randrproto fontconfig libfontenc libxcb mesalib xserver pixman xkeyboard-config git update 15 May 2015

xserver          commit bf6344e1913a5d24c2d68eaca999ea3d71e1b707
libxcb           commit cb621341a62e6d2233db3e337611f6fdd4f675a6
libxcb/xcb-proto commit 4c550465934164aab2449a125f75f4ca07816233
xkeyboard-config commit 5da6d510b460cad1b31288618cc364e586576826
libX11           commit d3415d1f052530760b4617db45affcb984cfe35c
libXdmcp         commit b10f382e3aa2e86cd5a2bc27d6758da55f0ab1f6
libXext          commit efdcbb7634501e1117d422636a0a75d7ea84b16b
libfontenc       commit 42f3a39c3085afd9ef904ae39102fd49bbc2e4a5
libXinerama      commit edd95182b26eb5d576d4878c559e0f17dddaa909
libXau           commit 1e4635be11154dd8262f37b379511bd627defa2a
xkbcomp          commit 1ae525b3d236b59e6437b2b5433d460e18370973
pixman           commit 82f9b4faaf1aa63ec26b0dfd227f1a8e5e139ae2
xextproto        commit 66afec3f49e8eb0d4c2e9af7088fc3116d4bafd7
randrproto       commit 895ee5264524c7c239ee4ef5e39c4e295323fb51
glproto          commit bd3d751e1eb17efb39f65093271bb4ac071aa9e0
mkfontscale      commit 87d628f8eec170ec13bb9feefb1ce05aed07d1d6
xwininfo         commit 0c49f8f2bd56b1e77721e81030ea948386dcdf4e
libXft           commit e8a83226bc10afb587f6f34daac44d2ef809c85e
libXmu           commit 4459e6940fe3fdf26a8d5d4c71989498bc400a62
libxtrans        commit 7cbad9fe2e61cd9d5caeaf361826a6f4bd320f03
fontconfig       commit 55ff8419274fd5ce59675f220b85035a3986d6cf
mesa             commit 3687d752e51829b4723c9abb07ae56d2bbcda570

12 files changed, 35 insertions, 30 deletions

diff --git a/xorg-server/Xext/hashtable.c b/xorg-server/Xext/hashtable.c
index 471ecca1c..41b2e0013 100644
--- a/xorg-server/Xext/hashtable.c
+++ b/xorg-server/Xext/hashtable.c
@@ -54,7 +54,7 @@ ht_create(int             keySize,
     ht->elements = 0;
     ht->bucketBits = INITHASHSIZE;
     numBuckets = 1 << ht->bucketBits;
-    ht->buckets = malloc(numBuckets * sizeof(*ht->buckets));
+    ht->buckets = xallocarray(numBuckets, sizeof(*ht->buckets));
     ht->cdata = cdata;
 
     if (ht->buckets) {
@@ -92,7 +92,7 @@ double_size(HashTable ht)
     int newNumBuckets = 1 << newBucketBits;
     int c;
 
-    newBuckets = malloc(newNumBuckets * sizeof(*ht->buckets));
+    newBuckets = xallocarray(newNumBuckets, sizeof(*ht->buckets));
     if (newBuckets) {
         for (c = 0; c < newNumBuckets; ++c) {
             xorg_list_init(&newBuckets[c]);
diff --git a/xorg-server/Xext/panoramiX.c b/xorg-server/Xext/panoramiX.c
index 2bbae2f5e..209df292c 100644
--- a/xorg-server/Xext/panoramiX.c
+++ b/xorg-server/Xext/panoramiX.c
@@ -747,13 +747,13 @@ PanoramiXMaybeAddDepth(DepthPtr pDepth)
 
     j = PanoramiXNumDepths;
     PanoramiXNumDepths++;
-    PanoramiXDepths = realloc(PanoramiXDepths,
-                              PanoramiXNumDepths * sizeof(DepthRec));
+    PanoramiXDepths = reallocarray(PanoramiXDepths,
+                                   PanoramiXNumDepths, sizeof(DepthRec));
     PanoramiXDepths[j].depth = pDepth->depth;
     PanoramiXDepths[j].numVids = 0;
     /* XXX suboptimal, should grow these dynamically */
     if (pDepth->numVids)
-        PanoramiXDepths[j].vids = malloc(sizeof(VisualID) * pDepth->numVids);
+        PanoramiXDepths[j].vids = xallocarray(pDepth->numVids, sizeof(VisualID));
     else
         PanoramiXDepths[j].vids = NULL;
 }
@@ -789,8 +789,8 @@ PanoramiXMaybeAddVisual(VisualPtr pVisual)
     /* found a matching visual on all screens, add it to the subset list */
     j = PanoramiXNumVisuals;
     PanoramiXNumVisuals++;
-    PanoramiXVisuals = realloc(PanoramiXVisuals,
-                               PanoramiXNumVisuals * sizeof(VisualRec));
+    PanoramiXVisuals = reallocarray(PanoramiXVisuals,
+                                    PanoramiXNumVisuals, sizeof(VisualRec));
 
