length;
+ opcode = hdr->opcode;
+
++ if (left < cmdlen)
++ return BadLength;
++
+ /*
+ ** Check for core opcodes and grab entry data.
+ */
+@@ -2057,6 +2060,10 @@ __glXDisp_Render(__GLXclientState * cl, GLbyte * pc)
+ return __glXError(GLXBadRenderRequest);
+ }
+
++ if (cmdlen < entry.bytes) {
++ return BadLength;
++ }
++
+ if (entry.varsize) {
+ /* variable size command */
+ extra = (*entry.varsize) (pc + __GLX_RENDER_HDR_SIZE,
+@@ -2064,17 +2071,9 @@ __glXDisp_Render(__GLXclientState * cl, GLbyte * pc)
+ if (extra < 0) {
+ return BadLength;
+ }
+- if (cmdlen != __GLX_PAD(entry.bytes + extra)) {
+- return BadLength;
+- }
+ }
+- else {
+- /* constant size command */
+- if (cmdlen != __GLX_PAD(entry.bytes)) {
+- return BadLength;
+- }
+- }
+- if (left < cmdlen) {
++
++ if (cmdlen != safe_pad(safe_add(entry.bytes, extra))) {
+ return BadLength;
+ }
+
+--
+2.1.2
+
Property changes on: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8098-2-8
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Added: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8098-3-8
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-CVE-2014-8098-3-8 (rev 0)
+++ trunk/x11-servers/xorg-server/files/patch-CVE-2014-8098-3-8 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,153 @@
+From a33a939e6abb255b14d8dbc85fcbd2c55b958bae Mon Sep 17 00:00:00 2001
+From: Adam Jackson <ajax at redhat.com>
+Date: Mon, 10 Nov 2014 12:13:43 -0500
+Subject: [PATCH 26/40] glx: Length checking for RenderLarge requests (v2)
+ [CVE-2014-8098 3/8]
+
+This is a half-measure until we start passing request length into the
+varsize function, but it's better than the nothing we had before.
+
+v2: Verify that there's at least a large render header's worth of
+dataBytes (Julien Cristau)
+
+Reviewed-by: Michal Srb <msrb at suse.com>
+Reviewed-by: Andy Ritger <aritger at nvidia.com>
+Signed-off-by: Adam Jackson <ajax at redhat.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
+---
+ glx/glxcmds.c | 57 ++++++++++++++++++++++++++++++++++-----------------------
+ 1 file changed, 34 insertions(+), 23 deletions(-)
+
+--- glx/glxcmds.c.orig 2014-12-10 14:30:17.826442820 +0100
++++ glx/glxcmds.c 2014-12-10 14:32:34.472432537 +0100
+@@ -2032,6 +2032,8 @@
+
+ __GLX_DECLARE_SWAP_VARIABLES;
+
++ REQUEST_AT_LEAST_SIZE(xGLXRenderLargeReq);
++
+ req = (xGLXRenderLargeReq *) pc;
+ if (client->swapped) {
+ __GLX_SWAP_SHORT(&req->length);
+@@ -2047,12 +2049,14 @@
+ __glXResetLargeCommandStatus(cl);
+ return error;
+ }
++ if (safe_pad(req->dataBytes) < 0)
++ return BadLength;
+ dataBytes = req->dataBytes;
+
+ /*
+ ** Check the request length.
+ */
+- if ((req->length << 2) != __GLX_PAD(dataBytes) + sz_xGLXRenderLargeReq) {
++ if ((req->length << 2) != safe_pad(dataBytes) + sz_xGLXRenderLargeReq) {
+ client->errorValue = req->length;
+ /* Reset in case this isn't 1st request. */
+ __glXResetLargeCommandStatus(cl);
+@@ -2062,7 +2066,7 @@
+
+ if (cl->largeCmdRequestsSoFar == 0) {
+ __GLXrenderSizeData entry;
+- int extra;
++ int extra = 0;
+ size_t cmdlen;
+ int err;
+
+@@ -2075,13 +2079,17 @@
+ return __glXError(GLXBadLargeRequest);
+ }
+
++ if (dataBytes < __GLX_RENDER_LARGE_HDR_SIZE)
++ return BadLength;
++
+ hdr = (__GLXrenderLargeHeader *) pc;
+ if (client->swapped) {
+ __GLX_SWAP_INT(&hdr->length);
+ __GLX_SWAP_INT(&hdr->opcode);
+ }
+- cmdlen = hdr->length;
+ opcode = hdr->opcode;
++ if ((cmdlen = safe_pad(hdr->length)) < 0)
++ return BadLength;
+
+ /*
+ ** Check for core opcodes and grab entry data.
+@@ -2103,17 +2111,13 @@
+ if (extra < 0) {
+ return BadLength;
+ }
+- /* large command's header is 4 bytes longer, so add 4 */
+- if (cmdlen != __GLX_PAD(entry.bytes + 4 + extra)) {
+- return BadLength;
+- }
+ }
+- else {
+- /* constant size command */
+- if (cmdlen != __GLX_PAD(entry.bytes + 4)) {
+- return BadLength;
+- }
++
++ /* the +4 is safe because we know entry.bytes is small */
++ if (cmdlen != safe_pad(safe_add(entry.bytes + 4, extra))) {
++ return BadLength;
+ }
++
+ /*
+ ** Make enough space in the buffer, then copy the entire request.
+ */
+@@ -2143,6 +2147,7 @@
+ ** We are receiving subsequent (i.e. not the first) requests of a
+ ** multi request command.
+ */
++ int bytesSoFar; /* including this packet */
+
+ /*
+ ** Check the request number and the total request count.
+@@ -2161,11 +2166,18 @@
+ /*
+ ** Check that we didn't get too much data.
+ */
+- if ((cl->largeCmdBytesSoFar + dataBytes) > cl->largeCmdBytesTotal) {
++ if ((bytesSoFar = safe_add(cl->largeCmdBytesSoFar, dataBytes)) < 0) {
++ client->errorValue = dataBytes;
++ __glXResetLargeCommandStatus(cl);
++ return __glXError(GLXBadLargeRequest);
++ }
++
++ if (bytesSoFar > cl->largeCmdBytesTotal) {
+ client->errorValue = dataBytes;
+ __glXResetLargeCommandStatus(cl);
+ return __glXError(GLXBadLargeRequest);
+ }
++
+ memcpy(cl->largeCmdBuf + cl->largeCmdBytesSoFar, pc, dataBytes);
+ cl->largeCmdBytesSoFar += dataBytes;
+ cl->largeCmdRequestsSoFar++;
+@@ -2177,17 +2189,16 @@
+ ** This is the last request; it must have enough bytes to complete
+ ** the command.
+ */
+- /* NOTE: the two pad macros have been added below; they are needed
+- ** because the client library pads the total byte count, but not
+- ** the per-request byte counts. The Protocol Encoding says the
+- ** total byte count should not be padded, so a proposal will be
+- ** made to the ARB to relax the padding constraint on the total
+- ** byte count, thus preserving backward compatibility. Meanwhile,
+- ** the padding done below fixes a bug that did not allow
+- ** large commands of odd sizes to be accepted by the server.
++ /* NOTE: the pad macro below is needed because the client library
++ ** pads the total byte count, but not the per-request byte counts.
++ ** The Protocol Encoding says the total byte count should not be
++ ** padded, so a proposal will be made to the ARB to relax the
++ ** padding constraint on the total byte count, thus preserving
++ ** backward compatibility. Meanwhile, the padding done below
++ ** fixes a bug that did not allow large commands of odd sizes to
++ ** be accepted by the server.
+ */
+- if (__GLX_PAD(cl->largeCmdBytesSoFar) !=
+- __GLX_PAD(cl->largeCmdBytesTotal)) {
++ if (safe_pad(cl->largeCmdBytesSoFar) != cl->largeCmdBytesTotal) {
+ client->errorValue = dataBytes;
+ __glXResetLargeCommandStatus(cl);
+ return __glXError(GLXBadLargeRequest);
Property changes on: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8098-3-8
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Added: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8098-4-8
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-CVE-2014-8098-4-8 (rev 0)
+++ trunk/x11-servers/xorg-server/files/patch-CVE-2014-8098-4-8 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,51 @@
+From c91e4abc3b892f42802efa20fef7ada442c2d3f5 Mon Sep 17 00:00:00 2001
+From: Adam Jackson <ajax at redhat.com>
+Date: Mon, 10 Nov 2014 12:13:44 -0500
+Subject: [PATCH 27/40] glx: Top-level length checking for swapped
+ VendorPrivate requests [CVE-2014-8098 4/8]
+
+Reviewed-by: Keith Packard <keithp at keithp.com>
+Reviewed-by: Julien Cristau <jcristau at debian.org>
+Reviewed-by: Michal Srb <msrb at suse.com>
+Reviewed-by: Andy Ritger <aritger at nvidia.com>
+Signed-off-by: Adam Jackson <ajax at redhat.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
+---
+ glx/glxcmdsswap.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/glx/glxcmdsswap.c b/glx/glxcmdsswap.c
+index 5d179f3..9ec1222 100644
+--- glx/glxcmdsswap.c
++++ glx/glxcmdsswap.c
+@@ -958,11 +958,13 @@ __glXDispSwap_RenderLarge(__GLXclientState * cl, GLbyte * pc)
+ int
+ __glXDispSwap_VendorPrivate(__GLXclientState * cl, GLbyte * pc)
+ {
++ ClientPtr client = cl->client;
+ xGLXVendorPrivateReq *req;
+ GLint vendorcode;
+ __GLXdispatchVendorPrivProcPtr proc;
+
+ __GLX_DECLARE_SWAP_VARIABLES;
++ REQUEST_AT_LEAST_SIZE(xGLXVendorPrivateReq);
+
+ req = (xGLXVendorPrivateReq *) pc;
+ __GLX_SWAP_SHORT(&req->length);
+@@ -985,11 +987,13 @@ __glXDispSwap_VendorPrivate(__GLXclientState * cl, GLbyte * pc)
+ int
+ __glXDispSwap_VendorPrivateWithReply(__GLXclientState * cl, GLbyte * pc)
+ {
++ ClientPtr client = cl->client;
+ xGLXVendorPrivateWithReplyReq *req;
+ GLint vendorcode;
+ __GLXdispatchVendorPrivProcPtr proc;
+
+ __GLX_DECLARE_SWAP_VARIABLES;
++ REQUEST_AT_LEAST_SIZE(xGLXVendorPrivateWithReplyReq);
+
+ req = (xGLXVendorPrivateWithReplyReq *) pc;
+ __GLX_SWAP_SHORT(&req->length);
+--
+2.1.2
+
Property changes on: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8098-4-8
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Added: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8098-6-8
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-CVE-2014-8098-6-8 (rev 0)
+++ trunk/x11-servers/xorg-server/files/patch-CVE-2014-8098-6-8 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,45 @@
+From 44ba149f28ece93c2fbfc9cc980588de5322dd4b Mon Sep 17 00:00:00 2001
+From: Adam Jackson <ajax at redhat.com>
+Date: Mon, 10 Nov 2014 12:13:46 -0500
+Subject: [PATCH 29/40] glx: Length-checking for non-generated vendor private
+ requests [CVE-2014-8098 6/8]
+
+Reviewed-by: Keith Packard <keithp at keithp.com>
+Reviewed-by: Michal Srb <msrb at suse.com>
+Reviewed-by: Andy Ritger <aritger at nvidia.com>
+Signed-off-by: Adam Jackson <ajax at redhat.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
+---
+ glx/indirect_program.c | 2 ++
+ glx/swap_interval.c | 2 ++
+ 2 files changed, 4 insertions(+)
+
+diff --git a/glx/indirect_program.c b/glx/indirect_program.c
+index cda139e..5caee7b 100644
+--- glx/indirect_program.c
++++ glx/indirect_program.c
+@@ -56,6 +56,8 @@ DoGetProgramString(struct __GLXclientStateRec *cl, GLbyte * pc,
+ __GLXcontext *const cx = __glXForceCurrent(cl, req->contextTag, &error);
+ ClientPtr client = cl->client;
+
++ REQUEST_FIXED_SIZE(xGLXVendorPrivateWithReplyReq, 8);
++
+ pc += __GLX_VENDPRIV_HDR_SIZE;
+ if (cx != NULL) {
+ GLenum target;
+diff --git a/glx/swap_interval.c b/glx/swap_interval.c
+index 17bc992..2320550 100644
+--- glx/swap_interval.c
++++ glx/swap_interval.c
+@@ -46,6 +46,8 @@ DoSwapInterval(__GLXclientState * cl, GLbyte * pc, int do_swap)
+ __GLXcontext *cx;
+ GLint interval;
+
++ REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 4);
++
+ cx = __glXLookupContextByTag(cl, tag);
+
+ if ((cx == NULL) || (cx->pGlxScreen == NULL)) {
+--
+2.1.2
+
Property changes on: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8098-6-8
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Added: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8098-7-8
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-CVE-2014-8098-7-8 (rev 0)
+++ trunk/x11-servers/xorg-server/files/patch-CVE-2014-8098-7-8 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,553 @@
+From 984583a497c813df5827ae22483133e704fee79c Mon Sep 17 00:00:00 2001
+From: Adam Jackson <ajax at redhat.com>
+Date: Mon, 10 Nov 2014 12:13:47 -0500
+Subject: [PATCH 30/40] glx: Length checking for non-generated single requests
+ (v2) [CVE-2014-8098 7/8]
+
+v2:
+Fix single versus vendor-private length checking for ARB_imaging subset
+extensions. (Julien Cristau)
+
+v3:
+Fix single versus vendor-private length checking for ARB_imaging subset
+extensions. (Julien Cristau)
+
+Reviewed-by: Michal Srb <msrb at suse.com>
+Reviewed-by: Andy Ritger <aritger at nvidia.com>
+Signed-off-by: Adam Jackson <ajax at redhat.com>
+Signed-off-by: Julien Cristau <jcristau at debian.org>
+Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
+---
+ glx/indirect_texture_compression.c | 4 ++++
+ glx/single2.c | 23 +++++++++++++++-----
+ glx/single2swap.c | 19 ++++++++++++----
+ glx/singlepix.c | 44 +++++++++++++++++++++++++-------------
+ glx/singlepixswap.c | 34 ++++++++++++++++++++++++-----
+ 5 files changed, 95 insertions(+), 29 deletions(-)
+
+diff --git a/glx/indirect_texture_compression.c b/glx/indirect_texture_compression.c
+index cda7656..1ebf7f3 100644
+--- glx/indirect_texture_compression.c
++++ glx/indirect_texture_compression.c
+@@ -43,6 +43,8 @@ __glXDisp_GetCompressedTexImage(struct __GLXclientStateRec *cl, GLbyte * pc)
+ __GLXcontext *const cx = __glXForceCurrent(cl, req->contextTag, &error);
+ ClientPtr client = cl->client;
+
++ REQUEST_FIXED_SIZE(xGLXSingleReq, 8);
++
+ pc += __GLX_SINGLE_HDR_SIZE;
+ if (cx != NULL) {
+ const GLenum target = *(GLenum *) (pc + 0);
+@@ -87,6 +89,8 @@ __glXDispSwap_GetCompressedTexImage(struct __GLXclientStateRec *cl, GLbyte * pc)
+ __glXForceCurrent(cl, bswap_32(req->contextTag), &error);
+ ClientPtr client = cl->client;
+
++ REQUEST_FIXED_SIZE(xGLXSingleReq, 8);
++
+ pc += __GLX_SINGLE_HDR_SIZE;
+ if (cx != NULL) {
+ const GLenum target = (GLenum) bswap_32(*(int *) (pc + 0));
+--- glx/single2.c.orig 2014-04-15 03:01:57.000000000 +0200
++++ glx/single2.c 2014-12-11 09:08:22.788060618 +0100
+@@ -49,11 +49,14 @@
+ int
+ __glXDisp_FeedbackBuffer(__GLXclientState * cl, GLbyte * pc)
+ {
++ ClientPtr client = cl->client;
+ GLsizei size;
+ GLenum type;
+ __GLXcontext *cx;
+ int error;
+
++ REQUEST_FIXED_SIZE(xGLXSingleReq, 8);
++
+ cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error);
+ if (!cx) {
+ return error;
+@@ -80,10 +83,13 @@
+ int
+ __glXDisp_SelectBuffer(__GLXclientState * cl, GLbyte * pc)
+ {
++ ClientPtr client = cl->client;
+ __GLXcontext *cx;
+ GLsizei size;
+ int error;
+
++ REQUEST_FIXED_SIZE(xGLXSingleReq, 4);
++
+ cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error);
+ if (!cx) {
+ return error;
+@@ -108,7 +114,7 @@
+ int
+ __glXDisp_RenderMode(__GLXclientState * cl, GLbyte * pc)
+ {
+- ClientPtr client;
++ ClientPtr client = cl->client;
+ xGLXRenderModeReply reply;
+ __GLXcontext *cx;
+ GLint nitems = 0, retBytes = 0, retval, newModeCheck;
+@@ -116,6 +122,8 @@
+ GLenum newMode;
+ int error;
+
++ REQUEST_FIXED_SIZE(xGLXSingleReq, 4);
++
+ cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error);
+ if (!cx) {
+ return error;
+@@ -192,7 +200,6 @@
+ ** selection array, as per the API for glRenderMode itself.
