From 4f6c97b1d78e2ab5857560a5af9b47ed8790978a Mon Sep 17 00:00:00 2001
From: marha <marha@users.sourceforge.net>
Date: Fri, 20 Aug 2010 17:34:23 +0000
Subject: xserver git update 20/8/2010

---
 xorg-server/fb/fbbits.h                     | 2 +-
 xorg-server/glx/glxcmds.c                   | 7 +++++++
 xorg-server/hw/xfree86/ddc/interpret_edid.c | 2 +-
 xorg-server/render/render.c                 | 8 ++++++++
 4 files changed, 17 insertions(+), 2 deletions(-)

(limited to 'xorg-server')

diff --git a/xorg-server/fb/fbbits.h b/xorg-server/fb/fbbits.h
index 77e792fd7..80a61ddeb 100644
--- a/xorg-server/fb/fbbits.h
+++ b/xorg-server/fb/fbbits.h
@@ -25,7 +25,7 @@
  * underlying datatypes instead of masks
  */
 
-#define isClipped(c,ul,lr)  ((((c) - (ul)) | ((lr) - (c))) & 0x80008000)
+#define isClipped(c,ul,lr)  (((c) | ((c) - (ul)) | ((lr) - (c))) & 0x80008000)
 
 #ifdef HAVE_DIX_CONFIG_H
 #include <dix-config.h>
diff --git a/xorg-server/glx/glxcmds.c b/xorg-server/glx/glxcmds.c
index be1f2c659..fb477fa98 100644
--- a/xorg-server/glx/glxcmds.c
+++ b/xorg-server/glx/glxcmds.c
@@ -491,6 +491,13 @@ __glXGetDrawable(__GLXcontext *glxc, GLXDrawable drawId, ClientPtr client,
 	return pGlxDraw;
     }
 
+    /* No active context and an unknown drawable, bail. */
+    if (glxc == NULL) {
+	    client->errorValue = drawId;
+	    *error = BadMatch;
+	    return NULL;
+    }
+
     /* The drawId wasn't a GLX drawable.  Make sure it's a window and
      * create a GLXWindow for it.  Check that the drawable screen
      * matches the context screen and that the context fbconfig is
diff --git a/xorg-server/hw/xfree86/ddc/interpret_edid.c b/xorg-server/hw/xfree86/ddc/interpret_edid.c
index 7558206cc..d1001a21f 100644
--- a/xorg-server/hw/xfree86/ddc/interpret_edid.c
+++ b/xorg-server/hw/xfree86/ddc/interpret_edid.c
@@ -552,7 +552,7 @@ get_monitor_ranges(Uchar *c, struct monitor_ranges *r)
     r->max_h = MAX_H;
     r->max_clock = 0;
     if(MAX_CLOCK != 0xff) /* is specified? */
-	r->max_clock = MAX_CLOCK * 10;
+	r->max_clock = MAX_CLOCK * 10 + 5;
     if (HAVE_2ND_GTF) {
 	r->gtf_2nd_f = F_2ND_GTF;
 	r->gtf_2nd_c = C_2ND_GTF;
diff --git a/xorg-server/render/render.c b/xorg-server/render/render.c
index cbd70cc7e..623d5db33 100644
--- a/xorg-server/render/render.c
+++ b/xorg-server/render/render.c
@@ -1077,6 +1077,14 @@ ProcRenderAddGlyphs (ClientPtr client)
     gi = (xGlyphInfo *) (gids + nglyphs);
     bits = (CARD8 *) (gi + nglyphs);
     remain -= (sizeof (CARD32) + sizeof (xGlyphInfo)) * nglyphs;
+
+    /* protect against bad nglyphs */
+    if (gi < stuff || gi > ((CARD32 *)stuff + client->req_len) ||
+        bits < stuff || bits > ((CARD32 *)stuff + client->req_len)) {
+        err = BadLength;
+        goto bail;
+    }
+
     for (i = 0; i < nglyphs; i++)
     {
 	size_t padded_width;
-- 
cgit v1.2.3