     memcpy(&PanoramiXVisuals[j], pVisual, sizeof(VisualRec));
 
diff --git a/xorg-server/Xext/panoramiXprocs.c b/xorg-server/Xext/panoramiXprocs.c
index 413a66afb..9eb29bd74 100644
--- a/xorg-server/Xext/panoramiXprocs.c
+++ b/xorg-server/Xext/panoramiXprocs.c
@@ -1106,7 +1106,7 @@ PanoramiXCopyArea(ClientPtr client)
         }
 
         pitch = PixmapBytePad(stuff->width, drawables[0]->depth);
-        if (!(data = calloc(1, stuff->height * pitch)))
+        if (!(data = calloc(stuff->height, pitch)))
             return BadAlloc;
 
         XineramaGetImageData(drawables, srcx, srcy,
@@ -1341,7 +1341,7 @@ PanoramiXPolyPoint(ClientPtr client)
     isRoot = (draw->type == XRT_WINDOW) && draw->u.win.root;
     npoint = bytes_to_int32((client->req_len << 2) - sizeof(xPolyPointReq));
     if (npoint > 0) {
-        origPts = malloc(npoint * sizeof(xPoint));
+        origPts = xallocarray(npoint, sizeof(xPoint));
         memcpy((char *) origPts, (char *) &stuff[1], npoint * sizeof(xPoint));
         FOR_NSCREENS_FORWARD(j) {
 
@@ -1406,7 +1406,7 @@ PanoramiXPolyLine(ClientPtr client)
     isRoot = IS_ROOT_DRAWABLE(draw);
     npoint = bytes_to_int32((client->req_len << 2) - sizeof(xPolyLineReq));
     if (npoint > 0) {
-        origPts = malloc(npoint * sizeof(xPoint));
+        origPts = xallocarray(npoint, sizeof(xPoint));
         memcpy((char *) origPts, (char *) &stuff[1], npoint * sizeof(xPoint));
         FOR_NSCREENS_FORWARD(j) {
 
@@ -1475,7 +1475,7 @@ PanoramiXPolySegment(ClientPtr client)
         return BadLength;
     nsegs >>= 3;
     if (nsegs > 0) {
-        origSegs = malloc(nsegs * sizeof(xSegment));
+        origSegs = xallocarray(nsegs, sizeof(xSegment));
         memcpy((char *) origSegs, (char *) &stuff[1], nsegs * sizeof(xSegment));
         FOR_NSCREENS_FORWARD(j) {
 
@@ -1543,7 +1543,7 @@ PanoramiXPolyRectangle(ClientPtr client)
         return BadLength;
     nrects >>= 3;
     if (nrects > 0) {
-        origRecs = malloc(nrects * sizeof(xRectangle));
+        origRecs = xallocarray(nrects, sizeof(xRectangle));
         memcpy((char *) origRecs, (char *) &stuff[1],
                nrects * sizeof(xRectangle));
         FOR_NSCREENS_FORWARD(j) {
@@ -1610,7 +1610,7 @@ PanoramiXPolyArc(ClientPtr client)
         return BadLength;
     narcs /= sizeof(xArc);
     if (narcs > 0) {
-        origArcs = malloc(narcs * sizeof(xArc));
+        origArcs = xallocarray(narcs, sizeof(xArc));
         memcpy((char *) origArcs, (char *) &stuff[1], narcs * sizeof(xArc));
         FOR_NSCREENS_FORWARD(j) {
 
@@ -1672,7 +1672,7 @@ PanoramiXFillPoly(ClientPtr client)
 
     count = bytes_to_int32((client->req_len << 2) - sizeof(xFillPolyReq));
     if (count > 0) {
-        locPts = malloc(count * sizeof(DDXPointRec));
+        locPts = xallocarray(count, sizeof(DDXPointRec));
         memcpy((char *) locPts, (char *) &stuff[1],
                count * sizeof(DDXPointRec));
         FOR_NSCREENS_FORWARD(j) {
@@ -1741,7 +1741,7 @@ PanoramiXPolyFillRectangle(ClientPtr client)
         return BadLength;
     things >>= 3;
     if (things > 0) {
-        origRects = malloc(things * sizeof(xRectangle));
+        origRects = xallocarray(things, sizeof(xRectangle));
         memcpy((char *) origRects, (char *) &stuff[1],
                things * sizeof(xRectangle));
         FOR_NSCREENS_FORWARD(j) {
@@ -1808,7 +1808,7 @@ PanoramiXPolyFillArc(ClientPtr client)
         return BadLength;
     narcs /= sizeof(xArc);
     if (narcs > 0) {
-        origArcs = malloc(narcs * sizeof(xArc));
+        origArcs = xallocarray(narcs, sizeof(xArc));
         memcpy((char *) origArcs, (char *) &stuff[1], narcs * sizeof(xArc));
         FOR_NSCREENS_FORWARD(j) {
 
