xserver fontconfig libXdmcp mesa pixmand xkeyboard-config git update 7 oct 2013

xserver          commit ccbe17b1c6da1ad9d085fc8133cdd15dc7004a4a
xkeyboard-config commit c8326b7d12b20eccfd38d661b95d9b23d8a56e27
libXdmcp         commit 089081dca4ba3598c6f9bf401c029378943b5854
pixman           commit c89f4c826695dbb5df0817d84f845dbd3e28b7a7
fontconfig       commit 604c2a683f1357fc65bad372b5d25a90099f827f
mesa             commit cfbfb50cb8d47b7f6975828b504936f9324f3b12

6 files changed, 156 insertions, 41 deletions

diff --git a/libXdmcp/.gitignore b/libXdmcp/.gitignore
index 07ac69ef1..edf9a1669 100644
--- a/libXdmcp/.gitignore
+++ b/libXdmcp/.gitignore
@@ -76,3 +76,4 @@ core
 #		Edit the following section as needed
 # For example, !report.pc overrides *.pc. See 'man gitignore'
 # 
+test/Array
diff --git a/libXdmcp/Array.c b/libXdmcp/Array.c
index f529781db..6b9b617f7 100644
--- a/libXdmcp/Array.c
+++ b/libXdmcp/Array.c
@@ -44,6 +44,15 @@ xmalloc(size_t size)
 }
 
 /*
+ * This variant of calloc does not return NULL if zero count is passed into.
+ */
+static void *
+xcalloc(size_t n, size_t size)
+{
+    return calloc(n ? n : 1, size);
+}
+
+/*
  * This variant of realloc does not return NULL if zero size is passed into
  */
 static void *
@@ -55,80 +64,73 @@ xrealloc(void *ptr, size_t size)
 int
 XdmcpAllocARRAY8 (ARRAY8Ptr array, int length)
 {
-    CARD8Ptr	newData;
-
     /* length defined in ARRAY8 struct is a CARD16 (not CARD8 like the rest) */
-    if (length > UINT16_MAX)
-	return FALSE;
+    if ((length > UINT16_MAX) || (length < 0))
+        array->data = NULL;
+    else
+        array->data = xmalloc(length * sizeof (CARD8));
 
-    newData = (CARD8Ptr) xmalloc(length * sizeof (CARD8));
-    if (!newData) {
+    if (array->data == NULL) {
 	array->length = 0;
-	array->data = NULL;
 	return FALSE;
     }
     array->length = (CARD16) length;
-    array->data = newData;
     return TRUE;
 }
 
 int
 XdmcpAllocARRAY16 (ARRAY16Ptr array, int length)
 {
-    CARD16Ptr	newData;
-
     /* length defined in ARRAY16 struct is a CARD8 */
-    if (length > UINT8_MAX)
-	return FALSE;
+    if ((length > UINT8_MAX) || (length < 0))
+        array->data = NULL;
+    else
+        array->data = xmalloc(length * sizeof (CARD16));
 
-    newData = (CARD16Ptr) xmalloc(length * sizeof (CARD16));
-    if (!newData) {
+    if (array->data == NULL) {
 	array->length = 0;
-	array->data = NULL;
 	return FALSE;
     }
     array->length = (CARD8) length;
-    array->data = newData;
     return TRUE;
 }
 
 int
 XdmcpAllocARRAY32 (ARRAY32Ptr array, int length)
 {
-    CARD32Ptr	newData;
-
     /* length defined in ARRAY32 struct is a CARD8 */
-    if (length > UINT8_MAX)
-	return FALSE;
+    if ((length > UINT8_MAX) || (length < 0))
+        array->data = NULL;
+    else
+        array->data = xmalloc(length * sizeof (CARD32));
 