+ */
+ noChangeAllowed:;
+- client = cl->client;
+ reply = (xGLXRenderModeReply) {
+ .type = X_Reply,
+ .sequenceNumber = client->sequence,
+@@ -211,9 +218,12 @@
+ int
+ __glXDisp_Flush(__GLXclientState * cl, GLbyte * pc)
+ {
++ ClientPtr client = cl->client;
+ __GLXcontext *cx;
+ int error;
+
++ REQUEST_SIZE_MATCH(xGLXSingleReq);
++
+ cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error);
+ if (!cx) {
+ return error;
+@@ -227,10 +237,12 @@
+ int
+ __glXDisp_Finish(__GLXclientState * cl, GLbyte * pc)
+ {
++ ClientPtr client = cl->client;
+ __GLXcontext *cx;
+- ClientPtr client;
+ int error;
+
++ REQUEST_SIZE_MATCH(xGLXSingleReq);
++
+ cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error);
+ if (!cx) {
+ return error;
+@@ -321,7 +332,7 @@
+ int
+ DoGetString(__GLXclientState * cl, GLbyte * pc, GLboolean need_swap)
+ {
+- ClientPtr client;
++ ClientPtr client = cl->client;
+ __GLXcontext *cx;
+ GLenum name;
+ const char *string;
+@@ -331,6 +342,8 @@
+ char *buf = NULL, *buf1 = NULL;
+ GLint length = 0;
+
++ REQUEST_FIXED_SIZE(xGLXSingleReq, 4);
++
+ /* If the client has the opposite byte order, swap the contextTag and
+ * the name.
+ */
+@@ -347,7 +360,6 @@
+ pc += __GLX_SINGLE_HDR_SIZE;
+ name = *(GLenum *) (pc + 0);
+ string = (const char *) CALL_GetString(GET_DISPATCH(), (name));
+- client = cl->client;
+
+ if (string == NULL)
+ string = "";
+--- glx/single2swap.c.orig 2014-04-15 03:01:57.000000000 +0200
++++ glx/single2swap.c 2014-12-11 09:05:12.670056539 +0100
+@@ -45,6 +45,7 @@
+ int
+ __glXDispSwap_FeedbackBuffer(__GLXclientState * cl, GLbyte * pc)
+ {
++ ClientPtr client = cl->client;
+ GLsizei size;
+ GLenum type;
+
+@@ -52,6 +53,8 @@
+ __GLXcontext *cx;
+ int error;
+
++ REQUEST_FIXED_SIZE(xGLXSingleReq, 8);
++
+ __GLX_SWAP_INT(&((xGLXSingleReq *) pc)->contextTag);
+ cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error);
+ if (!cx) {
+@@ -81,12 +84,15 @@
+ int
+ __glXDispSwap_SelectBuffer(__GLXclientState * cl, GLbyte * pc)
+ {
++ ClientPtr client = cl->client;
+ __GLXcontext *cx;
+ GLsizei size;
+
+ __GLX_DECLARE_SWAP_VARIABLES;
+ int error;
+
++ REQUEST_FIXED_SIZE(xGLXSingleReq, 4);
++
+ __GLX_SWAP_INT(&((xGLXSingleReq *) pc)->contextTag);
+ cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error);
+ if (!cx) {
+@@ -113,7 +119,7 @@
+ int
+ __glXDispSwap_RenderMode(__GLXclientState * cl, GLbyte * pc)
+ {
+- ClientPtr client;
++ ClientPtr client = cl->client;
+ __GLXcontext *cx;
+ xGLXRenderModeReply reply;
+ GLint nitems = 0, retBytes = 0, retval, newModeCheck;
+@@ -124,6 +130,8 @@
+ __GLX_DECLARE_SWAP_ARRAY_VARIABLES;
+ int error;
+
++ REQUEST_FIXED_SIZE(xGLXSingleReq, 4);
++
+ __GLX_SWAP_INT(&((xGLXSingleReq *) pc)->contextTag);
+ cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error);
+ if (!cx) {
+@@ -204,7 +212,6 @@
+ ** selection array, as per the API for glRenderMode itself.
+ */
+ noChangeAllowed:;
+- client = cl->client;
+ reply = (xGLXRenderModeReply) {
+ .type = X_Reply,
+ .sequenceNumber = client->sequence,
+@@ -228,11 +235,14 @@
+ int
+ __glXDispSwap_Flush(__GLXclientState * cl, GLbyte * pc)
+ {
++ ClientPtr client = cl->client;
+ __GLXcontext *cx;
+ int error;
+
+ __GLX_DECLARE_SWAP_VARIABLES;
+
++ REQUEST_SIZE_MATCH(xGLXSingleReq);
++
+ __GLX_SWAP_INT(&((xGLXSingleReq *) pc)->contextTag);
+ cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error);
+ if (!cx) {
+@@ -247,12 +257,14 @@
+ int
+ __glXDispSwap_Finish(__GLXclientState * cl, GLbyte * pc)
+ {
++ ClientPtr client = cl->client;
+ __GLXcontext *cx;
+- ClientPtr client;
+ int error;
+
+ __GLX_DECLARE_SWAP_VARIABLES;
+
++ REQUEST_SIZE_MATCH(xGLXSingleReq);
++
+ __GLX_SWAP_INT(&((xGLXSingleReq *) pc)->contextTag);
+ cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error);
+ if (!cx) {
+@@ -264,7 +276,6 @@
+ cx->hasUnflushedCommands = GL_FALSE;
+
+ /* Send empty reply packet to indicate finish is finished */
+- client = cl->client;
+ __GLX_BEGIN_REPLY(0);
+ __GLX_PUT_RETVAL(0);
+ __GLX_SWAP_REPLY_HEADER();
+--- glx/singlepix.c.orig 2014-12-11 09:04:51.072058678 +0100
++++ glx/singlepix.c 2014-12-11 09:10:51.484033826 +0100
+@@ -55,6 +55,8 @@
+ int error;
+ char *answer, answerBuffer[200];
+
++ REQUEST_FIXED_SIZE(xGLXSingleReq, 28);
++
+ cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error);
+ if (!cx) {
+ return error;
+@@ -107,6 +109,8 @@
+ char *answer, answerBuffer[200];
+ GLint width = 0, height = 0, depth = 1;
+
++ REQUEST_FIXED_SIZE(xGLXSingleReq, 20);
++
+ cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error);
+ if (!cx) {
+ return error;
+@@ -169,6 +173,8 @@
+ GLubyte answerBuffer[200];
+ char *answer;
+
++ REQUEST_FIXED_SIZE(xGLXSingleReq, 4);
++
+ cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error);
+ if (!cx) {
+ return error;
+@@ -231,15 +237,13 @@
+ compsize = __glGetTexImage_size(target, 1, format, type, width, 1, 1);
+ compsize2 = __glGetTexImage_size(target, 1, format, type, height, 1, 1);
+
+- if (compsize < 0)
++ if ((compsize = safe_pad(compsize)) < 0)
+ return BadLength;
+- if (compsize2 < 0)
++ if ((compsize2 = safe_pad(compsize2)) < 0)
+ return BadLength;
+- compsize = __GLX_PAD(compsize);
+- compsize2 = __GLX_PAD(compsize2);
+
+ CALL_PixelStorei(GET_DISPATCH(), (GL_PACK_SWAP_BYTES, swapBytes));
+- __GLX_GET_ANSWER_BUFFER(answer, cl, compsize + compsize2, 1);
++ __GLX_GET_ANSWER_BUFFER(answer, cl, safe_add(compsize, compsize2), 1);
+ __glXClearErrorOccured();
+ CALL_GetSeparableFilter(GET_DISPATCH(), (*(GLenum *) (pc + 0),
+ *(GLenum *) (pc + 4),
+@@ -265,7 +269,8 @@
+ __glXDisp_GetSeparableFilter(__GLXclientState * cl, GLbyte * pc)
+ {
+ const GLXContextTag tag = __GLX_GET_SINGLE_CONTEXT_TAG(pc);
+-
++ ClientPtr client = cl->client;
++ REQUEST_FIXED_SIZE(xGLXSingleReq, 16);
+ return GetSeparableFilter(cl, pc + __GLX_SINGLE_HDR_SIZE, tag);
+ }
+
+@@ -273,7 +278,8 @@
+ __glXDisp_GetSeparableFilterEXT(__GLXclientState * cl, GLbyte * pc)
+ {
+ const GLXContextTag tag = __GLX_GET_VENDPRIV_CONTEXT_TAG(pc);
+-
++ ClientPtr client = cl->client;
++ REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 16);
+ return GetSeparableFilter(cl, pc + __GLX_VENDPRIV_HDR_SIZE, tag);
+ }
+
+@@ -343,7 +349,8 @@
+ __glXDisp_GetConvolutionFilter(__GLXclientState * cl, GLbyte * pc)
+ {
+ const GLXContextTag tag = __GLX_GET_SINGLE_CONTEXT_TAG(pc);
+-
++ ClientPtr client = cl->client;
++ REQUEST_FIXED_SIZE(xGLXSingleReq, 16);
+ return GetConvolutionFilter(cl, pc + __GLX_SINGLE_HDR_SIZE, tag);
+ }
+
+@@ -351,7 +358,8 @@
+ __glXDisp_GetConvolutionFilterEXT(__GLXclientState * cl, GLbyte * pc)
+ {
+ const GLXContextTag tag = __GLX_GET_VENDPRIV_CONTEXT_TAG(pc);
+-
++ ClientPtr client = cl->client;
++ REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 16);
+ return GetConvolutionFilter(cl, pc + __GLX_VENDPRIV_HDR_SIZE, tag);
+ }
+
+@@ -411,7 +419,8 @@
+ __glXDisp_GetHistogram(__GLXclientState * cl, GLbyte * pc)
+ {
+ const GLXContextTag tag = __GLX_GET_SINGLE_CONTEXT_TAG(pc);
+-
++ ClientPtr client = cl->client;
++ REQUEST_FIXED_SIZE(xGLXSingleReq, 16);
+ return GetHistogram(cl, pc + __GLX_SINGLE_HDR_SIZE, tag);
+ }
+
+@@ -419,7 +428,8 @@
+ __glXDisp_GetHistogramEXT(__GLXclientState * cl, GLbyte * pc)
+ {
+ const GLXContextTag tag = __GLX_GET_VENDPRIV_CONTEXT_TAG(pc);
+-
++ ClientPtr client = cl->client;
++ REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 16);
+ return GetHistogram(cl, pc + __GLX_VENDPRIV_HDR_SIZE, tag);
+ }
+
+@@ -471,7 +481,8 @@
+ __glXDisp_GetMinmax(__GLXclientState * cl, GLbyte * pc)
+ {
+ const GLXContextTag tag = __GLX_GET_SINGLE_CONTEXT_TAG(pc);
+-
++ ClientPtr client = cl->client;
++ REQUEST_FIXED_SIZE(xGLXSingleReq, 16);
+ return GetMinmax(cl, pc + __GLX_SINGLE_HDR_SIZE, tag);
+ }
+
+@@ -479,7 +490,8 @@
+ __glXDisp_GetMinmaxEXT(__GLXclientState * cl, GLbyte * pc)
+ {
+ const GLXContextTag tag = __GLX_GET_VENDPRIV_CONTEXT_TAG(pc);
+-
++ ClientPtr client = cl->client;
++ REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 16);
+ return GetMinmax(cl, pc + __GLX_VENDPRIV_HDR_SIZE, tag);
+ }
+
+@@ -540,7 +552,8 @@
+ __glXDisp_GetColorTable(__GLXclientState * cl, GLbyte * pc)
+ {
+ const GLXContextTag tag = __GLX_GET_SINGLE_CONTEXT_TAG(pc);
+-
++ ClientPtr client = cl->client;
++ REQUEST_FIXED_SIZE(xGLXSingleReq, 16);
+ return GetColorTable(cl, pc + __GLX_SINGLE_HDR_SIZE, tag);
+ }
+
+@@ -548,6 +561,7 @@
+ __glXDisp_GetColorTableSGI(__GLXclientState * cl, GLbyte * pc)
+ {
+ const GLXContextTag tag = __GLX_GET_VENDPRIV_CONTEXT_TAG(pc);
+-
++ ClientPtr client = cl->client;
++ REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 16);
+ return GetColorTable(cl, pc + __GLX_VENDPRIV_HDR_SIZE, tag);
+ }
+--- glx/singlepixswap.c.orig 2014-12-11 09:04:51.073058638 +0100
++++ glx/singlepixswap.c 2014-12-11 09:12:14.151301716 +0100
+@@ -57,6 +57,8 @@
+ int error;
+ char *answer, answerBuffer[200];
+
++ REQUEST_FIXED_SIZE(xGLXSingleReq, 28);
++
+ __GLX_SWAP_INT(&((xGLXSingleReq *) pc)->contextTag);
+ cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error);
+ if (!cx) {
+@@ -122,6 +124,8 @@
+ char *answer, answerBuffer[200];
+ GLint width = 0, height = 0, depth = 1;
+
++ REQUEST_FIXED_SIZE(xGLXSingleReq, 20);
++
+ __GLX_SWAP_INT(&((xGLXSingleReq *) pc)->contextTag);
+ cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error);
+ if (!cx) {
+@@ -197,6 +201,8 @@
+
+ __GLX_DECLARE_SWAP_VARIABLES;
+
++ REQUEST_FIXED_SIZE(xGLXSingleReq, 4);
++
+ __GLX_SWAP_INT(&((xGLXSingleReq *) pc)->contextTag);
+ cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error);
+ if (!cx) {
+@@ -266,15 +272,13 @@
+ compsize = __glGetTexImage_size(target, 1, format, type, width, 1, 1);
+ compsize2 = __glGetTexImage_size(target, 1, format, type, height, 1, 1);
+
+- if (compsize < 0)
++ if ((compsize =safe_pad(compsize)) < 0)
+ return BadLength;
+- if (compsize2 < 0)
++ if ((compsize2 = safe_pad(compsize2)) < 0)
+ return BadLength;
+- compsize = __GLX_PAD(compsize);
+- compsize2 = __GLX_PAD(compsize2);
+
+ CALL_PixelStorei(GET_DISPATCH(), (GL_PACK_SWAP_BYTES, !swapBytes));
+- __GLX_GET_ANSWER_BUFFER(answer, cl, compsize + compsize2, 1);
++ __GLX_GET_ANSWER_BUFFER(answer, cl, safe_add(compsize, compsize2), 1);
+ __glXClearErrorOccured();
+ CALL_GetSeparableFilter(GET_DISPATCH(), (*(GLenum *) (pc + 0),
+ *(GLenum *) (pc + 4),
+@@ -302,7 +306,9 @@
+ __glXDispSwap_GetSeparableFilter(__GLXclientState * cl, GLbyte * pc)
+ {
+ const GLXContextTag tag = __GLX_GET_SINGLE_CONTEXT_TAG(pc);
++ ClientPtr client = cl->client;
+
++ REQUEST_FIXED_SIZE(xGLXSingleReq, 16);
+ return GetSeparableFilter(cl, pc + __GLX_SINGLE_HDR_SIZE, tag);
+ }
+
+@@ -310,7 +316,9 @@
+ __glXDispSwap_GetSeparableFilterEXT(__GLXclientState * cl, GLbyte * pc)
+ {
+ const GLXContextTag tag = __GLX_GET_VENDPRIV_CONTEXT_TAG(pc);
++ ClientPtr client = cl->client;
+
++ REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 16);
+ return GetSeparableFilter(cl, pc + __GLX_VENDPRIV_HDR_SIZE, tag);
+ }
+
+@@ -388,7 +396,9 @@
+ __glXDispSwap_GetConvolutionFilter(__GLXclientState * cl, GLbyte * pc)
+ {
+ const GLXContextTag tag = __GLX_GET_SINGLE_CONTEXT_TAG(pc);
++ ClientPtr client = cl->client;
+
++ REQUEST_FIXED_SIZE(xGLXSingleReq, 16);
+ return GetConvolutionFilter(cl, pc + __GLX_SINGLE_HDR_SIZE, tag);
+ }
+
+@@ -396,7 +406,9 @@
+ __glXDispSwap_GetConvolutionFilterEXT(__GLXclientState * cl, GLbyte * pc)
+ {
+ const GLXContextTag tag = __GLX_GET_VENDPRIV_CONTEXT_TAG(pc);
++ ClientPtr client = cl->client;
+
++ REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 16);
+ return GetConvolutionFilter(cl, pc + __GLX_VENDPRIV_HDR_SIZE, tag);
+ }
+
+@@ -463,7 +475,9 @@
+ __glXDispSwap_GetHistogram(__GLXclientState * cl, GLbyte * pc)
+ {
+ const GLXContextTag tag = __GLX_GET_SINGLE_CONTEXT_TAG(pc);
++ ClientPtr client = cl->client;
+
++ REQUEST_FIXED_SIZE(xGLXSingleReq, 16);
+ return GetHistogram(cl, pc + __GLX_SINGLE_HDR_SIZE, tag);
+ }
+
+@@ -471,7 +485,9 @@
+ __glXDispSwap_GetHistogramEXT(__GLXclientState * cl, GLbyte * pc)
+ {
+ const GLXContextTag tag = __GLX_GET_VENDPRIV_CONTEXT_TAG(pc);
++ ClientPtr client = cl->client;
+
++ REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 16);
+ return GetHistogram(cl, pc + __GLX_VENDPRIV_HDR_SIZE, tag);
+ }
+
+@@ -529,7 +545,9 @@
