diff options
| author | kwm <kwm@FreeBSD.org> | 2015-10-13 07:45:08 +0000 |
|---|---|---|
| committer | kwm <kwm@FreeBSD.org> | 2015-10-13 07:45:08 +0000 |
| commit | d9066e7f81004ea484da8127e425c71fa8f76268 (patch) | |
| tree | 5c1588bcc55dc0d528b29233e0611c59fb10d358 | |
| parent | ecb693545fe45f21a6ebef2b47f8bf526a6fd2c4 (diff) | |
| download | FreeBSD-ports-d9066e7f81004ea484da8127e425c71fa8f76268.zip FreeBSD-ports-d9066e7f81004ea484da8127e425c71fa8f76268.tar.gz | |
Xorg-server update to 1.17.2 with related driver updates and bumps.
Update fontproto to 2.1.3.
Update libXfont to 1.5.1.
Update xf86-input-keyboard 1.8.1.
Update xf86-input-vmmouse to 13.1.0.
Update xf86-input-void to 1.4.1.
Update xf86-video-chips to 1.2.6.
Update xf86-video-cirrus to 1.5.3.
Update xf86-video-mach64 to 6.9.5.
Update xf86-video-neomagic to 1.2.9.
Update xf86-video-r128 to 6.10.0.
Update xf86-video-s3virge to 1.10.7.
Update xf86-video-savage to 2.3.8.
Update xf86-video-siliconmotion to 1.7.8.
Update xf86-video-sis to 0.10.8.
Update xf86-video-trident to 1.3.7.
Update xf86-video-vesa to 2.3.4.
* All other xf86-* drivers where bump and/or patched to allow them to
compile and work with the new xorg-server.
* The ATI-ums driver is removed because the API it depends on was
removed from the xorg-server.
* Add patch to sunffb to make the lack of XAA non-fatal
(not build/run tested due to lack of hardware).
* Remove the extra patches in xorg-server for arm. The code seems to
support it now natively. Please file a bug if this is not the case.
* Update the xorg-server support in virtualbox-ose-additions for vboxmouse. [1]
Submitted by: jkim@ [1]
Obtained from: Graphics devel repo
141 files changed, 377 insertions, 4789 deletions
@@ -7892,3 +7892,4 @@ emulators/ppsspp-devel|emulators/ppsspp|2015-10-06|Out of date: use emulators/pp ports-mgmt/bpm||2015-10-10|No support for pkg www/moodle27||2015-10-11|Has expired: Please upgrade to moodle28 or moodle29 graphics/epeg|devel/efl|2015-10-11|Has expired: Merged into devel/efl +x11-drivers/xf86-video-ati-ums||2015-10-13|Not supported by xorg-server 1.17 diff --git a/Mk/bsd.xorg.mk b/Mk/bsd.xorg.mk index 3b657f4..b280bef 100644 --- a/Mk/bsd.xorg.mk +++ b/Mk/bsd.xorg.mk @@ -59,8 +59,8 @@ USE_XORG+= xorg-macros . if ${XORG_CAT} == "driver" USE_XORG+= xorg-server xproto randrproto xi renderproto xextproto \ - inputproto kbproto fontsproto videoproto dri2proto xf86driproto \ - glproto xineramaproto resourceproto scrnsaverproto + inputproto kbproto fontsproto videoproto dri2proto xf86driproto \ + presentproto glproto xineramaproto resourceproto scrnsaverproto # work around a llvm bug on i386, llvm bug #15806 # reproduced with clang 3.2 (current release) and 3.1 . if ${ARCH} == i386 diff --git a/emulators/virtualbox-ose-additions/Makefile b/emulators/virtualbox-ose-additions/Makefile index e982b6a..6e7f5ca 100644 --- a/emulators/virtualbox-ose-additions/Makefile +++ b/emulators/virtualbox-ose-additions/Makefile @@ -3,6 +3,7 @@ PORTNAME= virtualbox-ose DISTVERSION= 4.3.30 +PORTREVISION= 1 CATEGORIES= emulators MASTER_SITES= http://download.virtualbox.org/virtualbox/${DISTVERSION}/ \ http://tmp.chruetertee.ch/ \ diff --git a/emulators/virtualbox-ose/files/patch-src-VBox-Additions-x11-vboxmouse-Makefile.kmk b/emulators/virtualbox-ose/files/patch-src-VBox-Additions-x11-vboxmouse-Makefile.kmk index c31e476..fd8b280 100644 --- a/emulators/virtualbox-ose/files/patch-src-VBox-Additions-x11-vboxmouse-Makefile.kmk +++ b/emulators/virtualbox-ose/files/patch-src-VBox-Additions-x11-vboxmouse-Makefile.kmk @@ -1,6 +1,6 @@ ---- src/VBox/Additions/x11/vboxmouse/Makefile.kmk.orig 2014-11-21 10:16:53.000000000 -0500 -+++ src/VBox/Additions/x11/vboxmouse/Makefile.kmk 2014-12-10 14:10:02.000000000 -0500 -@@ -236,6 +236,50 @@ +--- src/VBox/Additions/x11/vboxmouse/Makefile.kmk.orig 2015-07-10 16:27:59.000000000 +0200 ++++ src/VBox/Additions/x11/vboxmouse/Makefile.kmk 2015-10-13 08:40:36.448907000 +0200 +@@ -228,6 +228,61 @@ vboxmouse_drv_112_SOURCES = \ vboxmouse.c @@ -48,15 +48,26 @@ +vboxmouse_drv_116_SOURCES = \ + vboxmouse.c + ++DLLS += vboxmouse_drv_117 ++vboxmouse_drv_117_TEMPLATE = VBOXGUESTR3XORGMOD ++vboxmouse_drv_117_DEFS := $(vboxmouse_drv_70_DEFS) NO_ANSIC ++## @todo replace $(VBOX_PATH_X11_ROOT)/xorg-server-1.6.0-local ++vboxmouse_drv_117_INCS := \ ++ $(vboxmouse_xorg_INCS) \ ++ $(VBOX_PATH_X11_ROOT)/xorg-server-1.17.1 \ ++ $(PATH_SUB_CURRENT) ++vboxmouse_drv_117_SOURCES = \ ++ vboxmouse.c ++ endif # neq ($(KBUILD_TARGET),linux) -@@ -284,7 +328,7 @@ +@@ -276,7 +331,7 @@ $(foreach ver, _70 _71 _13 _14 _15 _16, $(eval $(def_vboxmouse_test))) ifneq ($(KBUILD_TARGET), linux) - $(foreach ver, _17 _18 _19 _110 _111 _112 _113, $(eval $(def_vboxmouse_test))) -+ $(foreach ver, _17 _18 _19 _110 _111 _112 _113 _114 _115 _116, $(eval $(def_vboxmouse_test))) ++ $(foreach ver, _17 _18 _19 _110 _111 _112 _113 _114 _115 _116 _117, $(eval $(def_vboxmouse_test))) endif # neq ($(KBUILD_TARGET),linux) diff --git a/x11-drivers/Makefile b/x11-drivers/Makefile index 2014734..5706acd 100644 --- a/x11-drivers/Makefile +++ b/x11-drivers/Makefile @@ -22,7 +22,6 @@ SUBDIR += xf86-video-apm SUBDIR += xf86-video-ark SUBDIR += xf86-video-ati - SUBDIR += xf86-video-ati-ums SUBDIR += xf86-video-chips SUBDIR += xf86-video-cirrus SUBDIR += xf86-video-dummy diff --git a/x11-drivers/xf86-input-acecad/Makefile b/x11-drivers/xf86-input-acecad/Makefile index 07901d6..3c7a395 100644 --- a/x11-drivers/xf86-input-acecad/Makefile +++ b/x11-drivers/xf86-input-acecad/Makefile @@ -2,7 +2,7 @@ PORTNAME= xf86-input-acecad PORTVERSION= 1.5.0 -PORTREVISION= 5 +PORTREVISION= 6 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-input-egalax/Makefile b/x11-drivers/xf86-input-egalax/Makefile index 15a0f73..917eb59 100644 --- a/x11-drivers/xf86-input-egalax/Makefile +++ b/x11-drivers/xf86-input-egalax/Makefile @@ -3,6 +3,7 @@ PORTNAME= xf86-input-egalax PORTVERSION= 0.3 +PORTREVISION= 1 CATEGORIES= x11-drivers MAINTAINER= glebius@FreeBSD.org @@ -18,7 +19,8 @@ LICENSE= BSD2CLAUSE GNU_CONFIGURE= yes USES= autoreconf libtool pkgconfig USE_XORG= xorg-server xproto xi inputproto xf86driproto glproto \ - randrproto renderproto resourceproto scrnsaverproto xorg-macros + randrproto renderproto resourceproto scrnsaverproto \ + xorg-macros presentproto CONFIGURE_ENV= DRIVER_MAN_SUFFIX=4x DRIVER_MAN_DIR='$$(mandir)/man4' INSTALL_TARGET= install-strip diff --git a/x11-drivers/xf86-input-elographics/Makefile b/x11-drivers/xf86-input-elographics/Makefile index ae0699d..843b5df 100644 --- a/x11-drivers/xf86-input-elographics/Makefile +++ b/x11-drivers/xf86-input-elographics/Makefile @@ -2,7 +2,7 @@ PORTNAME= xf86-input-elographics PORTVERSION= 1.4.1 -PORTREVISION= 3 +PORTREVISION= 4 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-input-evdev/Makefile b/x11-drivers/xf86-input-evdev/Makefile index 44e7f0f..3c89199 100644 --- a/x11-drivers/xf86-input-evdev/Makefile +++ b/x11-drivers/xf86-input-evdev/Makefile @@ -2,6 +2,7 @@ PORTNAME= xf86-input-evdev PORTVERSION= 2.9.2 +PORTREVISION= 1 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-input-fpit/Makefile b/x11-drivers/xf86-input-fpit/Makefile index 09a989e..3236933 100644 --- a/x11-drivers/xf86-input-fpit/Makefile +++ b/x11-drivers/xf86-input-fpit/Makefile @@ -2,7 +2,7 @@ PORTNAME= xf86-input-fpit PORTVERSION= 1.4.0 -PORTREVISION= 5 +PORTREVISION= 6 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-input-hyperpen/Makefile b/x11-drivers/xf86-input-hyperpen/Makefile index 0c26876..4d06099 100644 --- a/x11-drivers/xf86-input-hyperpen/Makefile +++ b/x11-drivers/xf86-input-hyperpen/Makefile @@ -2,7 +2,7 @@ PORTNAME= xf86-input-hyperpen PORTVERSION= 1.4.1 -PORTREVISION= 3 +PORTREVISION= 4 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-input-joystick/Makefile b/x11-drivers/xf86-input-joystick/Makefile index 0514a0c..52bb4c5 100644 --- a/x11-drivers/xf86-input-joystick/Makefile +++ b/x11-drivers/xf86-input-joystick/Makefile @@ -2,7 +2,7 @@ PORTNAME= xf86-input-joystick PORTVERSION= 1.6.2 -PORTREVISION= 3 +PORTREVISION= 4 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-input-keyboard/Makefile b/x11-drivers/xf86-input-keyboard/Makefile index 23bdd4b..4b9636d 100644 --- a/x11-drivers/xf86-input-keyboard/Makefile +++ b/x11-drivers/xf86-input-keyboard/Makefile @@ -1,8 +1,7 @@ # $FreeBSD$ PORTNAME= xf86-input-keyboard -PORTVERSION= 1.8.0 -PORTREVISION= 7 +PORTVERSION= 1.8.1 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-input-keyboard/distinfo b/x11-drivers/xf86-input-keyboard/distinfo index 158af29..5179c5d 100644 --- a/x11-drivers/xf86-input-keyboard/distinfo +++ b/x11-drivers/xf86-input-keyboard/distinfo @@ -1,2 +1,2 @@ -SHA256 (xorg/driver/xf86-input-keyboard-1.8.0.tar.bz2) = 41c51c4e0a87aad6a1c4973c68a8de23b61162d0223f4ab36c627c307830cb5b -SIZE (xorg/driver/xf86-input-keyboard-1.8.0.tar.bz2) = 323838 +SHA256 (xorg/driver/xf86-input-keyboard-1.8.1.tar.bz2) = 1ac8ff39bf9da7d2fc7fd6c24515726e8138340c0518ab8c606e008cf93ca211 +SIZE (xorg/driver/xf86-input-keyboard-1.8.1.tar.bz2) = 319232 diff --git a/x11-drivers/xf86-input-mouse/Makefile b/x11-drivers/xf86-input-mouse/Makefile index e84acae..c883d3a 100644 --- a/x11-drivers/xf86-input-mouse/Makefile +++ b/x11-drivers/xf86-input-mouse/Makefile @@ -2,6 +2,7 @@ PORTNAME= xf86-input-mouse PORTVERSION= 1.9.1 +PORTREVISION= 1 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-input-mutouch/Makefile b/x11-drivers/xf86-input-mutouch/Makefile index 0a54bf4..3944364 100644 --- a/x11-drivers/xf86-input-mutouch/Makefile +++ b/x11-drivers/xf86-input-mutouch/Makefile @@ -2,7 +2,7 @@ PORTNAME= xf86-input-mutouch PORTVERSION= 1.3.0 -PORTREVISION= 3 +PORTREVISION= 4 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-input-penmount/Makefile b/x11-drivers/xf86-input-penmount/Makefile index e0d77ee..7fbdb9d 100644 --- a/x11-drivers/xf86-input-penmount/Makefile +++ b/x11-drivers/xf86-input-penmount/Makefile @@ -2,7 +2,7 @@ PORTNAME= xf86-input-penmount PORTVERSION= 1.5.0 -PORTREVISION= 3 +PORTREVISION= 4 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-input-synaptics/Makefile b/x11-drivers/xf86-input-synaptics/Makefile index b6e5f64..de7eb03 100644 --- a/x11-drivers/xf86-input-synaptics/Makefile +++ b/x11-drivers/xf86-input-synaptics/Makefile @@ -2,6 +2,7 @@ PORTNAME= xf86-input-synaptics PORTVERSION= 1.8.2 +PORTREVISION= 1 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-input-vmmouse/Makefile b/x11-drivers/xf86-input-vmmouse/Makefile index 63ac525..863522e 100644 --- a/x11-drivers/xf86-input-vmmouse/Makefile +++ b/x11-drivers/xf86-input-vmmouse/Makefile @@ -2,8 +2,7 @@ # $FreeBSD$ PORTNAME= xf86-input-vmmouse -PORTVERSION= 13.0.0 -PORTREVISION= 5 +PORTVERSION= 13.1.0 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-input-vmmouse/distinfo b/x11-drivers/xf86-input-vmmouse/distinfo index 0445b6b..3007159 100644 --- a/x11-drivers/xf86-input-vmmouse/distinfo +++ b/x11-drivers/xf86-input-vmmouse/distinfo @@ -1,2 +1,2 @@ -SHA256 (xorg/driver/xf86-input-vmmouse-13.0.0.tar.bz2) = 