@@ -1988,8 +1988,7 @@ PanoramiXGetImage(ClientPtr client)
         if (linesPerBuf > h)
             linesPerBuf = h;
     }
-    length = linesPerBuf * widthBytesLine;
-    if (!(pBuf = malloc(length)))
+    if (!(pBuf = xallocarray(linesPerBuf, widthBytesLine)))
         return BadAlloc;
 
     WriteReplyToClient(client, sizeof(xGetImageReply), &xgi);
diff --git a/xorg-server/Xext/saver.c b/xorg-server/Xext/saver.c
index 2c14ea00e..0e20467c9 100644
--- a/xorg-server/Xext/saver.c
+++ b/xorg-server/Xext/saver.c
@@ -853,7 +853,7 @@ ScreenSaverSetAttributes(ClientPtr client)
         goto bail;
     }
     /* over allocate for override redirect */
-    pAttr->values = values = malloc((len + 1) * sizeof(unsigned long));
+    pAttr->values = values = xallocarray(len + 1, sizeof(unsigned long));
     if (!values) {
         ret = BadAlloc;
         goto bail;
diff --git a/xorg-server/Xext/shape.c b/xorg-server/Xext/shape.c
index bb479b159..2fc789ec1 100644
--- a/xorg-server/Xext/shape.c
+++ b/xorg-server/Xext/shape.c
@@ -996,7 +996,7 @@ ProcShapeGetRectangles(ClientPtr client)
 
         nrects = RegionNumRects(region);
         box = RegionRects(region);
-        rects = malloc(nrects * sizeof(xRectangle));
+        rects = xallocarray(nrects, sizeof(xRectangle));
         if (!rects && nrects)
             return BadAlloc;
         for (i = 0; i < nrects; i++, box++) {
diff --git a/xorg-server/Xext/shm.c b/xorg-server/Xext/shm.c
index db9d47450..b359a9035 100644
--- a/xorg-server/Xext/shm.c
+++ b/xorg-server/Xext/shm.c
@@ -260,7 +260,7 @@ ShmDestroyPixmap(PixmapPtr pPixmap)
     pScreen->DestroyPixmap = ShmDestroyPixmap;
 
     if (shmdesc)
-	ShmDetachSegment(shmdesc, pPixmap->drawable.id);
+	ShmDetachSegment(shmdesc, 0);
 
     return ret;
 }
@@ -427,7 +427,7 @@ ProcShmAttach(ClientPtr client)
 
  /*ARGSUSED*/ static int
 ShmDetachSegment(void *value, /* must conform to DeleteType */
-                 XID shmseg)
+                 XID unused)
 {
     ShmDescPtr shmdesc = (ShmDescPtr) value;
     ShmDescPtr *prev;
@@ -971,6 +971,12 @@ ProcPanoramiXShmCreatePixmap(ClientPtr client)
                                                        stuff->offset);
 
         if (pMap) {
+            result = XaceHook(XACE_RESOURCE_ACCESS, client, stuff->pid,
+                              RT_PIXMAP, pMap, RT_NONE, NULL, DixCreateAccess);
+            if (result != Success) {
+                pDraw->pScreen->DestroyPixmap(pMap);
+                return result;
+            }
             dixSetPrivate(&pMap->devPrivates, shmPixmapPrivateKey, shmdesc);
             shmdesc->refcnt++;
             pMap->drawable.serialNumber = NEXT_SERIAL_NUMBER;
diff --git a/xorg-server/Xext/sync.c b/xorg-server/Xext/sync.c
index ba08cd1bb..41405619c 100644
--- a/xorg-server/Xext/sync.c
+++ b/xorg-server/Xext/sync.c
@@ -620,7 +620,7 @@ SyncAwaitTriggerFired(SyncTrigger * pTrigger)
 
     pAwaitUnion = (SyncAwaitUnion *) pAwait->pHeader;
     numwaits = pAwaitUnion->header.num_waitconditions;
-    ppAwait = malloc(numwaits * sizeof(SyncAwait *));
+    ppAwait = xallocarray(numwaits, sizeof(SyncAwait *));
     if (!ppAwait)
         goto bail;
 