+ __glXDispSwap_GetMinmax(__GLXclientState * cl, GLbyte * pc)
+ {
+ const GLXContextTag tag = __GLX_GET_SINGLE_CONTEXT_TAG(pc);
++ ClientPtr client = cl->client;
+
++ REQUEST_FIXED_SIZE(xGLXSingleReq, 16);
+ return GetMinmax(cl, pc + __GLX_SINGLE_HDR_SIZE, tag);
+ }
+
+@@ -537,7 +555,9 @@
+ __glXDispSwap_GetMinmaxEXT(__GLXclientState * cl, GLbyte * pc)
+ {
+ const GLXContextTag tag = __GLX_GET_VENDPRIV_CONTEXT_TAG(pc);
++ ClientPtr client = cl->client;
+
++ REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 16);
+ return GetMinmax(cl, pc + __GLX_VENDPRIV_HDR_SIZE, tag);
+ }
+
+@@ -605,7 +625,9 @@
+ __glXDispSwap_GetColorTable(__GLXclientState * cl, GLbyte * pc)
+ {
+ const GLXContextTag tag = __GLX_GET_SINGLE_CONTEXT_TAG(pc);
++ ClientPtr client = cl->client;
+
++ REQUEST_FIXED_SIZE(xGLXSingleReq, 16);
+ return GetColorTable(cl, pc + __GLX_SINGLE_HDR_SIZE, tag);
+ }
+
+@@ -613,6 +635,8 @@
+ __glXDispSwap_GetColorTableSGI(__GLXclientState * cl, GLbyte * pc)
+ {
+ const GLXContextTag tag = __GLX_GET_VENDPRIV_CONTEXT_TAG(pc);
++ ClientPtr client = cl->client;
+
++ REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 16);
+ return GetColorTable(cl, pc + __GLX_VENDPRIV_HDR_SIZE, tag);
+ }
Property changes on: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8098-7-8
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Added: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8098-8-8
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-CVE-2014-8098-8-8 (rev 0)
+++ trunk/x11-servers/xorg-server/files/patch-CVE-2014-8098-8-8 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,964 @@
+From e883c170c15493ab3637c0a01890f5a7ca4e16a5 Mon Sep 17 00:00:00 2001
+From: Adam Jackson <ajax at redhat.com>
+Date: Mon, 10 Nov 2014 12:13:48 -0500
+Subject: [PATCH 31/40] glx: Pass remaining request length into ->varsize (v2)
+ [CVE-2014-8098 8/8]
+
+v2: Handle more multiplies in indirect_reqsize.c (Julien Cristau)
+
+Reviewed-by: Julien Cristau <jcristau at debian.org>
+Reviewed-by: Michal Srb <msrb at suse.com>
+Reviewed-by: Andy Ritger <aritger at nvidia.com>
+Signed-off-by: Adam Jackson <ajax at redhat.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
+---
+ glx/glxcmds.c | 7 +-
+ glx/glxserver.h | 2 +-
+ glx/indirect_reqsize.c | 142 +++++++++++++++++++-------------------
+ glx/indirect_reqsize.h | 181 ++++++++++++++++++++++++++++++-------------------
+ glx/rensize.c | 27 +++++---
+ 5 files changed, 205 insertions(+), 154 deletions(-)
+
+--- glx/glxcmds.c.orig 2014-12-10 15:58:29.877078381 +0100
++++ glx/glxcmds.c 2014-12-10 16:02:02.578063888 +0100
+@@ -1990,7 +1990,8 @@
+ if (entry.varsize) {
+ /* variable size command */
+ extra = (*entry.varsize) (pc + __GLX_RENDER_HDR_SIZE,
+- client->swapped);
++ client->swapped,
++ left - __GLX_RENDER_HDR_SIZE);
+ if (extra < 0) {
+ return BadLength;
+ }
+@@ -2067,6 +2068,7 @@
+ if (cl->largeCmdRequestsSoFar == 0) {
+ __GLXrenderSizeData entry;
+ int extra = 0;
++ int left = (req->length << 2) - sz_xGLXRenderLargeReq;
+ size_t cmdlen;
+ int err;
+
+@@ -2107,7 +2109,8 @@
+ ** will be in the 1st request, so it's okay to do this.
+ */
+ extra = (*entry.varsize) (pc + __GLX_RENDER_LARGE_HDR_SIZE,
+- client->swapped);
++ client->swapped,
++ left - __GLX_RENDER_LARGE_HDR_SIZE);
+ if (extra < 0) {
+ return BadLength;
+ }
+--- glx/glxserver.h.orig 2012-05-17 19:09:02.000000000 +0200
++++ glx/glxserver.h 2014-12-10 14:55:50.575337222 +0100
+@@ -167,7 +167,7 @@
+ /*
+ * Tables for computing the size of each rendering command.
+ */
+-typedef int (*gl_proto_size_func) (const GLbyte *, Bool);
++typedef int (*gl_proto_size_func) (const GLbyte *, Bool, int);
+
+ typedef struct {
+ int bytes;
+--- glx/indirect_reqsize.c.orig 2012-05-17 19:09:02.000000000 +0200
++++ glx/indirect_reqsize.c 2014-12-10 15:28:31.264202211 +0100
+@@ -31,24 +31,22 @@
+ #include "indirect_size.h"
+ #include "indirect_reqsize.h"
+
+-#define __GLX_PAD(x) (((x) + 3) & ~3)
+-
+ #if defined(__CYGWIN__) || defined(__MINGW32__)
+ #undef HAVE_ALIAS
+ #endif
+ #ifdef HAVE_ALIAS
+ #define ALIAS2(from,to) \
+- GLint __glX ## from ## ReqSize( const GLbyte * pc, Bool swap ) \
++ GLint __glX ## from ## ReqSize( const GLbyte * pc, Bool swap, int reqlen ) \
+ __attribute__ ((alias( # to )));
+ #define ALIAS(from,to) ALIAS2( from, __glX ## to ## ReqSize )
+ #else
+ #define ALIAS(from,to) \
+- GLint __glX ## from ## ReqSize( const GLbyte * pc, Bool swap ) \
+- { return __glX ## to ## ReqSize( pc, swap ); }
++ GLint __glX ## from ## ReqSize( const GLbyte * pc, Bool swap, int reqlen ) \
++ { return __glX ## to ## ReqSize( pc, swap, reqlen ); }
+ #endif
+
+ int
+-__glXCallListsReqSize(const GLbyte * pc, Bool swap)
++__glXCallListsReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLsizei n = *(GLsizei *) (pc + 0);
+ GLenum type = *(GLenum *) (pc + 4);
+@@ -60,11 +58,11 @@
+ }
+
+ compsize = __glCallLists_size(type);
+- return __GLX_PAD((compsize * n));
++ return safe_pad(safe_mul(compsize, n));
+ }
+
+ int
+-__glXBitmapReqSize(const GLbyte * pc, Bool swap)
++__glXBitmapReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLint row_length = *(GLint *) (pc + 4);
+ GLint image_height = 0;
+@@ -88,7 +86,7 @@
+ }
+
+ int
+-__glXFogfvReqSize(const GLbyte * pc, Bool swap)
++__glXFogfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLenum pname = *(GLenum *) (pc + 0);
+ GLsizei compsize;
+@@ -98,11 +96,11 @@
+ }
+
+ compsize = __glFogfv_size(pname);
+- return __GLX_PAD((compsize * 4));
++ return safe_pad(safe_mul(compsize, 4));
+ }
+
+ int
+-__glXLightfvReqSize(const GLbyte * pc, Bool swap)
++__glXLightfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLenum pname = *(GLenum *) (pc + 4);
+ GLsizei compsize;
+@@ -112,11 +110,11 @@
+ }
+
+ compsize = __glLightfv_size(pname);
+- return __GLX_PAD((compsize * 4));
++ return safe_pad(safe_mul(compsize, 4));
+ }
+
+ int
+-__glXLightModelfvReqSize(const GLbyte * pc, Bool swap)
++__glXLightModelfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLenum pname = *(GLenum *) (pc + 0);
+ GLsizei compsize;
+@@ -126,11 +124,11 @@
+ }
+
+ compsize = __glLightModelfv_size(pname);
+- return __GLX_PAD((compsize * 4));
++ return safe_pad(safe_mul(compsize, 4));
+ }
+
+ int
+-__glXMaterialfvReqSize(const GLbyte * pc, Bool swap)
++__glXMaterialfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLenum pname = *(GLenum *) (pc + 4);
+ GLsizei compsize;
+@@ -140,11 +138,11 @@
+ }
+
+ compsize = __glMaterialfv_size(pname);
+- return __GLX_PAD((compsize * 4));
++ return safe_pad(safe_mul(compsize, 4));
+ }
+
+ int
+-__glXPolygonStippleReqSize(const GLbyte * pc, Bool swap)
++__glXPolygonStippleReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLint row_length = *(GLint *) (pc + 4);
+ GLint image_height = 0;
+@@ -164,7 +162,7 @@
+ }
+
+ int
+-__glXTexParameterfvReqSize(const GLbyte * pc, Bool swap)
++__glXTexParameterfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLenum pname = *(GLenum *) (pc + 4);
+ GLsizei compsize;
+@@ -174,11 +172,11 @@
+ }
+
+ compsize = __glTexParameterfv_size(pname);
+- return __GLX_PAD((compsize * 4));
++ return safe_pad(safe_mul(compsize, 4));
+ }
+
+ int
+-__glXTexImage1DReqSize(const GLbyte * pc, Bool swap)
++__glXTexImage1DReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLint row_length = *(GLint *) (pc + 4);
+ GLint image_height = 0;
+@@ -206,7 +204,7 @@
+ }
+
+ int
+-__glXTexImage2DReqSize(const GLbyte * pc, Bool swap)
++__glXTexImage2DReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLint row_length = *(GLint *) (pc + 4);
+ GLint image_height = 0;
+@@ -236,7 +234,7 @@
+ }
+
+ int
+-__glXTexEnvfvReqSize(const GLbyte * pc, Bool swap)
++__glXTexEnvfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLenum pname = *(GLenum *) (pc + 4);
+ GLsizei compsize;
+@@ -246,11 +244,11 @@
+ }
+
+ compsize = __glTexEnvfv_size(pname);
+- return __GLX_PAD((compsize * 4));
++ return safe_pad(safe_mul(compsize, 4));
+ }
+
+ int
+-__glXTexGendvReqSize(const GLbyte * pc, Bool swap)
++__glXTexGendvReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLenum pname = *(GLenum *) (pc + 4);
+ GLsizei compsize;
+@@ -260,11 +258,11 @@
+ }
+
+ compsize = __glTexGendv_size(pname);
+- return __GLX_PAD((compsize * 8));
++ return safe_pad(safe_mul(compsize, 8));
+ }
+
+ int
+-__glXTexGenfvReqSize(const GLbyte * pc, Bool swap)
++__glXTexGenfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLenum pname = *(GLenum *) (pc + 4);
+ GLsizei compsize;
+@@ -274,11 +272,11 @@
+ }
+
+ compsize = __glTexGenfv_size(pname);
+- return __GLX_PAD((compsize * 4));
++ return safe_pad(safe_mul(compsize, 4));
+ }
+
+ int
+-__glXPixelMapfvReqSize(const GLbyte * pc, Bool swap)
++__glXPixelMapfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLsizei mapsize = *(GLsizei *) (pc + 4);
+
+@@ -286,11 +284,11 @@
+ mapsize = bswap_32(mapsize);
+ }
+
+- return __GLX_PAD((mapsize * 4));
++ return safe_pad(safe_mul(mapsize, 4));
+ }
+
+ int
+-__glXPixelMapusvReqSize(const GLbyte * pc, Bool swap)
++__glXPixelMapusvReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLsizei mapsize = *(GLsizei *) (pc + 4);
+
+@@ -298,11 +296,11 @@
+ mapsize = bswap_32(mapsize);
+ }
+
+- return __GLX_PAD((mapsize * 2));
++ return safe_pad(safe_mul(mapsize, 2));
+ }
+
+ int
+-__glXDrawPixelsReqSize(const GLbyte * pc, Bool swap)
++__glXDrawPixelsReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLint row_length = *(GLint *) (pc + 4);
+ GLint image_height = 0;
+@@ -330,7 +328,7 @@
+ }
+
+ int
+-__glXPrioritizeTexturesReqSize(const GLbyte * pc, Bool swap)
++__glXPrioritizeTexturesReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLsizei n = *(GLsizei *) (pc + 0);
+
+@@ -338,11 +336,11 @@
+ n = bswap_32(n);
+ }
+
+- return __GLX_PAD((n * 4) + (n * 4));
++ return safe_pad(safe_add(safe_mul(n, 4), safe_mul(n, 4)));
+ }
+
+ int
+-__glXTexSubImage1DReqSize(const GLbyte * pc, Bool swap)
++__glXTexSubImage1DReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLint row_length = *(GLint *) (pc + 4);
+ GLint image_height = 0;
+@@ -370,7 +368,7 @@
+ }
+
+ int
+-__glXTexSubImage2DReqSize(const GLbyte * pc, Bool swap)
++__glXTexSubImage2DReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLint row_length = *(GLint *) (pc + 4);
+ GLint image_height = 0;
+@@ -400,7 +398,7 @@
+ }
+
+ int
+-__glXColorTableReqSize(const GLbyte * pc, Bool swap)
++__glXColorTableReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLint row_length = *(GLint *) (pc + 4);
+ GLint image_height = 0;
+@@ -428,7 +426,7 @@
+ }
+
+ int
+-__glXColorTableParameterfvReqSize(const GLbyte * pc, Bool swap)
++__glXColorTableParameterfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLenum pname = *(GLenum *) (pc + 4);
+ GLsizei compsize;
+@@ -438,11 +436,11 @@
+ }
+
+ compsize = __glColorTableParameterfv_size(pname);
+- return __GLX_PAD((compsize * 4));
++ return safe_pad(safe_mul(compsize, 4));
+ }
+
+ int
+-__glXColorSubTableReqSize(const GLbyte * pc, Bool swap)
++__glXColorSubTableReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLint row_length = *(GLint *) (pc + 4);
+ GLint image_height = 0;
+@@ -470,7 +468,7 @@
+ }
+
+ int
+-__glXConvolutionFilter1DReqSize(const GLbyte * pc, Bool swap)
++__glXConvolutionFilter1DReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLint row_length = *(GLint *) (pc + 4);
+ GLint image_height = 0;
+@@ -498,7 +496,7 @@
+ }
+
+ int
+-__glXConvolutionFilter2DReqSize(const GLbyte * pc, Bool swap)
++__glXConvolutionFilter2DReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLint row_length = *(GLint *) (pc + 4);
+ GLint image_height = 0;
+@@ -528,7 +526,7 @@
+ }
+
+ int
+-__glXConvolutionParameterfvReqSize(const GLbyte * pc, Bool swap)
++__glXConvolutionParameterfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLenum pname = *(GLenum *) (pc + 4);
+ GLsizei compsize;
+@@ -538,11 +536,11 @@
+ }
+
+ compsize = __glConvolutionParameterfv_size(pname);
+- return __GLX_PAD((compsize * 4));
++ return safe_pad(safe_mul(compsize, 4));
+ }
+
+ int
+-__glXTexImage3DReqSize(const GLbyte * pc, Bool swap)
++__glXTexImage3DReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLint row_length = *(GLint *) (pc + 4);
+ GLint image_height = *(GLint *) (pc + 8);
+@@ -579,7 +577,7 @@
+ }
+
+ int
+-__glXTexSubImage3DReqSize(const GLbyte * pc, Bool swap)