04cfb60366008d4db815c550d8fb8d0a4270c75fa7a20fa3bddc9ecbd355612c -SIZE (xorg/driver/xf86-input-vmmouse-13.0.0.tar.bz2) = 314269 +SHA256 (xorg/driver/xf86-input-vmmouse-13.1.0.tar.bz2) = 0af558957ac1be1b2863712c2475de8f4d7f14921fd01ded2e2fde4921b19319 +SIZE (xorg/driver/xf86-input-vmmouse-13.1.0.tar.bz2) = 319188 diff --git a/x11-drivers/xf86-input-vmmouse/pkg-plist b/x11-drivers/xf86-input-vmmouse/pkg-plist index 142e1cf..b5d9fc7 100644 --- a/x11-drivers/xf86-input-vmmouse/pkg-plist +++ b/x11-drivers/xf86-input-vmmouse/pkg-plist @@ -1,5 +1,6 @@ bin/vmmouse_detect libexec/hal/scripts/hal-probe-vmmouse +@comment lib/udev/rules.d/69-xorg-vmmouse.rules lib/xorg/modules/input/vmmouse_drv.so man/man1/vmmouse_detect.1.gz man/man4/vmmouse.4x.gz diff --git a/x11-drivers/xf86-input-void/Makefile b/x11-drivers/xf86-input-void/Makefile index 6f6aa9c..cba1719 100644 --- a/x11-drivers/xf86-input-void/Makefile +++ b/x11-drivers/xf86-input-void/Makefile @@ -1,8 +1,7 @@ # $FreeBSD$ PORTNAME= xf86-input-void -PORTVERSION= 1.4.0 -PORTREVISION= 3 +PORTVERSION= 1.4.1 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-input-void/distinfo b/x11-drivers/xf86-input-void/distinfo index 5787ac7..9157858 100644 --- a/x11-drivers/xf86-input-void/distinfo +++ b/x11-drivers/xf86-input-void/distinfo @@ -1,2 +1,2 @@ -SHA256 (xorg/driver/xf86-input-void-1.4.0.tar.bz2) = 2ab95865252c64cc88050fa0089a74e063c357b71907bf9be7886047c4987505 -SIZE (xorg/driver/xf86-input-void-1.4.0.tar.bz2) = 273454 +SHA256 (xorg/driver/xf86-input-void-1.4.1.tar.bz2) = f96e4f0a622821bf43a74bd419f2a18423343996c9d243c7e1430ba2d142339c +SIZE (xorg/driver/xf86-input-void-1.4.1.tar.bz2) = 271597 diff --git a/x11-drivers/xf86-input-wacom/Makefile b/x11-drivers/xf86-input-wacom/Makefile index 2685a2c..acb2279 100644 --- a/x11-drivers/xf86-input-wacom/Makefile +++ b/x11-drivers/xf86-input-wacom/Makefile @@ -2,7 +2,7 @@ PORTNAME= xf86-input-wacom PORTVERSION= 0.31.0 -PORTREVISION= 1 +PORTREVISION= 2 CATEGORIES= x11-drivers MASTER_SITES= SF/linuxwacom/${PORTNAME} diff --git a/x11-drivers/xf86-video-apm/Makefile b/x11-drivers/xf86-video-apm/Makefile index 628dd5e..f1b5628 100644 --- a/x11-drivers/xf86-video-apm/Makefile +++ b/x11-drivers/xf86-video-apm/Makefile @@ -2,7 +2,7 @@ PORTNAME= xf86-video-apm PORTVERSION= 1.2.5 -PORTREVISION= 5 +PORTREVISION= 6 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-video-ark/Makefile b/x11-drivers/xf86-video-ark/Makefile index 4c5b279..44c72386 100644 --- a/x11-drivers/xf86-video-ark/Makefile +++ b/x11-drivers/xf86-video-ark/Makefile @@ -2,7 +2,7 @@ PORTNAME= xf86-video-ark PORTVERSION= 0.7.5 -PORTREVISION= 5 +PORTREVISION= 6 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-video-ati-ums/Makefile b/x11-drivers/xf86-video-ati-ums/Makefile deleted file mode 100644 index 37ecc71..0000000 --- a/x11-drivers/xf86-video-ati-ums/Makefile +++ /dev/null @@ -1,19 +0,0 @@ -# $FreeBSD$ - -PORTNAME= xf86-video-ati -PORTVERSION= 6.14.6 -PORTREVISION= 5 -PKGNAMESUFFIX= -ums -CATEGORIES= x11-drivers - -MAINTAINER= x11@FreeBSD.org -COMMENT= X.Org ati display driver - -USE_GL= gl -XORG_CAT= driver -USE_XORG= xf86driproto xineramaproto xf86miscproto glproto - -CONFIGURE_ARGS+=--disable-kms -INSTALL_TARGET= install-strip - -.include <bsd.port.mk> diff --git a/x11-drivers/xf86-video-ati-ums/distinfo b/x11-drivers/xf86-video-ati-ums/distinfo deleted file mode 100644 index baa6ed5..0000000 --- a/x11-drivers/xf86-video-ati-ums/distinfo +++ /dev/null @@ -1,2 +0,0 @@ -SHA256 (xorg/driver/xf86-video-ati-6.14.6.tar.bz2) = aa5286b3e4f0187d7df14785c06dd800255d9405205dbf061da5d77df86bec36 -SIZE (xorg/driver/xf86-video-ati-6.14.6.tar.bz2) = 1139495 diff --git a/x11-drivers/xf86-video-ati-ums/files/patch-configure b/x11-drivers/xf86-video-ati-ums/files/patch-configure deleted file mode 100644 index bfb78a3..0000000 --- a/x11-drivers/xf86-video-ati-ums/files/patch-configure +++ /dev/null @@ -1,13 +0,0 @@ ---- configure.orig 2012-06-29 13:47:16 UTC -+++ configure -@@ -17642,10 +17642,6 @@ else - fi - - -- --$as_echo "#define USE_XAA 1" >>confdefs.h -- -- - # Properly handle EXA. - { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether to enable EXA support" >&5 - $as_echo_n "checking whether to enable EXA support... " >&6; } diff --git a/x11-drivers/xf86-video-ati-ums/files/patch-configure.ac b/x11-drivers/xf86-video-ati-ums/files/patch-configure.ac deleted file mode 100644 index 0f28018..0000000 --- a/x11-drivers/xf86-video-ati-ums/files/patch-configure.ac +++ /dev/null @@ -1,11 +0,0 @@ ---- configure.ac.orig 2012-06-29 13:46:11 UTC -+++ configure.ac -@@ -163,8 +163,6 @@ fi - AM_CONDITIONAL(DRM_MODE, test x$DRM_MODE = xyes) - AM_CONDITIONAL(LIBUDEV, test x$LIBUDEV = xyes) - --AC_DEFINE(USE_XAA, 1, [Build support for XAA]) -- - # Properly handle EXA. - AC_MSG_CHECKING([whether to enable EXA support]) - if test "x$EXA" = xyes; then diff --git a/x11-drivers/xf86-video-ati-ums/files/patch-src__radeon_dri2.c b/x11-drivers/xf86-video-ati-ums/files/patch-src__radeon_dri2.c deleted file mode 100644 index 144b7de..0000000 --- a/x11-drivers/xf86-video-ati-ums/files/patch-src__radeon_dri2.c +++ /dev/null @@ -1,11 +0,0 @@ ---- src/radeon_dri2.c.orig 2012-06-25 08:19:41 UTC -+++ src/radeon_dri2.c -@@ -590,7 +590,7 @@ static void - radeon_dri2_client_state_changed(CallbackListPtr *ClientStateCallback, pointer data, pointer calldata) - { - DRI2ClientEventsPtr pClientEventsPriv; -- DRI2FrameEventPtr ref; -+ DRI2FrameEventPtr ref = NULL; - NewClientInfoRec *clientinfo = calldata; - ClientPtr