GitLab

Reported by parfait 1.0:

Error: Memory leak (CWE 401)
   Memory leak of pointer 'newModes' allocated with realloc(((char*)modes), ((num_modes + 1) * 8))
        at line 93 of randr/rrmode.c in function 'RRModeCreate'.
          pointer allocated at line 82 with realloc(((char*)modes), ((num_modes + 1) * 8)).
Error: Memory leak (CWE 401)
   Memory leak of pointer 'newModes' allocated with malloc(8)
        at line 93 of randr/rrmode.c in function 'RRModeCreate'.
          pointer allocated at line 84 with malloc(8).
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Keith Packard <keithp@keithp.com>

Reported by parfait 1.0:

Error: Memory leak (CWE 401)
   Memory leak of pointer 'prop' allocated with RRCreateOutputProperty(property)
        at line 220 of randr/rrproperty.c in function 'RRChangeOutputProperty'.
          'prop' allocated at line 154 with RRCreateOutputProperty(property).
          prop leaks when pending != 0 at line 160.
Error: Memory leak (CWE 401)
   Memory leak of pointer 'prop' allocated with RRCreateOutputProperty(property)
        at line 346 of randr/rrproperty.c in function 'RRConfigureOutputProperty'.
          'prop' allocated at line 334 with RRCreateOutputProperty(property).
        at line 350 of randr/rrproperty.c in function 'RRConfigureOutputProperty'.
          'prop' allocated at line 334 with RRCreateOutputProperty(property).
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Keith Packard <keithp@keithp.com>

Reported by parfait 1.0:

Error: Memory leak (CWE 401)
   Memory leak of pointer 'prop' allocated with RRCreateProviderProperty(property)
        at line 221 of randr/rrproviderproperty.c in function 'RRChangeProviderProperty'.
          'prop' allocated at line 155 with RRCreateProviderProperty(property).
          prop leaks when pending != 0 at line 161.

Error: Memory leak (CWE 401)
   Memory leak of pointer 'prop' allocated with RRCreateProviderProperty(property)
        at line 345 of randr/rrproviderproperty.c in function 'RRConfigureProviderProperty'.
          'prop' allocated at line 333 with RRCreateProviderProperty(property).
        at line 349 of randr/rrproviderproperty.c in function 'RRConfigureProviderProperty'.
          'prop' allocated at line 333 with RRCreateProviderProperty(property).
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Keith Packard <keithp@keithp.com>

The RandR CRTC structures are freed when their resource IDs are
destroyed during server shut down, which is before the screen is
closed. Calling back into RandR with stale pointers just segfaults the
server.
Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Dave Airlie <airlied@redhat.com>
Tested-by: Knut Petersen <knut_petersen@t-online.de>

Panning is at odds with CRTC cursor confinement. This disables CRTC cursor
confinement as long as panning is enabled.

Fixes regression introduced in 56c90e29.
Reviewed-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Rui Matos <tiagomatos@gmail.com>
Signed-off-by: Keith Packard <keithp@keithp.com>

Let's say - purely for the sake of argument, mind you - that you had a
server GPU with anemic memory bandwidth, and you walked up to it and
plugged in a monitor that was 1920x1080 because that's what happened to
be on the crash cart.  Say the memory bandwidth is such that anything
larger than 1280x1024 gets filtered away.  Now you're in trouble,
because the established timings section includes a 720x400 mode because
that's what DOS 80x25 is, and that happens to just about match the
physical aspect ratio.

Instead let's reuse the logic from the existing aspect-match path: pick
the larger mode of either the physical aspect ratio or 4:3.
Reviewed-by: Julien Cristau <jcristau@debian.org>
Signed-off-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Keith Packard <keithp@keithp.com>

This code wasn't allocating enough space and was assigning the NULL
one past the end.

Pointed out by coverity.
Reviewed-by: Jeremy Huddleston <jeremyhu@apple.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Keith Packard <keithp@keithp.com>

Bugzilla: https://bugs.freedesktop.org/25804Reviewed-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Vic Lee <llyzs@163.com>
Signed-off-by: Keith Packard <keithp@keithp.com>

Signed-off-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Keith Packard <keithp@keithp.com>

Reported by parfait 1.0:

Error: Memory leak (CWE 401)
   Memory leak of pointer 'prop' allocated with XICreateDeviceProperty(property)
        at line 774 of Xi/xiproperty.c in function 'XIChangeDeviceProperty'.
          'prop' allocated at line 700 with XICreateDeviceProperty(property).
          prop leaks when handler != NULL at line 768
              and handler->SetProperty != NULL at line 769
              and checkonly != 0 at line 772
              and rc != 0 at line 772.
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>

When the owner of a touch accepts it, the other listeners must
receive a TouchEnd.