++__glXTexSubImage3DReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLint row_length = *(GLint *) (pc + 4);
+ GLint image_height = *(GLint *) (pc + 8);
+@@ -613,7 +611,7 @@
+ }
+
+ int
+-__glXCompressedTexImage1DARBReqSize(const GLbyte * pc, Bool swap)
++__glXCompressedTexImage1DARBReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLsizei imageSize = *(GLsizei *) (pc + 20);
+
+@@ -621,11 +619,11 @@
+ imageSize = bswap_32(imageSize);
+ }
+
+- return __GLX_PAD(imageSize);
++ return safe_pad(imageSize);
+ }
+
+ int
+-__glXCompressedTexImage2DARBReqSize(const GLbyte * pc, Bool swap)
++__glXCompressedTexImage2DARBReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLsizei imageSize = *(GLsizei *) (pc + 24);
+
+@@ -633,11 +631,11 @@
+ imageSize = bswap_32(imageSize);
+ }
+
+- return __GLX_PAD(imageSize);
++ return safe_pad(imageSize);
+ }
+
+ int
+-__glXCompressedTexImage3DARBReqSize(const GLbyte * pc, Bool swap)
++__glXCompressedTexImage3DARBReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLsizei imageSize = *(GLsizei *) (pc + 28);
+
+@@ -645,11 +643,11 @@
+ imageSize = bswap_32(imageSize);
+ }
+
+- return __GLX_PAD(imageSize);
++ return safe_pad(imageSize);
+ }
+
+ int
+-__glXCompressedTexSubImage3DARBReqSize(const GLbyte * pc, Bool swap)
++__glXCompressedTexSubImage3DARBReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLsizei imageSize = *(GLsizei *) (pc + 36);
+
+@@ -657,11 +655,11 @@
+ imageSize = bswap_32(imageSize);
+ }
+
+- return __GLX_PAD(imageSize);
++ return safe_pad(imageSize);
+ }
+
+ int
+-__glXProgramStringARBReqSize(const GLbyte * pc, Bool swap)
++__glXProgramStringARBReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLsizei len = *(GLsizei *) (pc + 8);
+
+@@ -669,11 +667,11 @@
+ len = bswap_32(len);
+ }
+
+- return __GLX_PAD(len);
++ return safe_pad(len);
+ }
+
+ int
+-__glXDrawBuffersARBReqSize(const GLbyte * pc, Bool swap)
++__glXDrawBuffersARBReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLsizei n = *(GLsizei *) (pc + 0);
+
+@@ -681,11 +679,11 @@
+ n = bswap_32(n);
+ }
+
+- return __GLX_PAD((n * 4));
++ return safe_pad(safe_mul(n, 4));
+ }
+
+ int
+-__glXPointParameterfvEXTReqSize(const GLbyte * pc, Bool swap)
++__glXPointParameterfvEXTReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLenum pname = *(GLenum *) (pc + 0);
+ GLsizei compsize;
+@@ -695,11 +693,11 @@
+ }
+
+ compsize = __glPointParameterfvEXT_size(pname);
+- return __GLX_PAD((compsize * 4));
++ return safe_pad(safe_mul(compsize, 4));
+ }
+
+ int
+-__glXProgramParameters4dvNVReqSize(const GLbyte * pc, Bool swap)
++__glXProgramParameters4dvNVReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLsizei num = *(GLsizei *) (pc + 8);
+
+@@ -707,11 +705,11 @@
+ num = bswap_32(num);
+ }
+
+- return __GLX_PAD((num * 32));
++ return safe_pad(safe_mul(num, 32));
+ }
+
+ int
+-__glXProgramParameters4fvNVReqSize(const GLbyte * pc, Bool swap)
++__glXProgramParameters4fvNVReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLsizei num = *(GLsizei *) (pc + 8);
+
+@@ -719,11 +717,11 @@
+ num = bswap_32(num);
+ }
+
+- return __GLX_PAD((num * 16));
++ return safe_pad(safe_mul(num, 16));
+ }
+
+ int
+-__glXVertexAttribs1dvNVReqSize(const GLbyte * pc, Bool swap)
++__glXVertexAttribs1dvNVReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLsizei n = *(GLsizei *) (pc + 4);
+
+@@ -731,11 +729,11 @@
+ n = bswap_32(n);
+ }
+
+- return __GLX_PAD((n * 8));
++ return safe_pad(safe_mul(n, 8));
+ }
+
+ int
+-__glXVertexAttribs2dvNVReqSize(const GLbyte * pc, Bool swap)
++__glXVertexAttribs2dvNVReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLsizei n = *(GLsizei *) (pc + 4);
+
+@@ -743,11 +741,11 @@
+ n = bswap_32(n);
+ }
+
+- return __GLX_PAD((n * 16));
++ return safe_pad(safe_mul(n, 16));
+ }
+
+ int
+-__glXVertexAttribs3dvNVReqSize(const GLbyte * pc, Bool swap)
++__glXVertexAttribs3dvNVReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLsizei n = *(GLsizei *) (pc + 4);
+
+@@ -755,11 +753,11 @@
+ n = bswap_32(n);
+ }
+
+- return __GLX_PAD((n * 24));
++ return safe_pad(safe_mul(n, 24));
+ }
+
+ int
+-__glXVertexAttribs3fvNVReqSize(const GLbyte * pc, Bool swap)
++__glXVertexAttribs3fvNVReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLsizei n = *(GLsizei *) (pc + 4);
+
+@@ -767,11 +765,11 @@
+ n = bswap_32(n);
+ }
+
+- return __GLX_PAD((n * 12));
++ return safe_pad(safe_mul(n, 12));
+ }
+
+ int
+-__glXVertexAttribs3svNVReqSize(const GLbyte * pc, Bool swap)
++__glXVertexAttribs3svNVReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLsizei n = *(GLsizei *) (pc + 4);
+
+@@ -779,11 +777,11 @@
+ n = bswap_32(n);
+ }
+
+- return __GLX_PAD((n * 6));
++ return safe_pad(safe_mul(n, 6));
+ }
+
+ int
+-__glXVertexAttribs4dvNVReqSize(const GLbyte * pc, Bool swap)
++__glXVertexAttribs4dvNVReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLsizei n = *(GLsizei *) (pc + 4);
+
+@@ -791,11 +789,11 @@
+ n = bswap_32(n);
+ }
+
+- return __GLX_PAD((n * 32));
++ return safe_pad(safe_mul(n, 32));
+ }
+
+ int
+-__glXProgramNamedParameter4fvNVReqSize(const GLbyte * pc, Bool swap)
++__glXProgramNamedParameter4fvNVReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLsizei len = *(GLsizei *) (pc + 4);
+
+@@ -803,7 +801,7 @@
+ len = bswap_32(len);
+ }
+
+- return __GLX_PAD(len);
++ return safe_pad(len);
+ }
+
+ ALIAS(Fogiv, Fogfv)
+--- glx/indirect_reqsize.h.orig 2012-05-17 19:09:02.000000000 +0200
++++ glx/indirect_reqsize.h 2014-12-10 15:45:48.967149775 +0100
+@@ -36,128 +36,169 @@
+ #define PURE
+ #endif
+
+-extern PURE _X_HIDDEN int __glXCallListsReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXBitmapReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXFogfvReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXFogivReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXLightfvReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXLightivReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXLightModelfvReqSize(const GLbyte * pc,
+- Bool swap);
+-extern PURE _X_HIDDEN int __glXLightModelivReqSize(const GLbyte * pc,
+- Bool swap);
+-extern PURE _X_HIDDEN int __glXMaterialfvReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXMaterialivReqSize(const GLbyte * pc, Bool swap);
++extern PURE _X_HIDDEN int __glXCallListsReqSize(const GLbyte * pc, Bool swap,
++ int reqlen);
++extern PURE _X_HIDDEN int __glXBitmapReqSize(const GLbyte * pc, Bool swap,
++ int reqlen);
++extern PURE _X_HIDDEN int __glXFogfvReqSize(const GLbyte * pc, Bool swap,
++ int reqlen);
++extern PURE _X_HIDDEN int __glXFogivReqSize(const GLbyte * pc, Bool swap,
++ int reqlen);
++extern PURE _X_HIDDEN int __glXLightfvReqSize(const GLbyte * pc, Bool swap,
++ int reqlen);
++extern PURE _X_HIDDEN int __glXLightivReqSize(const GLbyte * pc, Bool swap,
++ int reqlen);
++extern PURE _X_HIDDEN int __glXLightModelfvReqSize(const GLbyte * pc, Bool swap,
++ int reqlen);
++extern PURE _X_HIDDEN int __glXLightModelivReqSize(const GLbyte * pc, Bool swap,
++ int reqlen);
++extern PURE _X_HIDDEN int __glXMaterialfvReqSize(const GLbyte * pc, Bool swap,
++ int reqlen);
++extern PURE _X_HIDDEN int __glXMaterialivReqSize(const GLbyte * pc, Bool swap,
++ int reqlen);
+ extern PURE _X_HIDDEN int __glXPolygonStippleReqSize(const GLbyte * pc,
+- Bool swap);
++ Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXTexParameterfvReqSize(const GLbyte * pc,
+- Bool swap);
++ Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXTexParameterivReqSize(const GLbyte * pc,
+- Bool swap);
+-extern PURE _X_HIDDEN int __glXTexImage1DReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXTexImage2DReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXTexEnvfvReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXTexEnvivReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXTexGendvReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXTexGenfvReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXTexGenivReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXMap1dReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXMap1fReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXMap2dReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXMap2fReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXPixelMapfvReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXPixelMapuivReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXPixelMapusvReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXDrawPixelsReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXDrawArraysReqSize(const GLbyte * pc, Bool swap);
++ Bool swap, int reqlen);
++extern PURE _X_HIDDEN int __glXTexImage1DReqSize(const GLbyte * pc, Bool swap,
++ int reqlen);
++extern PURE _X_HIDDEN int __glXTexImage2DReqSize(const GLbyte * pc, Bool swap,
++ int reqlen);
++extern PURE _X_HIDDEN int __glXTexEnvfvReqSize(const GLbyte * pc, Bool swap,
++ int reqlen);
++extern PURE _X_HIDDEN int __glXTexEnvivReqSize(const GLbyte * pc, Bool swap,
++ int reqlen);
++extern PURE _X_HIDDEN int __glXTexGendvReqSize(const GLbyte * pc, Bool swap,
++ int reqlen);
++extern PURE _X_HIDDEN int __glXTexGenfvReqSize(const GLbyte * pc, Bool swap,
++ int reqlen);
++extern PURE _X_HIDDEN int __glXTexGenivReqSize(const GLbyte * pc, Bool swap,
++ int reqlen);
++extern PURE _X_HIDDEN int __glXMap1dReqSize(const GLbyte * pc, Bool swap,
++ int reqlen);
++extern PURE _X_HIDDEN int __glXMap1fReqSize(const GLbyte * pc, Bool swap,
++ int reqlen);
++extern PURE _X_HIDDEN int __glXMap2dReqSize(const GLbyte * pc, Bool swap,
++ int reqlen);
++extern PURE _X_HIDDEN int __glXMap2fReqSize(const GLbyte * pc, Bool swap,
++ int reqlen);
++extern PURE _X_HIDDEN int __glXPixelMapfvReqSize(const GLbyte * pc, Bool swap,
++ int reqlen);
++extern PURE _X_HIDDEN int __glXPixelMapuivReqSize(const GLbyte * pc, Bool swap,
++ int reqlen);
++extern PURE _X_HIDDEN int __glXPixelMapusvReqSize(const GLbyte * pc, Bool swap,
++ int reqlen);
++extern PURE _X_HIDDEN int __glXDrawPixelsReqSize(const GLbyte * pc, Bool swap,
++ int reqlen);
++extern PURE _X_HIDDEN int __glXDrawArraysReqSize(const GLbyte * pc, Bool swap,
++ int reqlen);
+ extern PURE _X_HIDDEN int __glXPrioritizeTexturesReqSize(const GLbyte * pc,
+- Bool swap);
++ Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXTexSubImage1DReqSize(const GLbyte * pc,
+- Bool swap);
++ Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXTexSubImage2DReqSize(const GLbyte * pc,
+- Bool swap);
+-extern PURE _X_HIDDEN int __glXColorTableReqSize(const GLbyte * pc, Bool swap);
++ Bool swap, int reqlen);
++extern PURE _X_HIDDEN int __glXColorTableReqSize(const GLbyte * pc, Bool swap,
++ int reqlen);
+ extern PURE _X_HIDDEN int __glXColorTableParameterfvReqSize(const GLbyte * pc,
+- Bool swap);
++ Bool swap,
++ int reqlen);
+ extern PURE _X_HIDDEN int __glXColorTableParameterivReqSize(const GLbyte * pc,
+- Bool swap);
++ Bool swap,
++ int reqlen);
+ extern PURE _X_HIDDEN int __glXColorSubTableReqSize(const GLbyte * pc,
+- Bool swap);
++ Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXConvolutionFilter1DReqSize(const GLbyte * pc,
+- Bool swap);
++ Bool swap,
++ int reqlen);
+ extern PURE _X_HIDDEN int __glXConvolutionFilter2DReqSize(const GLbyte * pc,
+- Bool swap);
++ Bool swap,
++ int reqlen);
+ extern PURE _X_HIDDEN int __glXConvolutionParameterfvReqSize(const GLbyte * pc,
+- Bool swap);
++ Bool swap,
++ int reqlen);
+ extern PURE _X_HIDDEN int __glXConvolutionParameterivReqSize(const GLbyte * pc,
+- Bool swap);
++ Bool swap,
++ int reqlen);
+ extern PURE _X_HIDDEN int __glXSeparableFilter2DReqSize(const GLbyte * pc,
+- Bool swap);
+-extern PURE _X_HIDDEN int __glXTexImage3DReqSize(const GLbyte * pc, Bool swap);
++ Bool swap, int reqlen);
++extern PURE _X_HIDDEN int __glXTexImage3DReqSize(const GLbyte * pc, Bool swap,
++ int reqlen);
+ extern PURE _X_HIDDEN int __glXTexSubImage3DReqSize(const GLbyte * pc,
+- Bool swap);
++ Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXCompressedTexImage1DARBReqSize(const GLbyte * pc,
+- Bool swap);
++ Bool swap,
++ int reqlen);
+ extern PURE _X_HIDDEN int __glXCompressedTexImage2DARBReqSize(const GLbyte * pc,
+- Bool swap);
++ Bool swap,
++ int reqlen);
+ extern PURE _X_HIDDEN int __glXCompressedTexImage3DARBReqSize(const GLbyte * pc,