pClient = clientinfo->client; - pClientEventsPriv = GetDRI2ClientEvents(pClient); diff --git a/x11-drivers/xf86-video-ati-ums/files/patch-src_radeon__driver.c b/x11-drivers/xf86-video-ati-ums/files/patch-src_radeon__driver.c deleted file mode 100644 index d00590c..0000000 --- a/x11-drivers/xf86-video-ati-ums/files/patch-src_radeon__driver.c +++ /dev/null @@ -1,10 +0,0 @@ ---- src/radeon_driver.c.orig 2012-06-25 08:19:41 UTC -+++ src/radeon_driver.c -@@ -3756,7 +3756,6 @@ Bool RADEONScreenInit(SCREEN_INIT_ARGS_D - /* Backing store setup */ - xf86DrvMsgVerb(pScrn->scrnIndex, X_INFO, RADEON_LOGLEVEL_DEBUG, - "Initializing backing store\n"); -- miInitializeBackingStore(pScreen); - xf86SetBackingStore(pScreen); - - /* DRI finalisation */ diff --git a/x11-drivers/xf86-video-ati-ums/files/patch-src_radeon_accel.c b/x11-drivers/xf86-video-ati-ums/files/patch-src_radeon_accel.c deleted file mode 100644 index 73d311a..0000000 --- a/x11-drivers/xf86-video-ati-ums/files/patch-src_radeon_accel.c +++ /dev/null @@ -1,15 +0,0 @@ ---- src/radeon_accel.c.orig 2012-06-25 10:19:41.000000000 +0200 -+++ src/radeon_accel.c 2012-07-30 02:11:51.000000000 +0200 -@@ -967,10 +967,9 @@ - - for (; nwords > 0; --nwords, ++d, ++s) - #ifdef __powerpc__ -- asm volatile("stwbrx %0,0,%1" : : "r" (*s), "r" (d)); -+ asm volatile("sthbrx %0,0,%1" : : "r" (*s), "r" (d)); - #else -- *d = ((*s >> 24) & 0xff) | ((*s >> 8) & 0xff00) -- | ((*s & 0xff00) << 8) | ((*s & 0xff) << 24); -+ *d = (*s >> 8) | (*s << 8); - #endif - return; - } diff --git a/x11-drivers/xf86-video-ati-ums/pkg-descr b/x11-drivers/xf86-video-ati-ums/pkg-descr deleted file mode 100644 index fe1b01b..0000000 --- a/x11-drivers/xf86-video-ati-ums/pkg-descr +++ /dev/null @@ -1 +0,0 @@ -This package contains the X.Org xf86-video-ati driver. diff --git a/x11-drivers/xf86-video-ati-ums/pkg-plist b/x11-drivers/xf86-video-ati-ums/pkg-plist deleted file mode 100644 index f2276d0..0000000 --- a/x11-drivers/xf86-video-ati-ums/pkg-plist +++ /dev/null @@ -1,7 +0,0 @@ -lib/xorg/modules/drivers/ati_drv.so -lib/xorg/modules/drivers/radeon_drv.so -lib/xorg/modules/multimedia/theatre200_drv.so -lib/xorg/modules/multimedia/theatre_detect_drv.so -lib/xorg/modules/multimedia/theatre_drv.so -man/man4/ati.4x.gz -man/man4/radeon.4x.gz diff --git a/x11-drivers/xf86-video-ati/Makefile b/x11-drivers/xf86-video-ati/Makefile index 3f7cb43..16904db 100644 --- a/x11-drivers/xf86-video-ati/Makefile +++ b/x11-drivers/xf86-video-ati/Makefile @@ -2,7 +2,7 @@ PORTNAME= xf86-video-ati PORTVERSION= 7.5.0 -PORTREVISION= 2 +PORTREVISION= 3 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-video-chips/Makefile b/x11-drivers/xf86-video-chips/Makefile index defe938..7618f85 100644 --- a/x11-drivers/xf86-video-chips/Makefile +++ b/x11-drivers/xf86-video-chips/Makefile @@ -1,8 +1,7 @@ # $FreeBSD$ PORTNAME= xf86-video-chips -PORTVERSION= 1.2.5 -PORTREVISION= 5 +PORTVERSION= 1.2.6 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-video-chips/distinfo b/x11-drivers/xf86-video-chips/distinfo index a6eb707..287632a 100644 --- a/x11-drivers/xf86-video-chips/distinfo +++ b/x11-drivers/xf86-video-chips/distinfo @@ -1,2 +1,2 @@ -SHA256 (xorg/driver/xf86-video-chips-1.2.5.tar.bz2) = 8d3c744d035b3d769049647bb8022ec24500d31b1b224cd0ea4efe61f86bfed2 -SIZE (xorg/driver/xf86-video-chips-1.2.5.tar.bz2) = 398804 +SHA256 (xorg/driver/xf86-video-chips-1.2.6.tar.bz2) = 99aef5cf9f58391eefab5b4983814f417fd1cf2e4a0f93564de1e9bd75636b1c +SIZE (xorg/driver/xf86-video-chips-1.2.6.tar.bz2) = 413528 diff --git a/x11-drivers/xf86-video-chips/files/patch-src_ct__driver.c b/x11-drivers/xf86-video-chips/files/patch-src_ct__driver.c deleted file mode 100644 index 2737a0f..0000000 --- a/x11-drivers/xf86-video-chips/files/patch-src_ct__driver.c +++ /dev/null @@ -1,28 +0,0 @@ ---- src/ct_driver.c.orig 2012-07-16 03:35:59 UTC -+++ src/ct_driver.c -@@ -96,9 +96,6 @@ - /* All drivers initialising the SW cursor need this */ - #include "mipointer.h" - --/* All drivers implementing backing store need this */ --#include "mibstore.h" -- - /* All drivers using the mi banking wrapper need this */ - #ifdef HAVE_ISA - #include "mibank.h" -@@ -4145,7 +4142,6 @@ CHIPSScreenInit(SCREEN_INIT_ARGS_DECL) - pBankInfo = NULL; - return FALSE; - } -- miInitializeBackingStore(pScreen); - xf86SetBackingStore(pScreen); - - /* Initialise cursor functions */ -@@ -4296,7 +4292,6 @@ CHIPSScreenInit(SCREEN_INIT_ARGS_DECL) - } - } - -- miInitializeBackingStore(pScreen); - xf86SetBackingStore(pScreen); - #ifdef ENABLE_SILKEN_MOUSE - xf86SetSilkenMouse(pScreen); diff --git a/x11-drivers/xf86-video-chips/files/patch-util_Makefile.am b/x11-drivers/xf86-video-chips/files/patch-util_Makefile.am deleted file mode 100644 index 2ec5982..0000000 --- a/x11-drivers/xf86-video-chips/files/patch-util_Makefile.am +++ /dev/null @@ -1,13 +0,0 @@ ---- util/Makefile.am.orig 2013-03-25 20:49:28.885754151 +0100 -+++ util/Makefile.am 2013-03-25 20:50:10.467748226 +0100 -@@ -3,7 +3,7 @@ - noinst_PROGRAMS = dRegs mRegs modClock memClock - endif - --dRegs_SOURCES = dRegs.c AsmMacros.h --mRegs_SOURCES = mRegs.c AsmMacros.h --modClock_SOURCES = modClock.c AsmMacros.h -+dRegs_SOURCES = dRegs.c AsmMacros.h iopl.h -+mRegs_SOURCES = mRegs.c AsmMacros.h iopl.h -+modClock_SOURCES = modClock.c AsmMacros.h iopl.h - memClock_SOURCES = modClock.c AsmMacros.h diff --git a/x11-drivers/xf86-video-chips/files/patch-util_Makefile.in b/x11-drivers/xf86-video-chips/files/patch-util_Makefile.in deleted file mode 100644 index b8d9624..0000000 --- a/x11-drivers/xf86-video-chips/files/patch-util_Makefile.in +++ /dev/null @@ -1,15 +0,0 @@ ---- util/Makefile.in.orig 2013-03-25 20:50:53.827746698 +0100 -+++ util/Makefile.in 2013-03-25 20:50:55.499747558 +0100 -@@ -238,9 +238,9 @@ - top_build_prefix = @top_build_prefix@ - top_builddir = @top_builddir@ - top_srcdir = @top_srcdir@ --dRegs_SOURCES = dRegs.c AsmMacros.h --mRegs_SOURCES = mRegs.c AsmMacros.h --modClock_SOURCES = modClock.c AsmMacros.h -+dRegs_SOURCES = dRegs.c AsmMacros.h iopl.h -+mRegs_SOURCES = mRegs.c AsmMacros.h iopl.h -+modClock_SOURCES = modClock.c AsmMacros.h iopl.h - memClock_SOURCES = modClock.c AsmMacros.h - all: all-am - diff --git a/x11-drivers/xf86-video-chips/files/patch-util_iopl.h b/x11-drivers/xf86-video-chips/files/patch-util_iopl.h deleted file mode 100644 index 50db4d1..0000000 --- a/x11-drivers/xf86-video-chips/files/patch-util_iopl.h +++ /dev/null @@ -1,63 +0,0 @@ ---- util/iopl.h.orig 2013-03-25 20:48:15.486758154 +0100 -+++ util/iopl.h 2013-03-25 20:47:56.000000000 +0100 -@@ -0,0 +1,60 @@ -+#ifdef __NetBSD__ -+# include <sys/types.h> -+# include <machine/pio.h> -+# include <machine/sysarch.h> -+#else -+# if defined(__linux__) -+/* Can't because <sys/iopl.h> provides conflicting inb, outb, etc -+ * # include <sys/io.h> -+ */ -+int iopl(int level); -+# endif -+# if defined(SVR4) && defined(i386) -+# include <sys/types.h> -+# ifdef NCR -+ /* broken NCR <sys/sysi86.h> */ -+# define __STDC -+# include <sys/sysi86.h> -+# undef __STDC -+# else -+# include <sys/sysi86.h> -+# endif -+# ifdef SVR4 -+# if !defined(sun) -+# include <sys/seg.h> -+# endif -+# endif -+# include <sys/v86.h> -+# if defined(sun) -+# include <sys/psw.h> -+# endif -+# endif -+# include "AsmMacros.h" -+#endif /* NetBSD */ -+ -+#include <unistd.h> -+#include <stdio.h> -+#include <stdlib.h> -+ -+#ifdef __NetBSD__ -+# define SET_IOPL() i386_iopl(3) -+# define RESET_IOPL() i386_iopl(0) -+#else -+# if defined(SVR4) && defined(i386) -+# ifndef SI86IOPL -+# define SET_IOPL() sysi86(SI86V86,V86SC_IOPL,PS_IOPL) -+# define RESET_IOPL() sysi86(SI86V86,V86SC_IOPL,0) -+# else -+# define SET_IOPL() sysi86(SI86IOPL,3) -+# define RESET_IOPL() sysi86(SI86IOPL,0) -+# endif -+# else -+# ifdef linux -+# define SET_IOPL() iopl(3) -+# define RESET_IOPL() iopl(0) -+# else -+# define SET_IOPL() (void)0 -+# define RESET_IOPL() (void)0 -+# endif -+# endif -+#endif diff --git a/x11-drivers/xf86-video-cirrus/Makefile b/x11-drivers/xf86-video-cirrus/Makefile index ac2b50e..fbc8d9b 100644 --- a/x11-drivers/xf86-video-cirrus/Makefile +++ b/x11-drivers/xf86-video-cirrus/Makefile @@ -1,8 +1,7 @@ # $FreeBSD$ PORTNAME= xf86-video-cirrus -PORTVERSION= 1.5.2 -PORTREVISION= 5 +PORTVERSION= 1.5.3 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-video-cirrus/distinfo b/x11-drivers/xf86-video-cirrus/distinfo index cd297e4..4360800 100644 --- a/x11-drivers/xf86-video-cirrus/distinfo +++ b/x11-drivers/xf86-video-cirrus/distinfo @@ -1,2 +1,2 @@ -SHA256 (xorg/driver/xf86-video-cirrus-1.5.2.tar.bz2) = 3361e1a65d9b84c464752fd612bdf6087622c6dd204121715366a170e5c3ccd7 -SIZE (xorg/driver/xf86-video-cirrus-1.5.2.tar.bz2) = 327547 +SHA256 (xorg/driver/xf86-video-cirrus-1.5.3.tar.bz2) = edc87b20a55259126b5239b5c1ef913419eab7ded0ed12ae9ae989460d7351ab +SIZE (xorg/driver/xf86-video-cirrus-1.5.3.tar.bz2) = 338930 diff --git a/x11-drivers/xf86-video-dummy/Makefile b/x11-drivers/xf86-video-dummy/Makefile index d0f9426..14de282 100644 --- a/x11-drivers/xf86-video-dummy/Makefile +++ b/x11-drivers/xf86-video-dummy/Makefile @@ -2,7 +2,7 @@ PORTNAME= xf86-video-dummy PORTVERSION= 0.3.7 -PORTREVISION= 5 +PORTREVISION= 6 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-video-fbdev/Makefile b/x11-drivers/xf86-video-fbdev/Makefile index 5b3ae50..73457eb 100644 --- a/x11-drivers/xf86-video-fbdev/Makefile +++ b/x11-drivers/xf86-video-fbdev/Makefile @@ -2,7 +2,7 @@ PORTNAME= xf86-video-fbdev PORTVERSION= 0.4.4 -PORTREVISION= 6 +PORTREVISION= 7 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-video-glint/Makefile b/x11-drivers/xf86-video-glint/Makefile index 89e7c3a..f8ac400 100644 --- a/x11-drivers/xf86-video-glint/Makefile +++ b/x11-drivers/xf86-video-glint/Makefile @@ -2,7 +2,7 @@ PORTNAME= xf86-video-glint PORTVERSION= 1.2.8 -PORTREVISION= 5 +PORTREVISION= 6 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-video-i128/Makefile b/x11-drivers/xf86-video-i128/Makefile index e4d8538..dad6c5b 100644 --- a/x11-drivers/xf86-video-i128/Makefile +++ b/x11-drivers/xf86-video-i128/Makefile @@ -2,7 +2,7 @@ PORTNAME= xf86-video-i128 PORTVERSION= 1.3.6 -PORTREVISION= 5 +PORTREVISION= 6 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-video-i740/Makefile b/x11-drivers/xf86-video-i740/Makefile index 3efba7c..9e940e8 100644 --- a/x11-drivers/xf86-video-i740/Makefile +++ b/x11-drivers/xf86-video-i740/Makefile @@ -2,6 +2,7 @@ PORTNAME= xf86-video-i740 PORTVERSION= 1.3.5 +PORTREVISION= 1 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-video-intel/Makefile b/x11-drivers/xf86-video-intel/Makefile index a47c24e..3157ebe 100644 --- a/x11-drivers/xf86-video-intel/Makefile +++ b/x11-drivers/xf86-video-intel/Makefile @@ -3,7 +3,7 @@ PORTNAME= xf86-video-intel PORTVERSION= 2.21.15 -PORTREVISION= 8 +PORTREVISION= 9 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-video-mach64/Makefile b/x11-drivers/xf86-video-mach64/Makefile index 18e0fd5..67e2310 100644 --- a/x11-drivers/xf86-video-mach64/Makefile +++ b/x11-drivers/xf86-video-mach64/Makefile @@ -1,8 +1,7 @@ # $FreeBSD$ PORTNAME= xf86-video-mach64 -PORTVERSION= 6.9.4 -PORTREVISION= 5 +PORTVERSION= 6.9.5 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-video-mach64/distinfo b/x11-drivers/xf86-video-mach64/distinfo index 9a74999..a17476c 100644 --- a/x11-drivers/xf86-video-mach64/distinfo +++ b/x11-drivers/xf86-video-mach64/distinfo @@ -1,2 +1,2 @@ -SHA256 (xorg/driver/xf86-video-mach64-6.9.4.tar.bz2) = 97f108b8d7c0a8426bef9562683323ab6369956f18b0e220ee0d1a66b740855e -SIZE (xorg/driver/xf86-video-mach64-6.9.4.tar.bz2) = 517239 +SHA256 (xorg/driver/xf86-video-mach64-6.9.5.tar.bz2) = 3e98985b6e044189efd42342862208f472881c25debf22230a1d54a96d71b41f +SIZE (xorg/driver/xf86-video-mach64-6.9.5.tar.bz2) = 520883 diff --git a/x11-drivers/xf86-video-mga/Makefile b/x11-drivers/xf86-video-mga/Makefile index 50de347..2659797 100644 --- a/x11-drivers/xf86-video-mga/Makefile +++ b/x11-drivers/xf86-video-mga/Makefile @@ -2,6 +2,7 @@ PORTNAME= xf86-video-mga PORTVERSION= 1.6.4 +PORTREVISION= 1 PORTEPOCH= 3 CATEGORIES= x11-drivers diff --git a/x11-drivers/xf86-video-neomagic/Makefile b/x11-drivers/xf86-video-neomagic/Makefile index a095adc..2d6591a 100644 --- a/x11-drivers/xf86-video-neomagic/Makefile +++ b/x11-drivers/xf86-video-neomagic/Makefile @@ -1,8 +1,7 @@ # $FreeBSD$ PORTNAME= xf86-video-neomagic -PORTVERSION= 1.2.8 -PORTREVISION= 6 +PORTVERSION= 1.2.9 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-video-neomagic/distinfo b/x11-drivers/xf86-video-neomagic/distinfo index cfe2a21..f257b0b 100644 --- a/x11-drivers/xf86-video-neomagic/distinfo +++ b/x11-drivers/xf86-video-neomagic/distinfo @@ -1,2 +1,2 @@ -SHA256 (xorg/driver/xf86-video-neomagic-1.2.8.tar.bz2) = 50abf6ac02547900edeaa5073c5f6d2f153f12dd47067cc7e4758e1b74d78874 -SIZE (xorg/driver/xf86-video-neomagic-1.2.8.tar.bz2) = 334223 +SHA256 (xorg/driver/xf86-video-neomagic-1.2.9.tar.bz2) = 72f89396b10527549337cb72a7eafb1194cf140144f9236a94ad2becdf140bf2 +SIZE (xorg/driver/xf86-video-neomagic-1.2.9.tar.bz2) = 340789 diff --git a/x11-drivers/xf86-video-nv/Makefile b/x11-drivers/xf86-video-nv/Makefile index 4a0cad9..d65548c 100644 --- a/x11-drivers/xf86-video-nv/Makefile +++ b/x11-drivers/xf86-video-nv/Makefile @@ -2,7 +2,7 @@ PORTNAME= xf86-video-nv PORTVERSION= 2.1.20 -PORTREVISION= 6 +PORTREVISION= 7 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-video-openchrome/Makefile b/x11-drivers/xf86-video-openchrome/Makefile index e153139..4ab6773 100644 --- a/x11-drivers/xf86-video-openchrome/Makefile +++ b/x11-drivers/xf86-video-openchrome/Makefile @@ -2,7 +2,7 @@ PORTNAME= xf86-video-openchrome PORTVERSION= 0.3.3 -PORTREVISION= 5 +PORTREVISION= 6 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-video-r128/Makefile b/x11-drivers/xf86-video-r128/Makefile index 95d3364..15b2a4a 100644 --- a/x11-drivers/xf86-video-r128/Makefile +++ b/x11-drivers/xf86-video-r128/Makefile @@ -1,8 +1,7 @@ # $FreeBSD$ PORTNAME= xf86-video-r128 -PORTVERSION= 6.9.2 -PORTREVISION= 5 +PORTVERSION= 6.10.0 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-video-r128/distinfo b/x11-drivers/xf86-video-r128/distinfo index fbb5aa3..d2e9f01 100644 --- a/x11-drivers/xf86-video-r128/distinfo +++ b/x11-drivers/xf86-video-r128/distinfo @@ -1,2 +1,2 @@ -SHA256 (xorg/driver/xf86-video-r128-6.9.2.tar.bz2) = 8b2d295f1842d07304a75da1cfb9bf139b320a6539970eaf8d5ecc010cd36ee0 -SIZE (xorg/driver/xf86-video-r128-6.9.2.tar.bz2) = 462266 +SHA256 (xorg/driver/xf86-video-r128-6.10.0.tar.bz2) = 80d531a07168230a408b88809a5440cfd48f9098666d12702d0012148a0d353d +SIZE (xorg/driver/xf86-video-r128-6.10.0.tar.bz2) = 494884 diff --git a/x11-drivers/xf86-video-rendition/Makefile b/x11-drivers/xf86-video-rendition/Makefile index 9888f66..1594952 100644 --- a/x11-drivers/xf86-video-rendition/Makefile +++ b/x11-drivers/xf86-video-rendition/Makefile @@ -2,7 +2,7 @@ PORTNAME= xf86-video-rendition PORTVERSION= 4.2.5 -PORTREVISION= 6 +PORTREVISION= 7 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-video-rendition/files/patch-src_rendition.c b/x11-drivers/xf86-video-rendition/files/patch-src_rendition.c index ab99424..5d5bb00 100644 --- a/x11-drivers/xf86-video-rendition/files/patch-src_rendition.c +++ b/x11-drivers/xf86-video-rendition/files/patch-src_rendition.c @@ -1,5 +1,5 @@ ---- src/rendition.c.orig 2012-07-17 05:32:12 UTC -+++ src/rendition.c +--- src/rendition.c.orig 2015-10-11 22:31:51.242126000 +0200 ++++ src/rendition.c 2015-10-11 22:32:20.465605000 +0200 @@ -1173,7 +1173,6 @@ renditionScreenInit(SCREEN_INIT_ARGS_DEC fbPictureInit (pScreen, 0, 0); @@ -8,3 +8,44 @@ /*********************************************************/ /* The actual setup of the driver-specific code */ +@@ -1372,6 +1371,18 @@ renditionMapMem(ScrnInfoPtr pScreenInfo) + /* Override on users request */ + WriteCombine + = xf86ReturnOptValBool(pRendition->Options, OPTION_FBWC, WriteCombine); ++#ifdef XSERVER_LIBPCIACCESS ++ mapOption = PCI_DEV_MAP_FLAG_WRITABLE; ++ if (WriteCombine) ++ mapOption |= PCI_DEV_MAP_FLAG_WRITE_COMBINE; ++ ++ err = pci_device_map_range(pRendition->PciInfo, ++ pRendition->PciInfo->regions[0].base_addr, ++ pRendition->PciInfo->regions[0].size, ++ mapOption, (void *)&pRendition->board.vmem_base); ++ ++ return (err == 0); ++#else + if (WriteCombine) { + xf86DrvMsg(pScreenInfo->scrnIndex, X_CONFIG, + ("Requesting Write-Combined memory access\n")); +@@ -1382,12 +1393,6 @@ renditionMapMem(ScrnInfoPtr pScreenInfo) + mapOption = VIDMEM_MMIO; + } + +-#ifdef XSERVER_LIBPCIACCESS +- err = pci_device_map_region(pRendition->PciInfo, 