@@ -1514,7 +1514,7 @@ SyncAwaitPrologue(ClientPtr client, int items)
     /*  all the memory for the entire await list is allocated
      *  here in one chunk
      */
-    pAwaitUnion = malloc((items + 1) * sizeof(SyncAwaitUnion));
+    pAwaitUnion = xallocarray(items + 1, sizeof(SyncAwaitUnion));
     if (!pAwaitUnion)
         return NULL;
 
diff --git a/xorg-server/Xext/xcmisc.c b/xorg-server/Xext/xcmisc.c
index 1e9101059..ed25650cd 100644
--- a/xorg-server/Xext/xcmisc.c
+++ b/xorg-server/Xext/xcmisc.c
@@ -101,7 +101,7 @@ ProcXCMiscGetXIDList(ClientPtr client)
     if (stuff->count > UINT32_MAX / sizeof(XID))
         return BadAlloc;
 
-    pids = (XID *) malloc(stuff->count * sizeof(XID));
+    pids = xallocarray(stuff->count, sizeof(XID));
     if (!pids) {
         return BadAlloc;
     }
diff --git a/xorg-server/Xext/xf86bigfont.c b/xorg-server/Xext/xf86bigfont.c
index 46b3242d1..95b537170 100644
--- a/xorg-server/Xext/xf86bigfont.c
+++ b/xorg-server/Xext/xf86bigfont.c
@@ -401,7 +401,7 @@ ProcXF86BigfontQueryFont(ClientPtr client)
             }
             else {
 #endif
-                pCI = malloc(nCharInfos * sizeof(xCharInfo));
+                pCI = xallocarray(nCharInfos, sizeof(xCharInfo));
                 if (!pCI)
                     return BadAlloc;
 #ifdef HAS_SHM
@@ -463,7 +463,7 @@ ProcXF86BigfontQueryFont(ClientPtr client)
             if (hashModulus > nCharInfos + 1)
                 hashModulus = nCharInfos + 1;
 
-            tmp = malloc((4 * nCharInfos + 1) * sizeof(CARD16));
+            tmp = xallocarray(4 * nCharInfos + 1, sizeof(CARD16));
             if (!tmp) {
                 if (!pDesc)
                     free(pCI);
diff --git a/xorg-server/Xext/xres.c b/xorg-server/Xext/xres.c
index 273793806..6b87c3ddc 100644
--- a/xorg-server/Xext/xres.c
+++ b/xorg-server/Xext/xres.c
@@ -223,7 +223,7 @@ ProcXResQueryClients(ClientPtr client)
 
     REQUEST_SIZE_MATCH(xXResQueryClientsReq);
 
-    current_clients = malloc(currentMaxClients * sizeof(int));
+    current_clients = xallocarray(currentMaxClients, sizeof(int));
 
     num_clients = 0;
     for (i = 0; i < currentMaxClients; i++) {
diff --git a/xorg-server/Xext/xselinux_label.c b/xorg-server/Xext/xselinux_label.c
index 2c33d1cbf..8559385b9 100644
--- a/xorg-server/Xext/xselinux_label.c
+++ b/xorg-server/Xext/xselinux_label.c
@@ -64,7 +64,7 @@ SELinuxArraySet(SELinuxArrayRec * rec, unsigned key, void *val)
 {
     if (key >= rec->size) {
         /* Need to increase size of array */
-        rec->array = realloc(rec->array, (key + 1) * sizeof(val));
+        rec->array = reallocarray(rec->array, key + 1, sizeof(val));
         if (!rec->array)
             return FALSE;
         memset(rec->array + rec->size, 0, (key - rec->size + 1) * sizeof(val));
diff --git a/xorg-server/Xext/xvmain.c b/xorg-server/Xext/xvmain.c
index 0abf190dc..93e5f0cd3 100644
--- a/xorg-server/Xext/xvmain.c
+++ b/xorg-server/Xext/xvmain.c
@@ -1102,7 +1102,7 @@ XvFillColorKey(DrawablePtr pDraw, CARD32 key, RegionPtr region)
     (void) ChangeGC(NullClient, gc, GCForeground | GCSubwindowMode, pval);
     ValidateGC(pDraw, gc);
 
-    rects = malloc(nbox * sizeof(xRectangle));
+    rects = xallocarray(nbox, sizeof(xRectangle));
     if (rects) {
         for (i = 0; i < nbox; i++, pbox++) {
             rects[i].x = pbox->x1 - pDraw->x;