+- Bool swap);
++ Bool swap,
++ int reqlen);
+ extern PURE _X_HIDDEN int __glXCompressedTexSubImage1DARBReqSize(const GLbyte *
+- pc, Bool swap);
++ pc, Bool swap,
++ int reqlen);
+ extern PURE _X_HIDDEN int __glXCompressedTexSubImage2DARBReqSize(const GLbyte *
+- pc, Bool swap);
++ pc, Bool swap,
++ int reqlen);
+ extern PURE _X_HIDDEN int __glXCompressedTexSubImage3DARBReqSize(const GLbyte *
+- pc, Bool swap);
++ pc, Bool swap,
++ int reqlen);
+ extern PURE _X_HIDDEN int __glXProgramStringARBReqSize(const GLbyte * pc,
+- Bool swap);
++ Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXDrawBuffersARBReqSize(const GLbyte * pc,
+- Bool swap);
++ Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXPointParameterfvEXTReqSize(const GLbyte * pc,
+- Bool swap);
++ Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXLoadProgramNVReqSize(const GLbyte * pc,
+- Bool swap);
++ Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXProgramParameters4dvNVReqSize(const GLbyte * pc,
+- Bool swap);
++ Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXProgramParameters4fvNVReqSize(const GLbyte * pc,
+- Bool swap);
++ Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXRequestResidentProgramsNVReqSize(const GLbyte *
+- pc, Bool swap);
++ pc, Bool swap,
++ int reqlen);
+ extern PURE _X_HIDDEN int __glXVertexAttribs1dvNVReqSize(const GLbyte * pc,
+- Bool swap);
++ Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXVertexAttribs1fvNVReqSize(const GLbyte * pc,
+- Bool swap);
++ Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXVertexAttribs1svNVReqSize(const GLbyte * pc,
+- Bool swap);
++ Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXVertexAttribs2dvNVReqSize(const GLbyte * pc,
+- Bool swap);
++ Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXVertexAttribs2fvNVReqSize(const GLbyte * pc,
+- Bool swap);
++ Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXVertexAttribs2svNVReqSize(const GLbyte * pc,
+- Bool swap);
++ Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXVertexAttribs3dvNVReqSize(const GLbyte * pc,
+- Bool swap);
++ Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXVertexAttribs3fvNVReqSize(const GLbyte * pc,
+- Bool swap);
++ Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXVertexAttribs3svNVReqSize(const GLbyte * pc,
+- Bool swap);
++ Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXVertexAttribs4dvNVReqSize(const GLbyte * pc,
+- Bool swap);
++ Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXVertexAttribs4fvNVReqSize(const GLbyte * pc,
+- Bool swap);
++ Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXVertexAttribs4svNVReqSize(const GLbyte * pc,
+- Bool swap);
++ Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXVertexAttribs4ubvNVReqSize(const GLbyte * pc,
+- Bool swap);
++ Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXPointParameterivNVReqSize(const GLbyte * pc,
+- Bool swap);
++ Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXProgramNamedParameter4dvNVReqSize(const GLbyte *
+- pc, Bool swap);
++ pc, Bool swap,
++ int reqlen);
+ extern PURE _X_HIDDEN int __glXProgramNamedParameter4fvNVReqSize(const GLbyte *
+- pc, Bool swap);
++ pc, Bool swap,
++ int reqlen);
+ extern PURE _X_HIDDEN int __glXDeleteFramebuffersEXTReqSize(const GLbyte * pc,
+- Bool swap);
++ Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXDeleteRenderbuffersEXTReqSize(const GLbyte * pc,
+- Bool swap);
++ Bool swap, int reqlen);
+
+ #undef PURE
+
+--- glx/rensize.c.orig 2012-05-17 19:09:02.000000000 +0200
++++ glx/rensize.c 2014-12-10 14:55:50.580336482 +0100
+@@ -52,7 +52,7 @@
+ }
+
+ int
+-__glXMap1dReqSize(const GLbyte * pc, Bool swap)
++__glXMap1dReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLenum target;
+ GLint order, k;
+@@ -68,7 +68,7 @@
+ }
+
+ int
+-__glXMap1fReqSize(const GLbyte * pc, Bool swap)
++__glXMap1fReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLenum target;
+ GLint order, k;
+@@ -92,7 +92,7 @@
+ }
+
+ int
+-__glXMap2dReqSize(const GLbyte * pc, Bool swap)
++__glXMap2dReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLenum target;
+ GLint uorder, vorder, k;
+@@ -110,7 +110,7 @@
+ }
+
+ int
+-__glXMap2fReqSize(const GLbyte * pc, Bool swap)
++__glXMap2fReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ GLenum target;
+ GLint uorder, vorder, k;
+@@ -342,13 +342,14 @@
+ }
+
+ int
+-__glXDrawArraysReqSize(const GLbyte * pc, Bool swap)
++__glXDrawArraysReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ __GLXdispatchDrawArraysHeader *hdr = (__GLXdispatchDrawArraysHeader *) pc;
+ __GLXdispatchDrawArraysComponentHeader *compHeader;
+ GLint numVertexes = hdr->numVertexes;
+ GLint numComponents = hdr->numComponents;
+ GLint arrayElementSize = 0;
++ GLint x, size;
+ int i;
+
+ if (swap) {
+@@ -357,6 +358,13 @@
+ }
+
+ pc += sizeof(__GLXdispatchDrawArraysHeader);
++ reqlen -= sizeof(__GLXdispatchDrawArraysHeader);
++
++ size = safe_mul(sizeof(__GLXdispatchDrawArraysComponentHeader),
++ numComponents);
++ if (size < 0 || reqlen < 0 || reqlen < size)
++ return -1;
++
+ compHeader = (__GLXdispatchDrawArraysComponentHeader *) pc;
+
+ for (i = 0; i < numComponents; i++) {
+@@ -400,17 +408,18 @@
+ return -1;
+ }
+
+- arrayElementSize += __GLX_PAD(numVals * __glXTypeSize(datatype));
++ x = safe_pad(safe_mul(numVals, __glXTypeSize(datatype)));
++ if ((arrayElementSize = safe_add(arrayElementSize, x)) < 0)
++ return -1;
+
+ pc += sizeof(__GLXdispatchDrawArraysComponentHeader);
+ }
+
+- return ((numComponents * sizeof(__GLXdispatchDrawArraysComponentHeader)) +
+- (numVertexes * arrayElementSize));
++ return safe_add(size, safe_mul(numVertexes, arrayElementSize));
+ }
+
+ int
+-__glXSeparableFilter2DReqSize(const GLbyte * pc, Bool swap)
++__glXSeparableFilter2DReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+ __GLXdispatchConvolutionFilterHeader *hdr =
+ (__GLXdispatchConvolutionFilterHeader *) pc;
Property changes on: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8098-8-8
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Added: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8099
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-CVE-2014-8099 (rev 0)
+++ trunk/x11-servers/xorg-server/files/patch-CVE-2014-8099 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,179 @@
+From 32a95fb7c7dbe22c9441c62762dfa4a8ec54d6c3 Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith at oracle.com>
+Date: Sun, 26 Jan 2014 19:23:17 -0800
+Subject: [PATCH 09/40] Xv: unvalidated lengths in XVideo extension swapped
+ procs [CVE-2014-8099]
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
+Reviewed-by: Peter Hutterer <peter.hutterer at who-t.net>
+---
+ Xext/xvdisp.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/Xext/xvdisp.c b/Xext/xvdisp.c
+index 86f982a..c2d0fc9 100644
+--- Xext/xvdisp.c
++++ Xext/xvdisp.c
+@@ -1121,6 +1121,7 @@ static int
+ SProcXvQueryExtension(ClientPtr client)
+ {
+ REQUEST(xvQueryExtensionReq);
++ REQUEST_SIZE_MATCH(xvQueryExtensionReq);
+ swaps(&stuff->length);
+ return XvProcVector[xv_QueryExtension] (client);
+ }
+@@ -1129,6 +1130,7 @@ static int
+ SProcXvQueryAdaptors(ClientPtr client)
+ {
+ REQUEST(xvQueryAdaptorsReq);
++ REQUEST_SIZE_MATCH(xvQueryAdaptorsReq);
+ swaps(&stuff->length);
+ swapl(&stuff->window);
+ return XvProcVector[xv_QueryAdaptors] (client);
+@@ -1138,6 +1140,7 @@ static int
+ SProcXvQueryEncodings(ClientPtr client)
+ {
+ REQUEST(xvQueryEncodingsReq);
++ REQUEST_SIZE_MATCH(xvQueryEncodingsReq);
+ swaps(&stuff->length);
+ swapl(&stuff->port);
+ return XvProcVector[xv_QueryEncodings] (client);
+@@ -1147,6 +1150,7 @@ static int
+ SProcXvGrabPort(ClientPtr client)
+ {
+ REQUEST(xvGrabPortReq);
++ REQUEST_SIZE_MATCH(xvGrabPortReq);
+ swaps(&stuff->length);
+ swapl(&stuff->port);
+ swapl(&stuff->time);
+@@ -1157,6 +1161,7 @@ static int
+ SProcXvUngrabPort(ClientPtr client)
+ {
+ REQUEST(xvUngrabPortReq);
++ REQUEST_SIZE_MATCH(xvUngrabPortReq);
+ swaps(&stuff->length);
+ swapl(&stuff->port);
+ swapl(&stuff->time);
+@@ -1167,6 +1172,7 @@ static int
+ SProcXvPutVideo(ClientPtr client)
+ {
+ REQUEST(xvPutVideoReq);
++ REQUEST_SIZE_MATCH(xvPutVideoReq);
+ swaps(&stuff->length);
+ swapl(&stuff->port);
+ swapl(&stuff->drawable);
+@@ -1186,6 +1192,7 @@ static int
+ SProcXvPutStill(ClientPtr client)
+ {
+ REQUEST(xvPutStillReq);
++ REQUEST_SIZE_MATCH(xvPutStillReq);
+ swaps(&stuff->length);
+ swapl(&stuff->port);
+ swapl(&stuff->drawable);
+@@ -1205,6 +1212,7 @@ static int
+ SProcXvGetVideo(ClientPtr client)
+ {
+ REQUEST(xvGetVideoReq);
++ REQUEST_SIZE_MATCH(xvGetVideoReq);
+ swaps(&stuff->length);
+ swapl(&stuff->port);
+ swapl(&stuff->drawable);
+@@ -1224,6 +1232,7 @@ static int
+ SProcXvGetStill(ClientPtr client)
+ {
+ REQUEST(xvGetStillReq);
++ REQUEST_SIZE_MATCH(xvGetStillReq);
+ swaps(&stuff->length);
+ swapl(&stuff->port);
+ swapl(&stuff->drawable);
+@@ -1243,6 +1252,7 @@ static int
+ SProcXvPutImage(ClientPtr client)
+ {
+ REQUEST(xvPutImageReq);
++ REQUEST_AT_LEAST_SIZE(xvPutImageReq);
+ swaps(&stuff->length);
+ swapl(&stuff->port);
+ swapl(&stuff->drawable);
+@@ -1266,6 +1276,7 @@ static int
+ SProcXvShmPutImage(ClientPtr client)
+ {
+ REQUEST(xvShmPutImageReq);
++ REQUEST_SIZE_MATCH(xvShmPutImageReq);
+ swaps(&stuff->length);
+ swapl(&stuff->port);
+ swapl(&stuff->drawable);
+@@ -1293,6 +1304,7 @@ static int
+ SProcXvSelectVideoNotify(ClientPtr client)
+ {
+ REQUEST(xvSelectVideoNotifyReq);
++ REQUEST_SIZE_MATCH(xvSelectVideoNotifyReq);
+ swaps(&stuff->length);
+ swapl(&stuff->drawable);
+ return XvProcVector[xv_SelectVideoNotify] (client);
+@@ -1302,6 +1314,7 @@ static int
+ SProcXvSelectPortNotify(ClientPtr client)
+ {
+ REQUEST(xvSelectPortNotifyReq);
++ REQUEST_SIZE_MATCH(xvSelectPortNotifyReq);
+ swaps(&stuff->length);
+ swapl(&stuff->port);
+ return XvProcVector[xv_SelectPortNotify] (client);
+@@ -1311,6 +1324,7 @@ static int
+ SProcXvStopVideo(ClientPtr client)
+ {
+ REQUEST(xvStopVideoReq);
++ REQUEST_SIZE_MATCH(xvStopVideoReq);
+ swaps(&stuff->length);
+ swapl(&stuff->port);
+ swapl(&stuff->drawable);
+@@ -1321,6 +1335,7 @@ static int
+ SProcXvSetPortAttribute(ClientPtr client)
+ {
+ REQUEST(xvSetPortAttributeReq);
++ REQUEST_SIZE_MATCH(xvSetPortAttributeReq);
+ swaps(&stuff->length);
+ swapl(&stuff->port);
+ swapl(&stuff->attribute);
+@@ -1332,6 +1347,7 @@ static int
+ SProcXvGetPortAttribute(ClientPtr client)
+ {
+ REQUEST(xvGetPortAttributeReq);
++ REQUEST_SIZE_MATCH(xvGetPortAttributeReq);
+ swaps(&stuff->length);
+ swapl(&stuff->port);
+ swapl(&stuff->attribute);
+@@ -1342,6 +1358,7 @@ static int
+ SProcXvQueryBestSize(ClientPtr client)
+ {
+ REQUEST(xvQueryBestSizeReq);
++ REQUEST_SIZE_MATCH(xvQueryBestSizeReq);
+ swaps(&stuff->length);
+ swapl(&stuff->port);
+ swaps(&stuff->vid_w);
+@@ -1355,6 +1372,7 @@ static int
+ SProcXvQueryPortAttributes(ClientPtr client)
+ {
+ REQUEST(xvQueryPortAttributesReq);
++ REQUEST_SIZE_MATCH(xvQueryPortAttributesReq);
+ swaps(&stuff->length);
+ swapl(&stuff->port);
+ return XvProcVector[xv_QueryPortAttributes] (client);
+@@ -1364,6 +1382,7 @@ static int
+ SProcXvQueryImageAttributes(ClientPtr client)
+ {
+ REQUEST(xvQueryImageAttributesReq);
++ REQUEST_SIZE_MATCH(xvQueryImageAttributesReq);
+ swaps(&stuff->length);
+ swapl(&stuff->port);
+ swapl(&stuff->id);
+@@ -1376,6 +1395,7 @@ static int
+ SProcXvListImageFormats(ClientPtr client)
+ {
+ REQUEST(xvListImageFormatsReq);
++ REQUEST_SIZE_MATCH(xvListImageFormatsReq);
+ swaps(&stuff->length);
+ swapl(&stuff->port);
+ return XvProcVector[xv_ListImageFormats] (client);
+--
+2.1.2
+
Property changes on: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8099
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Added: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8100-1-2
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-CVE-2014-8100-1-2 (rev 0)
+++ trunk/x11-servers/xorg-server/files/patch-CVE-2014-8100-1-2 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,36 @@
+From b5f9ef03df6a650571b29d3d1c1d2b67c6e84336 Mon Sep 17 00:00:00 2001
+From: Julien Cristau <jcristau at debian.org>
+Date: Tue, 28 Oct 2014 10:30:04 +0100
+Subject: [PATCH 13/40] render: check request size before reading it
+ [CVE-2014-8100 1/2]
+
+Otherwise we may be reading outside of the client request.
