svn merge ^/branches/released .

5 files changed, 20 insertions, 10 deletions

diff --git a/xorg-server/Xi/exevents.c b/xorg-server/Xi/exevents.c
index 87a40fa66..1232fe363 100644
--- a/xorg-server/Xi/exevents.c
+++ b/xorg-server/Xi/exevents.c
@@ -1612,14 +1612,18 @@ AddExtensionClient(WindowPtr pWin, ClientPtr client, Mask mask, int mskidx)
     if (!others)

 	return BadAlloc;

     if (!pWin->optional->inputMasks && !MakeInputMasks(pWin))

-	return BadAlloc;

+	goto bail;

     others->mask[mskidx] = mask;

     others->resource = FakeClientID(client->index);

     others->next = pWin->optional->inputMasks->inputClients;

     pWin->optional->inputMasks->inputClients = others;

     if (!AddResource(others->resource, RT_INPUTCLIENT, (pointer) pWin))

-	return BadAlloc;

+	goto bail;

     return Success;

+

+bail:

+    free(others);

+    return BadAlloc;

 }

 

 static Bool

diff --git a/xorg-server/Xi/extinit.c b/xorg-server/Xi/extinit.c
index 63f7fca8b..84b0086ff 100644
--- a/xorg-server/Xi/extinit.c
+++ b/xorg-server/Xi/extinit.c
@@ -49,6 +49,7 @@ SOFTWARE.
  *  Dispatch routines and initialization routines for the X input extension.

  *

  */

+#define ARRAY_SIZE(_a)        (sizeof((_a)) / sizeof((_a)[0]))

 

 #define	 NUMTYPES 15

 

@@ -410,7 +411,7 @@ static int
 ProcIDispatch(ClientPtr client)

 {

     REQUEST(xReq);

-    if (stuff->data > (IREQUESTS + XI2REQUESTS) || !ProcIVector[stuff->data])

+    if (stuff->data > ARRAY_SIZE(ProcIVector) || !ProcIVector[stuff->data])

         return BadRequest;

 

     return (*ProcIVector[stuff->data])(client);

@@ -429,7 +430,7 @@ static int
 SProcIDispatch(ClientPtr client)

 {

     REQUEST(xReq);

-    if (stuff->data > IREQUESTS || !SProcIVector[stuff->data])

+    if (stuff->data > ARRAY_SIZE(SProcIVector) || !SProcIVector[stuff->data])

         return BadRequest;

 

     return (*SProcIVector[stuff->data])(client);

@@ -863,6 +864,8 @@ XI2EventSwap(xGenericEvent *from, xGenericEvent *to)
     {

         case XI_Enter:

         case XI_Leave:

+        case XI_FocusIn:

+        case XI_FocusOut:

             SDeviceLeaveNotifyEvent((xXILeaveEvent*)from, (xXILeaveEvent*)to);

             break;

         case XI_DeviceChanged:

diff --git a/xorg-server/Xi/getprop.c b/xorg-server/Xi/getprop.c
index 5be09c685..fbf43f3fd 100644
--- a/xorg-server/Xi/getprop.c
+++ b/xorg-server/Xi/getprop.c
@@ -115,7 +115,7 @@ ProcXGetDeviceDontPropagateList(ClientPtr client)
 

     if ((others = wOtherInputMasks(pWin)) != 0) {

 	for (i = 0; i < EMASKSIZE; i++)

-	    tbuf = ClassFromMask(NULL, others->dontPropagateMask[i], i,

+	    ClassFromMask(NULL, others->dontPropagateMask[i], i,

 				 &count, COUNT);

 	if (count) {

 	    rep.count = count;

diff --git a/xorg-server/Xi/getselev.c b/xorg-server/Xi/getselev.c
index 3b556000c..fb45a0627 100644
--- a/xorg-server/Xi/getselev.c
+++ b/xorg-server/Xi/getselev.c
@@ -118,13 +118,13 @@ ProcXGetSelectedExtensionEvents(ClientPtr client)
     if ((pOthers = wOtherInputMasks(pWin)) != 0) {

 	for (others = pOthers->inputClients; others; others = others->next)

 	    for (i = 0; i < EMASKSIZE; i++)

-		tclient = ClassFromMask(NULL, others->mask[i], i,

+		ClassFromMask(NULL, others->mask[i], i,

 					&rep.all_clients_count, COUNT);

 

 	for (others = pOthers->inputClients; others; others = others->next)

 	    if (SameClient(others, client)) {

 		for (i = 0; i < EMASKSIZE; i++)

-		    tclient = ClassFromMask(NULL, others->mask[i], i,

+		    ClassFromMask(NULL, others->mask[i], i,

 					    &rep.this_client_count, COUNT);

 		break;

 	    }

@@ -152,8 +152,8 @@ ProcXGetSelectedExtensionEvents(ClientPtr client)
     if (total_length) {

 	client->pSwapReplyFunc = (ReplySwapPtr) Swap32Write;

 	WriteSwappedDataToClient(client, total_length, buf);

-	free(buf);

     }

+    free(buf);

     return Success;

 }

 

diff --git a/xorg-server/Xi/xiquerydevice.c b/xorg-server/Xi/xiquerydevice.c
index f8a4eb8a5..7066a1ab9 100644
--- a/xorg-server/Xi/xiquerydevice.c
+++ b/xorg-server/Xi/xiquerydevice.c
@@ -107,8 +107,10 @@ ProcXIQueryDevice(ClientPtr client)
     }

 

     info = calloc(1, len);

-    if (!info)

+    if (!info) {

+        free(skip);

         return BadAlloc;

+    }

 

     memset(&rep, 0, sizeof(xXIQueryDeviceReply));

     rep.repType = X_Reply;

@@ -153,8 +155,9 @@ ProcXIQueryDevice(ClientPtr client)
         }

     }

 

+    len = rep.length * 4;

     WriteReplyToClient(client, sizeof(xXIQueryDeviceReply), &rep);

-    WriteToClient(client, rep.length * 4, ptr);

+    WriteToClient(client, len, ptr);

     free(ptr);

     free(skip);

     return rc;