-    newData = (CARD32Ptr) xmalloc(length * sizeof (CARD32));
-    if (!newData) {
+    if (array->data == NULL) {
 	array->length = 0;
-	array->data = NULL;
 	return FALSE;
     }
     array->length = (CARD8) length;
-    array->data = newData;
     return TRUE;
 }
 
 int
 XdmcpAllocARRAYofARRAY8 (ARRAYofARRAY8Ptr array, int length)
 {
-    ARRAY8Ptr	newData;
-
     /* length defined in ARRAYofARRAY8 struct is a CARD8 */
-    if (length > UINT8_MAX)
-	return FALSE;
-
-    newData = (ARRAY8Ptr) xmalloc(length * sizeof (ARRAY8));
-    if (!newData) {
+    if ((length > UINT8_MAX) || (length < 0))
+        array->data = NULL;
+    else
+        /*
+         * Use calloc to ensure the pointers are cleared out so we
+         * don't try to free garbage if XdmcpDisposeARRAYofARRAY8()
+         * is called before the caller sets them to valid pointers.
+         */
+        array->data = xcalloc(length, sizeof (ARRAY8));
+
+    if (array->data == NULL) {
 	array->length = 0;
-	array->data = NULL;
 	return FALSE;
     }
     array->length = (CARD8) length;
-    array->data = newData;
     return TRUE;
 }
 
@@ -157,7 +159,7 @@ XdmcpReallocARRAY8 (ARRAY8Ptr array, int length)
     CARD8Ptr	newData;
 
     /* length defined in ARRAY8 struct is a CARD16 (not CARD8 like the rest) */
-    if (length > UINT16_MAX)
+    if ((length > UINT16_MAX) || (length < 0))
 	return FALSE;
 
     newData = (CARD8Ptr) xrealloc(array->data, length * sizeof (CARD8));
@@ -174,12 +176,15 @@ XdmcpReallocARRAYofARRAY8 (ARRAYofARRAY8Ptr array, int length)
     ARRAY8Ptr	newData;
 
     /* length defined in ARRAYofARRAY8 struct is a CARD8 */
-    if (length > UINT8_MAX)
+    if ((length > UINT8_MAX) || (length < 0))
 	return FALSE;
 
     newData = (ARRAY8Ptr) xrealloc(array->data, length * sizeof (ARRAY8));
     if (!newData)
 	return FALSE;
+    if (length > array->length)
+        memset(newData + array->length, 0,
+               (length - array->length) * sizeof (ARRAY8));
     array->length = (CARD8) length;
     array->data = newData;
     return TRUE;
@@ -191,7 +196,7 @@ XdmcpReallocARRAY16 (ARRAY16Ptr array, int length)
     CARD16Ptr	newData;
 
     /* length defined in ARRAY16 struct is a CARD8 */
-    if (length > UINT8_MAX)
+    if ((length > UINT8_MAX) || (length < 0))
 	return FALSE;
     newData = (CARD16Ptr) xrealloc(array->data, length * sizeof (CARD16));
     if (!newData)
@@ -207,7 +212,7 @@ XdmcpReallocARRAY32 (ARRAY32Ptr array, int length)
     CARD32Ptr	newData;
 
     /* length defined in ARRAY32 struct is a CARD8 */
-    if (length > UINT8_MAX)
+    if ((length > UINT8_MAX) || (length < 0))
 	return FALSE;
 
     newData = (CARD32Ptr) xrealloc(array->data, length * sizeof (CARD32));
diff --git a/libXdmcp/Makefile.am b/libXdmcp/Makefile.am
index c3b85aad6..ca540997b 100644
--- a/libXdmcp/Makefile.am
+++ b/libXdmcp/Makefile.am
@@ -1,4 +1,4 @@
-SUBDIRS=doc
+SUBDIRS=doc . test
 
 lib_LTLIBRARIES = libXdmcp.la
 
diff --git a/libXdmcp/configure.ac b/libXdmcp/configure.ac
index d8ddfae93..4e85650e7 100644
--- a/libXdmcp/configure.ac
+++ b/libXdmcp/configure.ac
@@ -35,10 +35,10 @@ AM_MAINTAINER_MODE
 AC_LIBTOOL_WIN32_DLL
 AC_PROG_LIBTOOL
 
-# Require xorg-macros minimum of 1.12 for DocBook external references
+# Require xorg-macros minimum of 1.16 for unit testing with memory checks
 m4_ifndef([XORG_MACROS_VERSION],
-          [m4_fatal([must install xorg-macros 1.12 or later before running autoconf/autogen])])
-XORG_MACROS_VERSION(1.12)
+          [m4_fatal([must install xorg-macros 1.16 or later before running autoconf/autogen])])
+XORG_MACROS_VERSION(1.16)
 XORG_DEFAULT_OPTIONS
 XORG_ENABLE_DOCS
 XORG_WITH_XMLTO(0.0.22)
@@ -72,7 +72,11 @@ AM_CONDITIONAL(HASXDMAUTH,test x$HASXDMAUTH = xyes)
 XORG_WITH_LINT
 XORG_LINT_LIBRARY([Xdmcp])
 