+
+Signed-off-by: Julien Cristau <jcristau at debian.org>
+Reviewed-by: Alan Coopersmith <alan.coopersmith at oracle.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
+---
+ render/render.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/render/render.c b/render/render.c
+index e3031da..200e0c8 100644
+--- render/render.c
++++ render/render.c
+@@ -276,11 +276,11 @@ ProcRenderQueryVersion(ClientPtr client)
+
+ REQUEST(xRenderQueryVersionReq);
+
++ REQUEST_SIZE_MATCH(xRenderQueryVersionReq);
++
+ pRenderClient->major_version = stuff->majorVersion;
+ pRenderClient->minor_version = stuff->minorVersion;
+
+- REQUEST_SIZE_MATCH(xRenderQueryVersionReq);
+-
+ if ((stuff->majorVersion * 1000 + stuff->minorVersion) <
+ (SERVER_RENDER_MAJOR_VERSION * 1000 + SERVER_RENDER_MINOR_VERSION)) {
+ rep.majorVersion = stuff->majorVersion;
+--
+2.1.2
+
Property changes on: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8100-1-2
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Added: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8100-2-2
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-CVE-2014-8100-2-2 (rev 0)
+++ trunk/x11-servers/xorg-server/files/patch-CVE-2014-8100-2-2 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,140 @@
+From 5d3a788aeb2fbd3ca2812747dc18c94a8b981c63 Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith at oracle.com>
+Date: Sun, 26 Jan 2014 19:51:29 -0800
+Subject: [PATCH 14/40] render: unvalidated lengths in Render extn. swapped
+ procs [CVE-2014-8100 2/2]
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
+Reviewed-by: Peter Hutterer <peter.hutterer at who-t.net>
+---
+ render/render.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/render/render.c b/render/render.c
+index 200e0c8..723f380 100644
+--- render/render.c
++++ render/render.c
+@@ -1995,7 +1995,7 @@ static int
+ SProcRenderQueryVersion(ClientPtr client)
+ {
+ REQUEST(xRenderQueryVersionReq);
+-
++ REQUEST_SIZE_MATCH(xRenderQueryVersionReq);
+ swaps(&stuff->length);
+ swapl(&stuff->majorVersion);
+ swapl(&stuff->minorVersion);
+@@ -2006,6 +2006,7 @@ static int
+ SProcRenderQueryPictFormats(ClientPtr client)
+ {
+ REQUEST(xRenderQueryPictFormatsReq);
++ REQUEST_SIZE_MATCH(xRenderQueryPictFormatsReq);
+ swaps(&stuff->length);
+ return (*ProcRenderVector[stuff->renderReqType]) (client);
+ }
+@@ -2014,6 +2015,7 @@ static int
+ SProcRenderQueryPictIndexValues(ClientPtr client)
+ {
+ REQUEST(xRenderQueryPictIndexValuesReq);
++ REQUEST_AT_LEAST_SIZE(xRenderQueryPictIndexValuesReq);
+ swaps(&stuff->length);
+ swapl(&stuff->format);
+ return (*ProcRenderVector[stuff->renderReqType]) (client);
+@@ -2029,6 +2031,7 @@ static int
+ SProcRenderCreatePicture(ClientPtr client)
+ {
+ REQUEST(xRenderCreatePictureReq);
++ REQUEST_AT_LEAST_SIZE(xRenderCreatePictureReq);
+ swaps(&stuff->length);
+ swapl(&stuff->pid);
+ swapl(&stuff->drawable);
+@@ -2042,6 +2045,7 @@ static int
+ SProcRenderChangePicture(ClientPtr client)
+ {
+ REQUEST(xRenderChangePictureReq);
++ REQUEST_AT_LEAST_SIZE(xRenderChangePictureReq);
+ swaps(&stuff->length);
+ swapl(&stuff->picture);
+ swapl(&stuff->mask);
+@@ -2053,6 +2057,7 @@ static int
+ SProcRenderSetPictureClipRectangles(ClientPtr client)
+ {
+ REQUEST(xRenderSetPictureClipRectanglesReq);
++ REQUEST_AT_LEAST_SIZE(xRenderSetPictureClipRectanglesReq);
+ swaps(&stuff->length);
+ swapl(&stuff->picture);
+ swaps(&stuff->xOrigin);
+@@ -2065,6 +2070,7 @@ static int
+ SProcRenderFreePicture(ClientPtr client)
+ {
+ REQUEST(xRenderFreePictureReq);
++ REQUEST_SIZE_MATCH(xRenderFreePictureReq);
+ swaps(&stuff->length);
+ swapl(&stuff->picture);
+ return (*ProcRenderVector[stuff->renderReqType]) (client);
+@@ -2074,6 +2080,7 @@ static int
+ SProcRenderComposite(ClientPtr client)
+ {
+ REQUEST(xRenderCompositeReq);
++ REQUEST_SIZE_MATCH(xRenderCompositeReq);
+ swaps(&stuff->length);
+ swapl(&stuff->src);
+ swapl(&stuff->mask);
+@@ -2093,6 +2100,7 @@ static int
+ SProcRenderScale(ClientPtr client)
+ {
+ REQUEST(xRenderScaleReq);
++ REQUEST_SIZE_MATCH(xRenderScaleReq);
+ swaps(&stuff->length);
+ swapl(&stuff->src);
+ swapl(&stuff->dst);
+@@ -2193,6 +2201,7 @@ static int
+ SProcRenderCreateGlyphSet(ClientPtr client)
+ {
+ REQUEST(xRenderCreateGlyphSetReq);
++ REQUEST_SIZE_MATCH(xRenderCreateGlyphSetReq);
+ swaps(&stuff->length);
+ swapl(&stuff->gsid);
+ swapl(&stuff->format);
+@@ -2203,6 +2212,7 @@ static int
+ SProcRenderReferenceGlyphSet(ClientPtr client)
+ {
+ REQUEST(xRenderReferenceGlyphSetReq);
++ REQUEST_SIZE_MATCH(xRenderReferenceGlyphSetReq);
+ swaps(&stuff->length);
+ swapl(&stuff->gsid);
+ swapl(&stuff->existing);
+@@ -2213,6 +2223,7 @@ static int
+ SProcRenderFreeGlyphSet(ClientPtr client)
+ {
+ REQUEST(xRenderFreeGlyphSetReq);
++ REQUEST_SIZE_MATCH(xRenderFreeGlyphSetReq);
+ swaps(&stuff->length);
+ swapl(&stuff->glyphset);
+ return (*ProcRenderVector[stuff->renderReqType]) (client);
+@@ -2227,6 +2238,7 @@ SProcRenderAddGlyphs(ClientPtr client)
+ xGlyphInfo *gi;
+
+ REQUEST(xRenderAddGlyphsReq);
++ REQUEST_AT_LEAST_SIZE(xRenderAddGlyphsReq);
+ swaps(&stuff->length);
+ swapl(&stuff->glyphset);
+ swapl(&stuff->nglyphs);
+@@ -2261,6 +2273,7 @@ static int
+ SProcRenderFreeGlyphs(ClientPtr client)
+ {
+ REQUEST(xRenderFreeGlyphsReq);
++ REQUEST_AT_LEAST_SIZE(xRenderFreeGlyphsReq);
+ swaps(&stuff->length);
+ swapl(&stuff->glyphset);
+ SwapRestL(stuff);
+@@ -2278,6 +2291,7 @@ SProcRenderCompositeGlyphs(ClientPtr client)
+ int size;
+
+ REQUEST(xRenderCompositeGlyphsReq);
++ REQUEST_AT_LEAST_SIZE(xRenderCompositeGlyphsReq);
+
+ switch (stuff->renderReqType) {
+ default:
+--
+2.1.2
+
Property changes on: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8100-2-2
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Added: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8101
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-CVE-2014-8101 (rev 0)
+++ trunk/x11-servers/xorg-server/files/patch-CVE-2014-8101 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,51 @@
+From 3df2fcf12499ebdb26b9b67419ea485a42041f33 Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith at oracle.com>
+Date: Sun, 26 Jan 2014 19:38:09 -0800
+Subject: [PATCH 12/40] randr: unvalidated lengths in RandR extension swapped
+ procs [CVE-2014-8101]
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
+Reviewed-by: Peter Hutterer <peter.hutterer at who-t.net>
+---
+ randr/rrsdispatch.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/randr/rrsdispatch.c b/randr/rrsdispatch.c
+index 08c3b6a..47558cf 100644
+--- randr/rrsdispatch.c
++++ randr/rrsdispatch.c
+@@ -27,6 +27,7 @@ SProcRRQueryVersion(ClientPtr client)
+ {
+ REQUEST(xRRQueryVersionReq);
+
++ REQUEST_SIZE_MATCH(xRRQueryVersionReq);
+ swaps(&stuff->length);
+ swapl(&stuff->majorVersion);
+ swapl(&stuff->minorVersion);
+@@ -38,6 +39,7 @@ SProcRRGetScreenInfo(ClientPtr client)
+ {
+ REQUEST(xRRGetScreenInfoReq);
+
++ REQUEST_SIZE_MATCH(xRRGetScreenInfoReq);
+ swaps(&stuff->length);
+ swapl(&stuff->window);
+ return (*ProcRandrVector[stuff->randrReqType]) (client);
+@@ -69,6 +71,7 @@ SProcRRSelectInput(ClientPtr client)
+ {
+ REQUEST(xRRSelectInputReq);
+
++ REQUEST_SIZE_MATCH(xRRSelectInputReq);
+ swaps(&stuff->length);
+ swapl(&stuff->window);
+ swaps(&stuff->enable);
+@@ -152,6 +155,7 @@ SProcRRConfigureOutputProperty(ClientPtr client)
+ {
+ REQUEST(xRRConfigureOutputPropertyReq);
+
++ REQUEST_AT_LEAST_SIZE(xRRConfigureOutputPropertyReq);
+ swaps(&stuff->length);
+ swapl(&stuff->output);
+ swapl(&stuff->property);
+--
+2.1.2
+
Property changes on: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8101
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Added: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8102
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-CVE-2014-8102 (rev 0)
+++ trunk/x11-servers/xorg-server/files/patch-CVE-2014-8102 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,27 @@
+From a0ece23a8bd300c8be10812d368dc8058c97c63e Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith at oracle.com>
+Date: Sun, 26 Jan 2014 20:02:20 -0800
+Subject: [PATCH 15/40] xfixes: unvalidated length in
+ SProcXFixesSelectSelectionInput [CVE-2014-8102]
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
+Reviewed-by: Peter Hutterer <peter.hutterer at who-t.net>
+---
+ xfixes/select.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/xfixes/select.c b/xfixes/select.c
+index c088ed3..e964d58 100644
+--- xfixes/select.c
++++ xfixes/select.c
+@@ -201,6 +201,7 @@ SProcXFixesSelectSelectionInput(ClientPtr client)
+ {
+ REQUEST(xXFixesSelectSelectionInputReq);
+
++ REQUEST_SIZE_MATCH(xXFixesSelectSelectionInputReq);
+ swaps(&stuff->length);
+ swapl(&stuff->window);
+ swapl(&stuff->selection);
+--
+2.1.2
+
Property changes on: trunk/x11-servers/xorg-server/files/patch-CVE-2014-8102
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Added: trunk/x11-servers/xorg-server/files/patch-CVE-2015-0255
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-CVE-2015-0255 (rev 0)
+++ trunk/x11-servers/xorg-server/files/patch-CVE-2015-0255 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,175 @@
+This patch has two commits. One is needed to address the CVE the other
+is allow the patch to apply.
+
+http://lists.freedesktop.org/archives/xorg/2015-February/057158.html
+
+http://cgit.freedesktop.org/xorg/xserver/patch/?id=20079c36cf7d377938ca5478447d8b9045cb7d43
+http://cgit.freedesktop.org/xorg/xserver/patch/?id=81c90dc8f0aae3b65730409b1b615b5fa7280ebd
+
+--- xkb/xkb.c.orig 2015-02-12 20:30:54.131767000 +0100
++++ xkb/xkb.c 2015-02-12 20:31:01.849633000 +0100
+@@ -4958,26 +4958,29 @@ ProcXkbGetGeometry(ClientPtr client)
+
+ /***====================================================================***/
+
+-static char *
+-_GetCountedString(char **wire_inout, Bool swap)
++static Status
++_GetCountedString(char **wire_inout, ClientPtr client, char **str)
+ {
+- char *wire, *str;
+- CARD16 len, *plen;
++ char *wire, *next;
++ CARD16 len;
+
+ wire = *wire_inout;
+- plen = (CARD16 *) wire;
+- if (swap) {
+- swaps(plen);
+- }
+- len = *plen;
+- str = malloc(len + 1);
+- if (str) {
+- memcpy(str, &wire[2], len);
+- str[len] = '\0';
++ len = *(CARD16 *) wire;
++ if (client->swapped) {
++ swaps(&len);
+ }
+- wire += XkbPaddedSize(len + 2);
+- *wire_inout = wire;
+- return str;
++ next = wire + XkbPaddedSize(len + 2);
++ /* Check we're still within the size of the request */
++ if (client->req_len <
++ bytes_to_int32(next - (char *) client->requestBuffer))
++ return BadValue;
++ *str = malloc(len + 1);
++ if (!*str)
++ return BadAlloc;
++ memcpy(*str, &wire[2], len);
++ *(*str + len) = '\0';
++ *wire_inout = next;
++ return Success;
+ }
+
+ static Status
+@@ -4986,25 +4989,29 @@ _CheckSetDoodad(char **wire_inout,
+ {
+ char *wire;
+ xkbDoodadWireDesc *dWire;
++ xkbAnyDoodadWireDesc any;
++ xkbTextDoodadWireDesc text;
+ XkbDoodadPtr doodad;
++ Status status;
+
+ dWire = (xkbDoodadWireDesc *) (*wire_inout);
++ any = dWire->any;
+ wire = (char *) &dWire[1];
+ if (client->swapped) {
+- swapl(&dWire->any.name);
+- swaps(&dWire->any.top);
+- swaps(&dWire->any.left);
+- swaps(&dWire->any.angle);
++ swapl(&any.name);
++ swaps(&any.top);
++ swaps(&any.left);
++ swaps(&any.angle);
+ }
+ CHK_ATOM_ONLY(dWire->any.name);
+- doodad = XkbAddGeomDoodad(geom, section, dWire->any.name);
++ doodad = XkbAddGeomDoodad(geom, section, any.name);
+ if (!doodad)
+ return BadAlloc;
+ doodad->any.type = dWire->any.type;
+ doodad->any.priority = dWire->any.priority;
+- doodad->any.top = dWire->any.top;
+- doodad->any.left = dWire->any.left;
+- doodad->any.angle = dWire->any.angle;
++ doodad->any.top = any.top;
++ doodad->any.left = any.left;
++ doodad->any.angle = any.angle;
+ switch (doodad->any.type) {
+ case XkbOutlineDoodad:
+ case XkbSolidDoodad:
+@@ -5027,15 +5034,22 @@ _CheckSetDoodad(char **wire_inout,
+ dWire->text.colorNdx);
+ return BadMatch;
+ }
++ text = dWire->text;
+ if (client->swapped) {
+- swaps(&dWire->text.width);
+- swaps(&dWire->text.height);
++ swaps(&text.width);
++ swaps(&text.height);
+ }
+- doodad->text.width = dWire->text.width;
+- doodad->text.height = dWire->text.height;
++ doodad->text.width = text.width;
++ doodad->text.height = text.height;
+ doodad->text.color_ndx = dWire->text.colorNdx;
+- doodad->text.text = _GetCountedString(&wire, client->swapped);
+- doodad->text.font = _GetCountedString(&wire, client->swapped);
++ status = _GetCountedString(&wire, client, &doodad->text.text);
++ if (status != Success)
++ return status;
++ status = _GetCountedString(&wire, client, &doodad->text.font);
++ if (status != Success) {
++ free (doodad->text.text);
++ return status;
++ }
+ break;
+ case XkbIndicatorDoodad:
+ if (dWire->indicator.onColorNdx >= geom->num_colors) {
+@@ -5070,7 +5084,9 @@ _CheckSetDoodad(char **wire_inout,
+ }
+ doodad->logo.color_ndx = dWire->logo.colorNdx;
+ doodad->logo.shape_ndx = dWire->logo.shapeNdx;
+- doodad->logo.logo_name = _GetCountedString(&wire, client->swapped);
++ status = _GetCountedString(&wire, client, &doodad->logo.logo_name);
++ if (status != Success)
++ return status;
+ break;
+ default:
+ client->errorValue = _XkbErrCode2(0x4F, dWire->any.type);
+@@ -5302,18 +5318,20 @@ _CheckSetGeom(XkbGeometryPtr geom, xkbSe
+ char *wire;
+
+ wire = (char *) &req[1];
+- geom->label_font = _GetCountedString(&wire, client->swapped);
++ status = _GetCountedString(&wire, client, &geom->label_font);
++ if (status != Success)
++ return status;
+
+ for (i = 0; i < req->nProperties; i++) {
+ char *name, *val;
+
+- name = _GetCountedString(&wire, client->swapped);
+- if (!name)
+- return BadAlloc;
+- val = _GetCountedString(&wire, client->swapped);
+- if (!val) {
++ status = _GetCountedString(&wire, client, &name);
++ if (status != Success)
++ return status;
++ status = _GetCountedString(&wire, client, &val);
++ if (status != Success) {
+ free(name);
+- return BadAlloc;
++ return status;
+ }
+ if (XkbAddGeomProperty(geom, name, val) == NULL) {
+ free(name);
+@@ -5347,9 +5365,9 @@ _CheckSetGeom(XkbGeometryPtr geom, xkbSe
+ for (i = 0; i < req->nColors; i++) {
+ char *name;
+
+- name = _GetCountedString(&wire, client->swapped);
+- if (!name)
+- return BadAlloc;
++ status = _GetCountedString(&wire, client, &name);
++ if (status != Success)
++ return status;
+ if (!XkbAddGeomColor(geom, name, geom->num_colors)) {
+ free(name);
+ return BadAlloc;
Property changes on: trunk/x11-servers/xorg-server/files/patch-CVE-2015-0255
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Modified: trunk/x11-servers/xorg-server/files/patch-Xserver-hw-xfree86-os-support-bsd-i386_video.c
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-Xserver-hw-xfree86-os-support-bsd-i386_video.c 2015-05-28 02:59:29 UTC (rev 19133)
+++ trunk/x11-servers/xorg-server/files/patch-Xserver-hw-xfree86-os-support-bsd-i386_video.c 2015-05-28 03:00:00 UTC (rev 19134)
@@ -1,8 +1,5 @@
-Index: programs/Xserver/hw/xfree86/os-support/bsd/i386_video.c
-diff -u -p programs/Xserver/hw/xfree86/os-support/bsd/i386_video.c.orig programs/Xserver/hw/xfree86/os-support/bsd/i386_video.c
---- hw/xfree86/os-support/bsd/i386_video.c.orig Tue Oct 4 01:46:14 2005
-+++ hw/xfree86/os-support/bsd/i386_video.c Thu Jan 26 14:57:56 2006
-@@ -35,6 +35,7 @@
+Index: hw/xfree86/os-support/bsd/i386_video.c
+@@ -32,6 +32,7 @@
#include "xf86Priv.h"
#include <errno.h>
Added: trunk/x11-servers/xorg-server/files/patch-config_config-backends.h
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-config_config-backends.h (rev 0)
+++ trunk/x11-servers/xorg-server/files/patch-config_config-backends.h 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,11 @@
+--- config/config-backends.h.orig 2014-04-12 15:29:14 UTC
++++ config/config-backends.h
+@@ -75,3 +75,8 @@ void config_hal_fini(void);
+ int config_wscons_init(void);
+ void config_wscons_fini(void);
+ #endif
++
++#ifdef CONFIG_DEVD
++int config_devd_init(void);
++void config_devd_fini(void);
++#endif
Property changes on: trunk/x11-servers/xorg-server/files/patch-config_config-backends.h
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Added: trunk/x11-servers/xorg-server/files/patch-config_config.c
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-config_config.c (rev 0)
+++ trunk/x11-servers/xorg-server/files/patch-config_config.c 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,21 @@
+--- config/config.c.orig 2014-04-12 15:29:14 UTC
++++ config/config.c
+@@ -64,6 +64,9 @@ config_init(void)
+ #elif defined(CONFIG_WSCONS)
+ if (!config_wscons_init())
+ ErrorF("[config] failed to initialise wscons\n");
++#elif defined(CONFIG_DEVD)
++ if (!config_devd_init())
++ ErrorF("[config] failed to initialise devd\n");
+ #endif
+ }
+
+@@ -82,6 +85,8 @@ config_fini(void)
+ config_dbus_core_fini();
+ #elif defined(CONFIG_WSCONS)
+ config_wscons_fini();
++#elif defined(CONFIG_DEVD)
++ config_devd_fini();
+ #endif
+ }
+
Property changes on: trunk/x11-servers/xorg-server/files/patch-config_config.c
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Added: trunk/x11-servers/xorg-server/files/patch-config_devd.c
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-config_devd.c (rev 0)
+++ trunk/x11-servers/xorg-server/files/patch-config_devd.c 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,534 @@
+--- config/devd.c.orig 2015-05-19 19:41:49 UTC
++++ config/devd.c
+@@ -0,0 +1,531 @@
++/*
++ * Copyright (c) 2012 Baptiste Daroussin
++ * Copyright (c) 2013, 2014 Alex Kozlov
++ * Copyright (c) 2014 Robert Millan
++ * Copyright (c) 2014 Jean-Sebastien Pedron
++ *
++ * Permission is hereby granted, free of charge, to any person obtaining a
++ * copy of this software and associated documentation files (the "Software"),
++ * to deal in the Software without restriction, including without limitation
++ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
++ * and/or sell copies of the Software, and to permit persons to whom the
++ * Software is furnished to do so, subject to the following conditions:
++ *
++ * The above copyright notice and this permission notice (including the next
++ * paragraph) shall be included in all copies or substantial portions of the
++ * Software.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
++ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
++ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
++ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
++ * DEALINGS IN THE SOFTWARE.