Even though there's code implementing the logic above in
ProcessTouchOwnershipEvent(), DeliverTouchEndEvent() was refusing to send
those TouchEnd events in this situatuation.
Signed-off-by: Daniel d'Andrada <daniel.dandrada@canonical.com>
Reviewed-by: Chase Douglas <chase.douglas@canonical.com>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>

With --disable-xorg, We also disabled a bunch of tests because of their
perceived reliance on a DDX. The cause was libtool missing some object files
that never ended up in libxservertest.la. Only the xfree86 test has a true
dependency on XORG.

DIX_LIB was pointing to dix.O (instead of libdix.la) when
DTRACE_SPECIAL_OBJECTS was defined. libdix.la should be part of XSERVER_LIBS
but dix.O is not a recognised libtool object, so it got skipped for
libxservertest.a. Only in the XORG case would we add DIX_LIB and OS_LIB
manually, thus forcing linkage with the dtrace-generated objects.

Fixing this by packaging up the dtrace-generated files as part of
libdix.la/libos.la doesn't work for Solaris (and possible others), so simply
always force linkage against the DIX_LIB/OS_LIB in the case of dtrace objects.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Tested-by: Alan Coopersmith <alan.coopersmith@oracle.com>

Commit 84956ca4 bogusly adds GLX_INTEL_swap_event to the extensions reported
by swrast.

"DRI2 supports this now - and already enables it explicitly - but drisw does
not and should not. Otherwise toolkits like clutter will only ever SwapBuffers
once and wait forever for an event that's not coming."

(A similar bug for direct swrast is already fixed in mesa commit 25620eb1)

(Note that this may be papering over the cracks somewhat, as if we do report
GLX_INTEL_swap_event, some clutter apps fail with GLXBadDrawable calling
GLXChangeDrawableAttributes to change the setting of GLX_BUFFER_SWAP_COMPLETE_INTEL_MASK
in the GLX_EVENT_MASK, apparently after the drawable is destroyed, which suggests
a bug with GLXDrawable lifetimes)
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>

Don't note GLX_INTEL_swap_event as being required by GLX 1.4, it isn't.
(This data is not currently used in the server)

(A similar change is made in mesa commit d3f7597bc9f6d5)
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>

Fix Win32TempDir() in the case where we fell back to checking the TMP
environment variable. It looks like this has been wrong since forever.
Signed-off-by: Colin Harrison <colin.harrison@virgin.net>
Reviewed-by: Jon TURNEY <jon.turney@dronecode.org.uk>

Fix FIXME in fbConfigToPixelFormat() to correctly populate RGBA-mask shift
parameters.  Also request colourindex pixelFormats correctly.

Now that they are requested correctly, don't skip colorindex visuals when
converting pixelFormats to fbConfigs.

Populate transparent colour information when converting pixelFormat from
DescribePixelFormats() to a fbConfig.
Signed-off-by: Marc Haesen <marha@users.sourceforge.net>
Reviewed-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>

Oh this is terrible.

Currently we only compute the select timeout in whole seconds.  This means if we
have less than 1 second remaining, we select with a timeout of 0 (i.e. poll)
which causes the task to spin, burning 100% CPU for the remaining timeout (and
possibly preventing the process we are waiting for from running :S)
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>

Also improve it's debug output a bit
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>

winOverrideIcon() is called from the internal WM client thread.

Accessing server-internal data structures to get icon data or window hints is
not safe, as there is no lock to ensure we do not collide with these data
structures being updated in the server thread.