+#  --enable-unit-tests
+XORG_ENABLE_UNIT_TESTS([yes])
+
 AC_CONFIG_FILES([Makefile
 		doc/Makefile
+		test/Makefile
 		xdmcp.pc])
 AC_OUTPUT
diff --git a/libXdmcp/test/Array.c b/libXdmcp/test/Array.c
new file mode 100644
index 000000000..786fade52
--- /dev/null
+++ b/libXdmcp/test/Array.c
@@ -0,0 +1,92 @@
+/*
+ * Copyright (c) 2013, Oracle and/or its affiliates. All rights reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <assert.h>
+#include <X11/Xdmcp.h>
+#include <inttypes.h>
+
+/* Test what happens if you try to allocate an array with too many entries */
+#define TestAllocOversize(type, len) {                          \
+    type newArray = { -1, (void *) -1 };                        \
+    int result;                                                 \
+    printf("Checking XdmcpAlloc%s(%d)...\n", #type, len);       \
+    result = XdmcpAlloc##type(&newArray, len)    ;              \
+    assert(result == FALSE);                                    \
+    assert(newArray.length == 0);                               \
+    assert(newArray.data == NULL);                              \
+    printf("Checking XdmcpRealloc%s(%d)...\n", #type, len);     \
+    result = XdmcpRealloc##type(&newArray, len);                \
+    assert(result == FALSE);                                    \
+    assert(newArray.length == 0);                               \
+    assert(newArray.data == NULL);                              \
+    XdmcpDispose##type(&newArray);                              \
+}
+
+static void
+TestAllocOversizeArrays(void)
+{
+    TestAllocOversize(ARRAY8, UINT16_MAX + 1);
+    TestAllocOversize(ARRAY16, UINT8_MAX + 1);
+    TestAllocOversize(ARRAY32, UINT8_MAX + 1);
+    TestAllocOversize(ARRAYofARRAY8, UINT8_MAX + 1);
+    TestAllocOversize(ARRAY8, -1);
+    TestAllocOversize(ARRAY16, -1);
+    TestAllocOversize(ARRAY32, -1);
+    TestAllocOversize(ARRAYofARRAY8, -1);
+}
+
+static void
+TestZeroFillARRAYofARRAY8(void)
+{
+    ARRAYofARRAY8 aa;
+    int result;
+    char *noise;
+
+    printf("Checking XdmcpAllocARRAYofARRAY8 zero fills array...\n");
+    /* prefill memory with junk - hopefully next malloc will pick up some */
+    noise = malloc(32 * sizeof(ARRAY8));
+    memset(noise, 0xdeadbeef, 32 * sizeof(ARRAY8));
+    free(noise);
+    result = XdmcpAllocARRAYofARRAY8(&aa, 32);
+    assert(result == TRUE);
+    assert(aa.length == 32);
+    assert(aa.data[4].data == NULL);
+    printf("Checking XdmcpReallocARRAYofARRAY8 zero fills array...\n");
+    result = XdmcpAllocARRAYofARRAY8(&aa, 48);
+    assert(result == TRUE);
+    assert(aa.length == 48);
+    assert(aa.data[40].data == NULL);
+    XdmcpDisposeARRAYofARRAY8(&aa);
+}
+
+int
+main(int argc, char **argv)
+{
+    TestAllocOversizeArrays();
+    TestZeroFillARRAYofARRAY8();
+
+    exit(0);
+}
diff --git a/libXdmcp/test/Makefile.am b/libXdmcp/test/Makefile.am
new file mode 100644
index 000000000..d86719ed4
--- /dev/null
+++ b/libXdmcp/test/Makefile.am
@@ -0,0 +1,13 @@
+if ENABLE_UNIT_TESTS
+
+check_PROGRAMS = Array
+
+TESTS=$(check_PROGRAMS)
+
+AM_CFLAGS = $(CWARNFLAGS) $(XDMCP_CFLAGS)
+AM_CPPFLAGS = -I$(top_srcdir)/include
+LDADD= $(top_builddir)/libXdmcp.la $(XDMCP_LIBS)
+
+AM_TESTS_ENVIRONMENT = $(XORG_MALLOC_DEBUG_ENV)
+
+endif ENABLE_UNIT_TESTS