++ *
++ * Author: Baptiste Daroussin <bapt at FreeBSD.org>
++ */
++
++#ifdef HAVE_DIX_CONFIG_H
++#include <dix-config.h>
++#endif
++
++#include <sys/types.h>
++#include <sys/kbio.h>
++#include <sys/socket.h>
++#include <sys/stat.h>
++#include <sys/sysctl.h>
++#include <sys/un.h>
++
++#include <ctype.h>
++#include <errno.h>
++#include <fcntl.h>
++#include <stdlib.h>
++#include <stdio.h>
++#include <stdbool.h>
++#include <unistd.h>
++
++#include "input.h"
++#include "inputstr.h"
++#include "hotplug.h"
++#include "config-backends.h"
++#include "os.h"
++
++#define DEVD_SOCK_PATH "/var/run/devd.pipe"
++
++#define DEVD_EVENT_ADD '+'
++#define DEVD_EVENT_REMOVE '-'
++
++#define RECONNECT_DELAY 5 * 1000
++
++static int sock_devd;
++static bool is_console_kbd = false;
++static bool is_kbdmux = false;
++OsTimerPtr rtimer;
++
++struct hw_type {
++ const char *driver;
++ int flag;
++ const char *xdriver;
++};
++
++static struct hw_type hw_types[] = {
++ { "ukbd", ATTR_KEYBOARD, "kbd" },
++ { "atkbd", ATTR_KEYBOARD, "kbd" },
++ { "kbdmux", ATTR_KEYBOARD, "kbd" },
++ { "sysmouse", ATTR_POINTER, "mouse" },
++ { "ums", ATTR_POINTER, "mouse" },
++ { "psm", ATTR_POINTER, "mouse" },
++ { "vboxguest", ATTR_POINTER, "vboxmouse" },
++ { "joy", ATTR_JOYSTICK, NULL },
++ { "atp", ATTR_TOUCHPAD, NULL },
++ { "uep", ATTR_TOUCHSCREEN, NULL },
++ { NULL, -1, NULL },
++};
++
++static bool
++sysctl_exists(const struct hw_type *device, int unit,
++ char *devname, size_t devname_len)
++{
++ char sysctlname[PATH_MAX];
++ size_t len;
++ int ret;
++
++ if (device == NULL || device->driver == NULL)
++ return false;
++
++ /* Check if a sysctl exists. */
++ snprintf(sysctlname, sizeof(sysctlname), "dev.%s.%i.%%desc",
++ device->driver, unit);
++ ret = sysctlbyname(sysctlname, NULL, &len, NULL, 0);
++
++ if (ret == 0 && len > 0) {
++ snprintf(devname, devname_len, "%s%i", device->driver, unit);
++ return true;
++ }
++
++ return false;
++}
++
++static bool
++devpath_exists(const struct hw_type *device,
++ char *devname, size_t devname_len)
++{
++ char *devpath;
++ struct stat st;
++ int ret;
++
++ if (device == NULL || device->driver == NULL)
++ return false;
++
++ /* Check if /dev/$driver exists. */
++ asprintf(&devpath, "/dev/%s", device->driver);
++ if (devpath == NULL)
++ return false;
++
++ ret = stat(devpath, &st);
++ free(devpath);
++
++ if (ret == 0) {
++ strncpy(devname, device->driver, devname_len);
++ return true;
++ }
++
++ return false;
++}
++
++static char *
++sysctl_get_str(const char *sysctlname)
++{
++ char *dest = NULL;
++ size_t len;
++
++ if (sysctlname == NULL)
++ return NULL;
++
++ if (sysctlbyname(sysctlname, NULL, &len, NULL, 0) == 0) {
++ dest = malloc(len + 1);
++ if (dest) {
++ if (sysctlbyname(sysctlname, dest, &len, NULL, 0) == 0)
++ dest[len] = '\0';
++ else {
++ free(dest);
++ dest = NULL;
++ }
++ }
++ }
++
++ return dest;
++}
++
++static void
++device_added(const char *devname)
++{
++ char path[PATH_MAX];
++ char sysctlname[PATH_MAX];
++ char *vendor;
++ char *product = NULL;
++ char *config_info = NULL;
++ char *walk;
++ InputOption *options = NULL;
++ InputAttributes attrs = { };
++ DeviceIntPtr dev = NULL;
++ int i;
++ int fd;
++
++ for (i = 0; hw_types[i].driver != NULL; i++) {
++ size_t len;
++
++ len = strlen(hw_types[i].driver);
++ if (strcmp(devname, hw_types[i].driver) == 0 ||
++ (strncmp(devname, hw_types[i].driver, len) == 0 &&
++ isnumber(*(devname + len)))) {
++ attrs.flags |= hw_types[i].flag;
++ break;
++ }
++ }
++
++ if (hw_types[i].driver == NULL || hw_types[i].xdriver == NULL) {
++ LogMessage(X_INFO, "config/devd: ignoring device %s\n",
++ devname);
++ return;
++ }
++
++ /* Skip keyboard devices if kbdmux is enabled */
++ if (is_kbdmux && is_console_kbd && hw_types[i].flag & ATTR_KEYBOARD) {
++ LogMessage(X_INFO, "config/devd: kbdmux is enabled, ignoring device %s\n",
++ devname);
++ return;
++ }
++
++ snprintf(path, sizeof(path), "/dev/%s", devname);
++
++ options = input_option_new(NULL, "_source", "server/devd");
++ if (!options)
++ return;
++
++ snprintf(sysctlname, sizeof(sysctlname), "dev.%s.%s.%%desc",
++ hw_types[i].driver, devname + strlen(hw_types[i].driver));
++ vendor = sysctl_get_str(sysctlname);
++ if (vendor == NULL) {
++ options = input_option_new(options, "name", devname);
++ }
++ else {
++ if ((walk = strchr(vendor, ' ')) != NULL) {
++ walk[0] = '\0';
++ walk++;
++ product = walk;
++ if ((walk = strchr(product, ',')) != NULL)
++ walk[0] = '\0';
++ }
++
++ attrs.vendor = strdup(vendor);
++ if (product) {
++ attrs.product = strdup(product);
++ options = input_option_new(options, "name", product);
++ }
++ else
++ options = input_option_new(options, "name", "(unnamed)");
++
++ free(vendor);
++ }
++
++ /* XXX implement usb_id */
++ attrs.usb_id = NULL;
++ attrs.device = strdup(path);
++ options = input_option_new(options, "driver", hw_types[i].xdriver);
++
++ fd = open(path, O_RDONLY);
++ if (fd > 0) {
++ close(fd);
++ options = input_option_new(options, "device", path);
++ }
++ else {
++ if (attrs.flags & ~ATTR_KEYBOARD) {
++ LogMessage(X_INFO, "config/devd: device %s already opened\n",
++ path);
++
++ /*
++ * Fail if cannot open device, it breaks AllowMouseOpenFail,
++ * but it should not matter when config/devd enabled
++ */
++ goto unwind;
++ }
++
++ if (is_console_kbd) {
++ /*
++ * There can be only one keyboard attached to console and
++ * it is already added.
++ */
++ LogMessage(X_WARNING, "config/devd: console keyboard is "
++ "already added, ignoring %s (%s)\n",
++ attrs.product, path);
++ goto unwind;
++ }
++ else
++ /*
++ * Don't pass "device" option if the keyboard is already
++ * attached to the console (ie. open() fails).
++ * This would activate a special logic in xf86-input-keyboard.
++ * Prevent any other attached to console keyboards being
++ * processed. There can be only one such device.
++ */
++ is_console_kbd = true;
++ }
++
++ if (asprintf(&config_info, "devd:%s", devname) == -1) {
++ config_info = NULL;
++ goto unwind;
++ }
++
++ if (device_is_duplicate(config_info)) {
++ LogMessage(X_WARNING, "config/devd: device %s (%s) already added. "
++ "ignoring\n", attrs.product, path);
++ goto unwind;
++ }
++
++ options = input_option_new(options, "config_info", config_info);
++ LogMessage(X_INFO, "config/devd: adding input device %s (%s)\n",
++ attrs.product, path);
++
++ NewInputDeviceRequest(options, &attrs, &dev);
++
++unwind:
++ free(config_info);
++ input_option_free_list(&options);
++ free(attrs.usb_id);
++ free(attrs.product);
++ free(attrs.device);
++ free(attrs.vendor);
++}
++
++static void
++device_removed(char *devname)
++{
++ char *config_info;
++
++ if (asprintf(&config_info, "devd:%s", devname) == -1)
++ return;
++
++ remove_devices("devd", config_info);
++
++ free(config_info);
++}
++
++static bool is_kbdmux_enabled(void)
++{
++ /* Xorg uses /dev/ttyv0 as a console device */
++ /* const char device[]="/dev/console"; */
++ const char device[]="/dev/ttyv0";
++ keyboard_info_t info;
++ int fd;
++
++ fd = open(device, O_RDONLY);
++
++ if (fd < 0)
++ return false;
++
++ if (ioctl(fd, KDGKBINFO, &info) == -1) {
++ close(fd);
++ return false;
++ }
++
++ close(fd);
++
++ if (!strncmp(info.kb_name, "kbdmux", 6))
++ return true;
++
++ return false;
++}
++
++static void
++disconnect_devd(int sock)
++{
++ if (sock >= 0) {
++ RemoveGeneralSocket(sock);
++ close(sock);
++ }
++}
++
++static int
++connect_devd(void)
++{
++ struct sockaddr_un devd;
++ int sock;
++
++ sock = socket(AF_UNIX, SOCK_STREAM, 0);
++ if (sock < 0) {
++ LogMessage(X_ERROR, "config/devd: fail opening stream socket\n");
++ return -1;
++ }
++
++ devd.sun_family = AF_UNIX;
++ strlcpy(devd.sun_path, DEVD_SOCK_PATH, sizeof(devd.sun_path));
++
++ if (connect(sock, (struct sockaddr *) &devd, sizeof(devd)) < 0) {
++ close(sock);
++ LogMessage(X_ERROR, "config/devd: fail to connect to devd\n");
++ return -1;
++ }
++
++ AddGeneralSocket(sock);
++
++ return sock;
++}
++
++static CARD32
++reconnect_handler(OsTimerPtr timer, CARD32 time, pointer arg)
++{
++ int newsock;
++
++ if ((newsock = connect_devd()) > 0) {
++ sock_devd = newsock;
++ TimerFree(rtimer);
++ rtimer = NULL;
++ LogMessage(X_INFO, "config/devd: reopening devd socket\n");
++ return 0;
++ }
++
++ /* Try again after RECONNECT_DELAY */
++ return RECONNECT_DELAY;
++}
++
++static ssize_t
++socket_getline(int fd, char **out)
++{
++ char *buf, *newbuf;
++ ssize_t ret, cap, sz = 0;
++ char c;
++
++ cap = 1024;
++ buf = malloc(cap * sizeof(char));
++ if (!buf)
++ return -1;
++
++ for (;;) {
++ ret = read(sock_devd, &c, 1);
++ if (ret < 0) {
++ if (errno == EINTR)
++ continue;
++ free(buf);
++ return -1;
++ /* EOF - devd socket is lost */
++ } else if (ret == 0) {
++ disconnect_devd(sock_devd);
++ rtimer = TimerSet(NULL, 0, 1, reconnect_handler, NULL);
++ LogMessage(X_WARNING, "config/devd: devd socket is lost\n");
++ return -1;
++ }
++ if (c == '\n')
++ break;
++
++ if (sz + 1 >= cap) {
++ cap *= 2;
++ newbuf = realloc(buf, cap * sizeof(char));
++ if (!newbuf) {
++ free(buf);
++ return -1;
++ }
++ buf = newbuf;
++ }
++ buf[sz] = c;
++ sz++;
++ }
++
++ buf[sz] = '\0';
++ if (sz >= 0)
++ *out = buf;
++ else
++ free(buf);
++
++ /* Number of bytes in the line, not counting the line break */
++ return sz;
++}
++
++static void
++wakeup_handler(void *data, int err, void *read_mask)
++{
++ char *line = NULL;
++ char *walk;
++
++ if (err < 0)
++ return;
++
++ if (FD_ISSET(sock_devd, (fd_set *) read_mask)) {
++ if (socket_getline(sock_devd, &line) < 0)
++ return;
++
++ walk = strchr(line + 1, ' ');
++ if (walk != NULL)
++ walk[0] = '\0';
++
++ switch (*line) {
++ case DEVD_EVENT_ADD:
++ device_added(line + 1);
++ break;
++ case DEVD_EVENT_REMOVE:
++ device_removed(line + 1);
++ break;
++ default:
++ break;
++ }
++ free(line);
++ }
++}
++
++static void
++block_handler(void *data, struct timeval **tv, void *read_mask)
++{
++}
++
++int
++config_devd_init(void)
++{
++ char devicename[1024];
++ int i, j;
++
++ LogMessage(X_INFO, "config/devd: probing input devices...\n");
++
++ /*
++ * Add fake keyboard and give up on keyboards management
++ * if kbdmux is enabled
++ */
++ if ((is_kbdmux = is_kbdmux_enabled()) == true)
++ device_added("kbdmux");
++
++ for (i = 0; hw_types[i].driver != NULL; i++) {
++ /* First scan the sysctl to determine the hardware */
++ for (j = 0; j < 16; j++) {
++ if (sysctl_exists(&hw_types[i], j,
++ devicename, sizeof(devicename)) != 0)
++ device_added(devicename);
++ }
++
++ if (devpath_exists(&hw_types[i], devicename, sizeof(devicename)) != 0)
++ device_added(devicename);
++ }
++
++ if ((sock_devd = connect_devd()) < 0)
++ return 0;
++
++ RegisterBlockAndWakeupHandlers(block_handler, wakeup_handler, NULL);
++
++ return 1;
++}
++
++void
++config_devd_fini(void)
++{
++ LogMessage(X_INFO, "config/devd: terminating backend...\n");
++
++ if (rtimer) {
++ TimerFree(rtimer);
++ rtimer = NULL;
++ }
++
++ disconnect_devd(sock_devd);
++
++ RemoveBlockAndWakeupHandlers(block_handler, wakeup_handler, NULL);
++
++ is_console_kbd = false;
++}
Property changes on: trunk/x11-servers/xorg-server/files/patch-config_devd.c
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Added: trunk/x11-servers/xorg-server/files/patch-hw_xfree86_common_xf86Config.c
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-hw_xfree86_common_xf86Config.c (rev 0)
+++ trunk/x11-servers/xorg-server/files/patch-hw_xfree86_common_xf86Config.c 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,20 @@
+--- hw/xfree86/common/xf86Config.c.orig 2014-04-15 01:01:57 UTC
++++ hw/xfree86/common/xf86Config.c
+@@ -1376,13 +1376,16 @@ checkCoreInputDevices(serverLayoutPtr se
+ }
+
+ if (!xf86Info.forceInputDevices && !(foundPointer && foundKeyboard)) {
+-#if defined(CONFIG_HAL) || defined(CONFIG_UDEV) || defined(CONFIG_WSCONS)
++#if defined(CONFIG_HAL) || defined(CONFIG_UDEV) || defined(CONFIG_WSCONS) || \
++ defined(CONFIG_DEVD)
+ const char *config_backend;
+
+ #if defined(CONFIG_HAL)
+ config_backend = "HAL";
+ #elif defined(CONFIG_UDEV)
+ config_backend = "udev";
++#elif defined(CONFIG_DEVD)
++ config_backend = "devd";
+ #else
+ config_backend = "wscons";
+ #endif