Rewrite so the internal client thread uses X client calls to obtain this data
safely

We used to also set the icon inside the server when the window was initially
created.  For simplicity, we simply send a message to the internal WM to update
the icon when the window is created (rather than writing different icon update
code which can work in the server thread for that one case...)

extwm mode used to do the icon update in the server. I'm not sure that actually
made much sense.  Let's assume the external WM client can do it instead...

v2
Make sure that WM_WM_ICON_EVENT does nothing for override-redirect windows

v3
Reinstate check that native window actually has expected properties for an X
window before trying to update it's icon; some auxiliary windows owned by the
XWin process don't, which would cause a crash

v4
Various fixes to pixmap icon conversion:
- remove left-over malloc in winScaleXimageToWindowsIcon causing a memory leak
- don't recalculate DDBitmap stride in winScaleXimageToWindowsIcon, when we already have worked it out
- properly check that XGetWindowProperty(NET_WM_ICON) returned some data
- don't try to retrieve WM_HINTS icon_mask if it isn't set
- restore accidentally dropped calculation of effBpp, stride, maskStride of output DDBitmap
- make sure imageMask is zero-initalized before we use it to mask the DDBitmap

v5
Remove a left-over unused variable

v6
Avoid XDestroyImage(NULL) crash if XGetImage failed for icon_pixmap
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>

_NET_WM_ICON property is also considered to decide on the window icon, so also
send a WM_WM_ICON_EVENT message to the WM if the PropertyNotify event is for
_NET_WM_ICON property
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>

WM_WM_HINTS_EVENT only updates the icon, so rename it to WM_WM_ICON_EVENT
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>

Simplify GetWindowName() by moving UTF-8 to wchar conversion out to it's call
site.  This allows us to do extra processing on the window name in future.
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>

Found-by: Tinderbox
Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>

x-selection.m:1502:1: warning: method has no return type specified; defaults to 'id'
      [-Wmissing-method-return-type,Semantic Issue]
- init
^
  (id)
1 warning generated.
Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>

Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>

Various fixes, applied to panoramiX.c in commit 2b266eda, also need applying to pseudoramiX.c:
 Fix panoramiX request and reply swapping
 Set window and screen values in panoramix replies
 Prevent buffer overrun in ProcPanoramiXGetScreenSize

These fixes seem to be necessary in order to compile pseudoramiX.c with gcc

pseudoramiX.c: In function 'ProcPseudoramiXGetState':
pseudoramiX.c:221:56: error: call to 'wrong_size' declared with attribute error: wrong sized variable passed to swap
pseudoramiX.c: In function 'ProcPseudoramiXGetScreenCount':
pseudoramiX.c:250:62: error: call to 'wrong_size' declared with attribute error: wrong sized variable passed to swap
pseudoramiX.c: In function 'ProcPseudoramiXGetScreenSize':
pseudoramiX.c:283:56: error: call to 'wrong_size' declared with attribute error: wrong sized variable passed to swap
pseudoramiX.c:284:57: error: call to 'wrong_size' declared with attribute error: wrong sized variable passed to swap
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>

We've had reports of two copies of the GLX bits, one in the server
and one in libglx.so causing problems, I didn't understand why the
X server needed a copy so drop it, however then we have to fix a missing
GlxExtensionInit that comes from sdksyms, so work around it by moving
that one declaration into a header that sdksyms doesn't scan.

Thanks to Jon Turney for debugging the actual problem.
(copyright header from extinit.h that seems most appropriate put on top).

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=52402Tested-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Daniel Stone <daniel@fooishbar.org>
Tested-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Keith Packard <keithp@keithp.com>

Signed-off-by: Keith Packard <keithp@keithp.com>

Signed-off-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Dave Airlie <airlied@redhat.com>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Daniel Stone <daniel@fooishbar.org>
Acked-by: Aaron Plattner <aplattner@nvidia.com>
Signed-off-by: Keith Packard <keithp@keithp.com>

Signed-off-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Dave Airlie <airlied@redhat.com>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Daniel Stone <daniel@fooishbar.org>
Acked-by: Aaron Plattner <aplattner@nvidia.com>
Signed-off-by: Keith Packard <keithp@keithp.com>

XAA was the only consumer.
Signed-off-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Dave Airlie <airlied@redhat.com>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Daniel Stone <daniel@fooishbar.org>
Acked-by: Aaron Plattner <aplattner@nvidia.com>
Signed-off-by: Keith Packard <keithp@keithp.com>

Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>

"new" is a reserved word in C++.
Signed-off-by: Aaron Plattner <aplattner@nvidia.com>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Signed-off-by: Keith Packard <keithp@keithp.com>

 * GLX is now loaded
 * PseudoramiX loading is back in miinitext.  It needs to be loaded
   before RandR.

Regression-from: 27a624be
Regression-from: 5f5bbbe5Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>

Regression-from: 96d74138Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>

Signed-off-by: Keith Packard <keithp@keithp.com>