Property changes on: trunk/x11-servers/xorg-server/files/patch-hw_xfree86_common_xf86Config.c
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Added: trunk/x11-servers/xorg-server/files/patch-hw_xfree86_common_xf86Globals.c
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-hw_xfree86_common_xf86Globals.c (rev 0)
+++ trunk/x11-servers/xorg-server/files/patch-hw_xfree86_common_xf86Globals.c 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,12 @@
+--- hw/xfree86/common/xf86Globals.c.orig 2014-04-12 15:29:14 UTC
++++ hw/xfree86/common/xf86Globals.c
+@@ -123,7 +123,8 @@ xf86InfoRec xf86Info = {
+ .log = LogNone,
+ .disableRandR = FALSE,
+ .randRFrom = X_DEFAULT,
+-#if defined(CONFIG_HAL) || defined(CONFIG_UDEV) || defined(CONFIG_WSCONS)
++#if defined(CONFIG_HAL) || defined(CONFIG_UDEV) || defined(CONFIG_WSCONS) || \
++ defined(CONFIG_DEVD)
+ .forceInputDevices = FALSE,
+ .autoAddDevices = TRUE,
+ .autoEnableDevices = TRUE,
Property changes on: trunk/x11-servers/xorg-server/files/patch-hw_xfree86_common_xf86Globals.c
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Added: trunk/x11-servers/xorg-server/files/patch-hw_xfree86_common_xf86Xinput.c
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-hw_xfree86_common_xf86Xinput.c (rev 0)
+++ trunk/x11-servers/xorg-server/files/patch-hw_xfree86_common_xf86Xinput.c 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,9 @@
+Index: hw/xfree86/common/xf86Xinput.c
+@@ -942,6 +942,7 @@
+ if (strcmp(key, "_source") == 0 &&
+ (strcmp(value, "server/hal") == 0 ||
+ strcmp(value, "server/udev") == 0 ||
++ strcmp(value, "server/devd") == 0 ||
+ strcmp(value, "server/wscons") == 0)) {
+ is_auto = 1;
+ if (!xf86Info.autoAddDevices) {
Property changes on: trunk/x11-servers/xorg-server/files/patch-hw_xfree86_common_xf86Xinput.c
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Added: trunk/x11-servers/xorg-server/files/patch-hw_xfree86_loader_loadmod.c
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-hw_xfree86_loader_loadmod.c (rev 0)
+++ trunk/x11-servers/xorg-server/files/patch-hw_xfree86_loader_loadmod.c 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,11 @@
+--- hw/xfree86/loader/loadmod.c.orig 2014-04-12 15:29:14 UTC
++++ hw/xfree86/loader/loadmod.c
+@@ -490,7 +490,7 @@ LoaderListDirs(const char **subdirlist,
+ char **elem;
+ const char **subdirs;
+ const char **s;
+- PatternPtr patterns;
++ PatternPtr patterns = NULL;
+ PatternPtr p;
+ DIR *d;
+ struct dirent *dp;
Property changes on: trunk/x11-servers/xorg-server/files/patch-hw_xfree86_loader_loadmod.c
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Added: trunk/x11-servers/xorg-server/files/patch-hw_xfree86_modes_xf86Crtc.c
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-hw_xfree86_modes_xf86Crtc.c (rev 0)
+++ trunk/x11-servers/xorg-server/files/patch-hw_xfree86_modes_xf86Crtc.c 2015-05-28 03:00:00 UTC (rev 19134)
@@ -0,0 +1,12 @@
+--- hw/xfree86/modes/xf86Crtc.c.orig 2014-04-15 01:01:57 UTC
++++ hw/xfree86/modes/xf86Crtc.c
+@@ -1774,6 +1774,9 @@ SetCompatOutput(xf86CrtcConfigPtr config
+ DisplayModePtr maxmode = NULL, testmode, mode;
+ int o, compat = -1, count, mincount = 0;
+
++ if (config->num_output == 0)
++ return NULL;
++
+ /* Look for one that's definitely connected */
+ for (o = 0; o < config->num_output; o++) {
+ test = config->output[o];
Property changes on: trunk/x11-servers/xorg-server/files/patch-hw_xfree86_modes_xf86Crtc.c
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property
Modified: trunk/x11-servers/xorg-server/files/patch-xkb_Makefile.in
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-xkb_Makefile.in 2015-05-28 02:59:29 UTC (rev 19133)
+++ trunk/x11-servers/xorg-server/files/patch-xkb_Makefile.in 2015-05-28 03:00:00 UTC (rev 19134)
@@ -1,6 +1,6 @@
---- xkb/Makefile.in.orig 2013-06-16 11:16:48.000000000 +0000
-+++ xkb/Makefile.in 2013-06-16 11:17:08.000000000 +0000
-@@ -816,7 +816,7 @@
+--- xkb/Makefile.in.orig 2014-12-12 22:12:45 UTC
++++ xkb/Makefile.in
+@@ -790,7 +790,7 @@ info: info-am
info-am:
Deleted: trunk/x11-servers/xorg-server/files/patch-xorgconf.cpp
===================================================================
--- trunk/x11-servers/xorg-server/files/patch-xorgconf.cpp 2015-05-28 02:59:29 UTC (rev 19133)
+++ trunk/x11-servers/xorg-server/files/patch-xorgconf.cpp 2015-05-28 03:00:00 UTC (rev 19134)
@@ -1,14 +0,0 @@
---- hw/xfree86/xorgconf.cpp.orig Fri Dec 31 14:40:27 2004
-+++ hw/xfree86/xorgconf.cpp Fri Dec 31 14:40:28 2004
-@@ -624,3 +624,11 @@
- InputDevice "Keyboard1" "CoreKeyboard"
- EndSection
-
-+
-+XCOMM Two experimental extensions are available -- Composite and XEVIE. Uncomment
-+XCOMM the section below to enable Composite. Many extensions can also be disabled
-+XCOMM in this manner.
-+
-+XCOMM Section "Extensions"
-+XCOMM Option "Composite" "Enable"
-+XCOMM EndSection
Modified: trunk/x11-servers/xorg-server/pkg-plist
===================================================================
--- trunk/x11-servers/xorg-server/pkg-plist 2015-05-28 02:59:29 UTC (rev 19133)
+++ trunk/x11-servers/xorg-server/pkg-plist 2015-05-28 03:00:00 UTC (rev 19134)
@@ -12,13 +12,10 @@
include/xorg/IBM.h
include/xorg/TI.h
include/xorg/XIstubs.h
-%%NEW%%include/xorg/Xprintf.h
+include/xorg/Xprintf.h
include/xorg/bt829.h
-%%OLD%%include/xorg/bstore.h
-%%OLD%%include/xorg/bstorestr.h
-%%NEW%%include/xorg/callback.h
-%%OLD%%include/xorg/cfb8_16.h
-%%NEW%%include/xorg/client.h
+include/xorg/callback.h
+include/xorg/client.h
include/xorg/closestr.h
include/xorg/closure.h
include/xorg/colormap.h
@@ -61,14 +58,13 @@
include/xorg/geint.h
include/xorg/globals.h
include/xorg/glyphstr.h
+include/xorg/glx_extinit.h
include/xorg/hotplug.h
include/xorg/i2c_def.h
include/xorg/input.h
include/xorg/inputstr.h
-%%NEW%%include/xorg/list.h
+include/xorg/list.h
include/xorg/mi.h
-%%OLD%%include/xorg/mibank.h
-include/xorg/mibstore.h
include/xorg/micmap.h
include/xorg/micoord.h
include/xorg/mifillarc.h
@@ -82,8 +78,8 @@
include/xorg/miscstruct.h
include/xorg/mispans.h
include/xorg/mistruct.h
-%%NEW%%include/xorg/misync.h
-%%NEW%%include/xorg/misyncstr.h
+include/xorg/misync.h
+include/xorg/misyncstr.h
include/xorg/miwideline.h
include/xorg/mizerarc.h
include/xorg/mioverlay.h
@@ -90,7 +86,7 @@
include/xorg/msp3430.h
include/xorg/opaque.h
include/xorg/os.h
-%%NEW%%include/xorg/optionstr.h
+include/xorg/optionstr.h
include/xorg/panoramiXsrv.h
include/xorg/panoramiX.h
include/xorg/picture.h
@@ -102,7 +98,6 @@
include/xorg/propertyst.h
include/xorg/ptrveloc.h
include/xorg/randrstr.h
-%%OLD%%include/xorg/renderedge.h
include/xorg/region.h
include/xorg/regionstr.h
include/xorg/registry.h
@@ -120,7 +115,7 @@
include/xorg/site.h
include/xorg/swaprep.h
include/xorg/swapreq.h
-%%NEW%%include/xorg/syncsdk.h
+include/xorg/syncsdk.h
include/xorg/tda8425.h
include/xorg/tda9850.h
include/xorg/tda9885.h
@@ -133,9 +128,6 @@
include/xorg/wfbrename.h
include/xorg/window.h
include/xorg/windowstr.h
-include/xorg/xaa.h
-%%OLD%%include/xorg/xaaWrapper.h
-include/xorg/xaalocal.h
include/xorg/xaarop.h
include/xorg/xace.h
include/xorg/xacestr.h
@@ -146,7 +138,7 @@
include/xorg/xf86Modes.h
include/xorg/xf86Module.h
include/xorg/xf86Opt.h
-%%NEW%%include/xorg/xf86Optionstr.h
+include/xorg/xf86Optionstr.h
include/xorg/xf86Optrec.h
include/xorg/xf86Parser.h
include/xorg/xf86Pci.h
@@ -165,6 +157,7 @@
include/xorg/xf86fbman.h
include/xorg/xf86i2c.h
include/xorg/xf86int10.h
+include/xorg/xf86platformBus.h
include/xorg/xf86sbusBus.h
include/xorg/xf86str.h
include/xorg/xf86xv.h
@@ -181,15 +174,10 @@
include/xorg/xserver-properties.h
include/xorg/xvdix.h
include/xorg/xvmcext.h
-lib/xorg/modules/extensions/libdbe.so
-lib/xorg/modules/extensions/libdri.so
-lib/xorg/modules/extensions/libdri2.so
-lib/xorg/modules/extensions/libextmod.so
-lib/xorg/modules/extensions/librecord.so
lib/xorg/modules/extensions/.xorg/libglx.so
lib/xorg/modules/libexa.so
lib/xorg/modules/libfb.so
-%%NEW%%lib/xorg/modules/libfbdevhw.so
+lib/xorg/modules/libfbdevhw.so
lib/xorg/modules/libint10.so
lib/xorg/modules/libshadow.so
lib/xorg/modules/libshadowfb.so
@@ -196,9 +184,6 @@
lib/xorg/modules/libvbe.so
lib/xorg/modules/libvgahw.so
lib/xorg/modules/libwfb.so
-lib/xorg/modules/libxaa.so
-%%OLD%%lib/xorg/modules/libxf8_16bpp.so
-%%OLD%%lib/xorg/modules/linux/libfbdevhw.so
lib/xorg/modules/multimedia/bt829_drv.so
lib/xorg/modules/multimedia/fi1236_drv.so
lib/xorg/modules/multimedia/msp3430_drv.so
@@ -215,16 +200,6 @@
man/man4/exa.4.gz
man/man4/fbdevhw.4.gz
man/man5/xorg.conf.5.gz
-%%NEW%%man/man5/xorg.conf.d.5.gz
+man/man5/xorg.conf.d.5.gz
share/aclocal/xorg-server.m4
-%%NEW%%@exec /bin/mkdir -p %D/share/X11/xorg.conf.d
- at comment %%NEW%%@dirrm share/doc/xorg-server
- at dirrm include/xorg
- at dirrm lib/xorg/modules/extensions/.xorg
- at dirrm lib/xorg/modules/extensions
- at dirrm lib/xorg/modules/multimedia
-%%OLD%%@dirrm lib/xorg/modules/linux
- at dirrm lib/xorg/modules
- at dirrm lib/xorg
-%%NEW%%@dirrmtry share/X11/xorg.conf.d
- at dirrmtry share/X11
+ at dir etc/X11/xorg.conf.d
Modified: trunk/x11-servers/xorg-vfbserver/Makefile
===================================================================
--- trunk/x11-servers/xorg-vfbserver/Makefile 2015-05-28 02:59:29 UTC (rev 19133)
+++ trunk/x11-servers/xorg-vfbserver/Makefile 2015-05-28 03:00:00 UTC (rev 19134)
@@ -1,31 +1,58 @@
# $MidnightBSD$
PORTNAME= xorg-vfbserver
-PORTREVISION= 1
+PORTVERSION= 1.14.7
+CATEGORIES= x11-servers
+MASTER_SITES= XORG/individual/xserver
+DISTNAME= xorg-server-${PORTVERSION}
+DIST_SUBDIR= xorg/xserver
MAINTAINER= ports at MidnightBSD.org
COMMENT= X virtual framebuffer server from X.Org
+
LICENSE= mit
-MASTERDIR= ${.CURDIR}/../xorg-server
-DESCR= ${.CURDIR}/pkg-descr
-USE_XORG= x11 xf86driproto glproto randrproto renderproto fixesproto \
- damageproto xcmiscproto xextproto xf86miscproto inputproto \
- xf86vidmodeproto xf86bigfontproto scrnsaverproto bigreqsproto \
- dri2proto resourceproto fontsproto xf86dgaproto videoproto \
- compositeproto trapproto recordproto resourceproto \
- xineramaproto xinerama evieproto xkbfile xfont fontenc \
- xkbui xxf86misc xxf86vm xaw7 xmu xpm xext pixman xtrans
+USES= tar:bzip2 pkgconfig
+GNU_CONFIGURE= yes
+CONFIGURE_ARGS= --disable-dmx \
+ --disable-xephyr \
+ --disable-xnest \
+ --disable-kdrive \
+ --disable-xfbdev \
+ --disable-xfake \
+ --disable-screensaver \
+ --disable-xwin \
+ --disable-xwayland \
+ --disable-xorg \
+ --without-xmlto \
+ --disable-docs \
+ --disable-devel-docs \
+ --localstatedir=/var \
+ --without-dtrace \
+ --without-doxygen \
+ --disable-libpciaccess \
+ --disable-glx \
+ --disable-dri \
+ --disable-config-hal \
+ --disable-libdrm \
+ --disable-glx-tls \
+ --disable-vbe \
+ --disable-vgahw \
+ --enable-xvfb \
+ --with-fontrootdir=${PREFIX}/share/fonts
-CONFIGURE_ARGS= --disable-dmx --disable-xnest \
- --without-xmlto --disable-docs --disable-devel1-docs \
- --localstatedir=/var --without-dtrace
+USE_XORG= pixman x11 fixesproto damageproto xcmiscproto xtrans \
+ bigreqsproto randrproto renderproto xextproto inputproto \
+ videoproto compositeproto recordproto \
+ fontsproto resourceproto xf86driproto glproto \
+ presentproto xineramaproto xkbfile xfont
-SLAVE_PORT= yes
-PLIST_FILES= bin/Xvfb
-MAN1= Xvfb.1
+PLIST_FILES= bin/Xvfb \
+ man/man1/Xvfb.1.gz
+.include <bsd.port.pre.mk>
+
do-install:
cd ${WRKSRC}/hw/vfb; ${MAKE} ${FAKE_MAKEARGS} install
-.include "${MASTERDIR}/Makefile"
+.include <bsd.port.post.mk>
Modified: trunk/x11-servers/xorg-vfbserver/distinfo
===================================================================
--- trunk/x11-servers/xorg-vfbserver/distinfo 2015-05-28 02:59:29 UTC (rev 19133)
+++ trunk/x11-servers/xorg-vfbserver/distinfo 2015-05-28 03:00:00 UTC (rev 19134)
@@ -1,2 +1,2 @@
-SHA256 (xorg/xserver/xorg-server-1.10.4.tar.bz2) = fafc16b97b9a61b62dfaa74e8d336baa0cea752ce9ed8103c4d212baa8031ca5
-SIZE (xorg/xserver/xorg-server-1.10.4.tar.bz2) = 5386174
+SHA256 (xorg/xserver/xorg-server-1.14.7.tar.bz2) = fcf66fa6ad86227613d2d3e8ae13ded297e2a1e947e9060a083eaf80d323451f
+SIZE (xorg/xserver/xorg-server-1.14.7.tar.bz2) = 5520884
More information about the Midnightbsd-cvs
mailing list