0, TRUE); +- pRendition->board.vmem_base = pRendition->PciInfo->regions[0].memory; +- +- return (err == 0); +-#else + pRendition->board.vmem_base= + xf86MapPciMem(pScreenInfo->scrnIndex, mapOption, + pRendition->pcitag, +@@ -1416,7 +1421,7 @@ renditionUnmapMem(ScrnInfoPtr pScreenInf + #else + pci_device_unmap_range(pRendition->PciInfo, + pRendition->board.vmem_base, +- pScreenInfo->videoRam * 1024); ++ pRendition->PciInfo->regions[0].size); + #endif + return TRUE; + #ifdef DEBUG0 diff --git a/x11-drivers/xf86-video-rendition/files/patch-src_rendition.h b/x11-drivers/xf86-video-rendition/files/patch-src_rendition.h index 81b528a..75a5fa4 100644 --- a/x11-drivers/xf86-video-rendition/files/patch-src_rendition.h +++ b/x11-drivers/xf86-video-rendition/files/patch-src_rendition.h @@ -1,6 +1,16 @@ ---- src/rendition.h.orig 2012-07-16 02:42:28 UTC -+++ src/rendition.h -@@ -28,9 +28,6 @@ +--- src/rendition.h.orig 2015-10-11 22:31:54.085176000 +0200 ++++ src/rendition.h 2015-10-11 22:32:12.657760000 +0200 +@@ -14,9 +14,6 @@ + /* Everything using inb/outb, etc needs "compiler.h" */ + #include "compiler.h" + +-/* Drivers for PCI hardware need this */ +-#include "xf86PciInfo.h" +- + /* Drivers that need to access the PCI config space directly need this */ + #include "xf86Pci.h" + +@@ -28,9 +25,6 @@ /* All drivers initialising the SW cursor need this */ #include "mipointer.h" @@ -10,3 +20,12 @@ /* All drivers using the mi colormap manipulation need this */ #include "micmap.h" +@@ -69,4 +63,8 @@ + + #include "compat-api.h" + /* end of __RENDITION_H__ */ ++ ++#define PCI_CHIP_V1000 0x0001 ++#define PCI_CHIP_V2x00 0x2000 ++ + #endif diff --git a/x11-drivers/xf86-video-s3/Makefile b/x11-drivers/xf86-video-s3/Makefile index 8ccba04..e9d71f2 100644 --- a/x11-drivers/xf86-video-s3/Makefile +++ b/x11-drivers/xf86-video-s3/Makefile @@ -2,7 +2,7 @@ PORTNAME= xf86-video-s3 PORTVERSION= 0.6.5 -PORTREVISION= 5 +PORTREVISION= 6 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-video-s3virge/Makefile b/x11-drivers/xf86-video-s3virge/Makefile index 40c6715..ccd229d 100644 --- a/x11-drivers/xf86-video-s3virge/Makefile +++ b/x11-drivers/xf86-video-s3virge/Makefile @@ -1,8 +1,7 @@ # $FreeBSD$ PORTNAME= xf86-video-s3virge -PORTVERSION= 1.10.6 -PORTREVISION= 5 +PORTVERSION= 1.10.7 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-video-s3virge/distinfo b/x11-drivers/xf86-video-s3virge/distinfo index 8eabf45..1f9a71d 100644 --- a/x11-drivers/xf86-video-s3virge/distinfo +++ b/x11-drivers/xf86-video-s3virge/distinfo @@ -1,2 +1,2 @@ -SHA256 (xorg/driver/xf86-video-s3virge-1.10.6.tar.bz2) = 85e1f6bdd3f39d0348c53602f481b974c13fc752c94931882817751c8ec8363e -SIZE (xorg/driver/xf86-video-s3virge-1.10.6.tar.bz2) = 349790 +SHA256 (xorg/driver/xf86-video-s3virge-1.10.7.tar.bz2) = 5dbe68de05483f902fdc48e97ce8d9fdd1d2ade14cb53c0c3642f0259f65a4da +SIZE (xorg/driver/xf86-video-s3virge-1.10.7.tar.bz2) = 374129 diff --git a/x11-drivers/xf86-video-savage/Makefile b/x11-drivers/xf86-video-savage/Makefile index 968d308..00d6c98 100644 --- a/x11-drivers/xf86-video-savage/Makefile +++ b/x11-drivers/xf86-video-savage/Makefile @@ -1,8 +1,7 @@ # $FreeBSD$ PORTNAME= xf86-video-savage -PORTVERSION= 2.3.7 -PORTREVISION= 5 +PORTVERSION= 2.3.8 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-video-savage/distinfo b/x11-drivers/xf86-video-savage/distinfo index 766fc87..e4338f5 100644 --- a/x11-drivers/xf86-video-savage/distinfo +++ b/x11-drivers/xf86-video-savage/distinfo @@ -1,2 +1,2 @@ -SHA256 (xorg/driver/xf86-video-savage-2.3.7.tar.bz2) = 041d4205c9222c1780fba6e0e397a559aed393b7a7991b58fa79ba8cccc54a44 -SIZE (xorg/driver/xf86-video-savage-2.3.7.tar.bz2) = 395249 +SHA256 (xorg/driver/xf86-video-savage-2.3.8.tar.bz2) = fdcea4a86532bceb50095eaf0fe2f38bbfa160e98463b815f4b549eb9985fa63 +SIZE (xorg/driver/xf86-video-savage-2.3.8.tar.bz2) = 418649 diff --git a/x11-drivers/xf86-video-scfb/Makefile b/x11-drivers/xf86-video-scfb/Makefile index d068e21..423476e 100644 --- a/x11-drivers/xf86-video-scfb/Makefile +++ b/x11-drivers/xf86-video-scfb/Makefile @@ -3,7 +3,7 @@ PORTNAME= xf86-video-scfb PORTVERSION= 0.0.4 -PORTREVISION= 2 +PORTREVISION= 3 CATEGORIES= x11-drivers MAINTAINER= ray@FreeBSD.org @@ -19,7 +19,7 @@ DIST_SUBDIR= xorg/driver USE_XORG= xorg-server xproto randrproto xi renderproto xextproto \ inputproto kbproto fontsproto videoproto dri2proto \ xf86driproto glproto xineramaproto resourceproto \ - scrnsaverproto + scrnsaverproto presentproto CONFIGURE_ENV= DRIVER_MAN_SUFFIX=4x DRIVER_MAN_DIR='$$(mandir)/man4' INSTALL_TARGET= install-strip diff --git a/x11-drivers/xf86-video-siliconmotion/Makefile b/x11-drivers/xf86-video-siliconmotion/Makefile index c67858b..5e26591 100644 --- a/x11-drivers/xf86-video-siliconmotion/Makefile +++ b/x11-drivers/xf86-video-siliconmotion/Makefile @@ -1,8 +1,7 @@ # $FreeBSD$ PORTNAME= xf86-video-siliconmotion -PORTVERSION= 1.7.7 -PORTREVISION= 5 +PORTVERSION= 1.7.8 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-video-siliconmotion/distinfo b/x11-drivers/xf86-video-siliconmotion/distinfo index 536d2c2..65ea6f2 100644 --- a/x11-drivers/xf86-video-siliconmotion/distinfo +++ b/x11-drivers/xf86-video-siliconmotion/distinfo @@ -1,2 +1,2 @@ -SHA256 (xorg/driver/xf86-video-siliconmotion-1.7.7.tar.bz2) = 87b8b59d43945d4fc8012860c0bd9aed42c4684a943355c607b8eb8d6710c3aa -SIZE (xorg/driver/xf86-video-siliconmotion-1.7.7.tar.bz2) = 385957 +SHA256 (xorg/driver/xf86-video-siliconmotion-1.7.8.tar.bz2) = e9d449a9fd9e58b4e018447b6c64005f7874cffb1777e513ac9fc41a86071beb +SIZE (xorg/driver/xf86-video-siliconmotion-1.7.8.tar.bz2) = 398928 diff --git a/x11-drivers/xf86-video-siliconmotion/files/patch-src_smi__driver.c b/x11-drivers/xf86-video-siliconmotion/files/patch-src_smi__driver.c deleted file mode 100644 index d74ae96..0000000 --- a/x11-drivers/xf86-video-siliconmotion/files/patch-src_smi__driver.c +++ /dev/null @@ -1,11 +0,0 @@ ---- src/smi_driver.c.orig 2012-07-17 04:53:21 UTC -+++ src/smi_driver.c -@@ -1750,8 +1750,6 @@ SMI_ScreenInit(SCREEN_INIT_ARGS_DECL) - "Done writing mode. Register dump:\n"); - SMI_PrintRegs(pScrn); - -- miInitializeBackingStore(pScreen); -- - #ifdef HAVE_XMODES - xf86DiDGAInit(pScreen, (unsigned long)(pSmi->FBBase + pScrn->fbOffset)); - #endif diff --git a/x11-drivers/xf86-video-sis/Makefile b/x11-drivers/xf86-video-sis/Makefile index caf1336..60e1c9b 100644 --- a/x11-drivers/xf86-video-sis/Makefile +++ b/x11-drivers/xf86-video-sis/Makefile @@ -1,8 +1,7 @@ # $FreeBSD$ PORTNAME= xf86-video-sis -PORTVERSION= 0.10.7 -PORTREVISION= 5 +PORTVERSION= 0.10.8 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-video-sis/distinfo b/x11-drivers/xf86-video-sis/distinfo index 7a8c42e..a3f0744 100644 --- a/x11-drivers/xf86-video-sis/distinfo +++ b/x11-drivers/xf86-video-sis/distinfo @@ -1,2 +1,2 @@ -SHA256 (xorg/driver/xf86-video-sis-0.10.7.tar.bz2) = be2eb6acba081e88dabc5be9db379e3da89a4d4edeb68064f204bf343a411cd0 -SIZE (xorg/driver/xf86-video-sis-0.10.7.tar.bz2) = 699499 +SHA256 (xorg/driver/xf86-video-sis-0.10.8.tar.bz2) = c8f3f2577f69334dfcc4bf96477dce45161170555f3abdfa105599e61bc7d3fe +SIZE (xorg/driver/xf86-video-sis-0.10.8.tar.bz2) = 734785 diff --git a/x11-drivers/xf86-video-sis/files/patch-src_sis__driver.c b/x11-drivers/xf86-video-sis/files/patch-src_sis__driver.c index a42b69b..df6ac87 100644 --- a/x11-drivers/xf86-video-sis/files/patch-src_sis__driver.c +++ b/x11-drivers/xf86-video-sis/files/patch-src_sis__driver.c @@ -1,27 +1,6 @@ ---- src/sis_driver.c.orig 2012-07-17 05:20:28 UTC -+++ src/sis_driver.c -@@ -57,7 +57,6 @@ - #include "fb.h" - #include "micmap.h" - #include "mipointer.h" --#include "mibstore.h" - #include "edid.h" - - #define SIS_NEED_inSISREG -@@ -8859,7 +8858,6 @@ SISScreenInit(SCREEN_INIT_ARGS_DECL) - } - pSiS->SiSFastVidCopyDone = TRUE; - -- miInitializeBackingStore(pScreen); - xf86SetBackingStore(pScreen); - xf86SetSilkenMouse(pScreen); - -@@ -9351,11 +9349,12 @@ SISMergedPointerMoved(SCRN_ARG_TYPE arg, - } - } - if(doit) { -+#if GET_ABI_MAJOR(ABI_XINPUT_VERSION) < 20 /* screw it */ - sigstate = xf86BlockSIGIO(); +--- src/sis_driver.c.orig 2015-09-23 09:54:07.196489000 +0200 ++++ src/sis_driver.c 2015-09-23 09:56:45.740035000 +0200 +@@ -9390,7 +9390,7 @@ SISMergedPointerMoved(SCRN_ARG_TYPE arg, #if GET_ABI_MAJOR(ABI_XINPUT_VERSION) >= 15 { double dx = x, dy = y; @@ -30,11 +9,3 @@ x = (int)dx; y = (int)dy; } -@@ -9368,6 +9367,7 @@ SISMergedPointerMoved(SCRN_ARG_TYPE arg, - miPointerAbsoluteCursor(x, y, currentTime.milliseconds); - #endif - xf86UnblockSIGIO(sigstate); -+#endif - return; - } - } diff --git a/x11-drivers/xf86-video-sunffb/Makefile b/x11-drivers/xf86-video-sunffb/Makefile index ba1abd9..96849c6 100644 --- a/x11-drivers/xf86-video-sunffb/Makefile +++ b/x11-drivers/xf86-video-sunffb/Makefile @@ -2,7 +2,7 @@ PORTNAME= xf86-video-sunffb PORTVERSION= 1.2.2 -PORTREVISION= 5 +PORTREVISION= 6 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-video-sunffb/files/patch-src_ffb__driver.c b/x11-drivers/xf86-video-sunffb/files/patch-src_ffb__driver.c new file mode 100644 index 0000000..a11731b --- /dev/null +++ b/x11-drivers/xf86-video-sunffb/files/patch-src_ffb__driver.c @@ -0,0 +1,33 @@ +From 181b60190c1f81fc9b9b5deb07d536b78f2536ab Mon Sep 17 00:00:00 2001 +From: Matthieu Herrb <matthieu.herrb@laas.fr> +Date: Mon, 10 Jun 2013 21:51:08 +0200 +Subject: Unbreak when XAA is not present. + +Turn accel off if loading XAA fails. + +Signed-off-by: Matthieu Herrb <matthieu.herrb@laas.fr> +Reviewed-by: Alex Deucher <alexander.deucher@amd.com> + +diff --git a/src/ffb_driver.c b/src/ffb_driver.c +index af13484..7f17d64 100644 +--- src/ffb_driver.c ++++ src/ffb_driver.c +@@ -413,9 +413,12 @@ FFBPreInit(ScrnInfoPtr pScrn, int flags) + return FALSE; + } + +- if (xf86LoadSubModule(pScrn, "xaa") == NULL) { +- FFBFreeRec(pScrn); +- return FALSE; ++ if (!pFfb->NoAccel) { ++ if (xf86LoadSubModule(pScrn, "xaa") == NULL) { ++ xf86DrvMsg(pScrn->scrnIndex, X_INFO, ++ "Loading XAA failed, acceleration disabled\n"); ++ pFfb->NoAccel = TRUE; ++ } + } + + if (pFfb->HWCursor && xf86LoadSubModule(pScrn, "ramdac") == NULL) { +-- +cgit v0.10.2 + diff --git a/x11-drivers/xf86-video-tdfx/Makefile b/x11-drivers/xf86-video-tdfx/Makefile index 4493465..61bdc3f 100644 --- a/x11-drivers/xf86-video-tdfx/Makefile +++ b/x11-drivers/xf86-video-tdfx/Makefile @@ -2,6 +2,7 @@ PORTNAME= xf86-video-tdfx PORTVERSION= 1.4.6 +PORTREVISION= 1 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-video-trident/Makefile b/x11-drivers/xf86-video-trident/Makefile index 3a8c405..dff0680 100644 --- a/x11-drivers/xf86-video-trident/Makefile +++ b/x11-drivers/xf86-video-trident/Makefile @@ -1,8 +1,7 @@ # $FreeBSD$ PORTNAME= xf86-video-trident -PORTVERSION= 1.3.6 -PORTREVISION= 6 +PORTVERSION= 1.3.7 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-video-trident/distinfo b/x11-drivers/xf86-video-trident/distinfo index db131b8..8e9f34a 100644 --- a/x11-drivers/xf86-video-trident/distinfo +++ b/x11-drivers/xf86-video-trident/distinfo @@ -1,2 +1,2 @@ -SHA256 (xorg/driver/xf86-video-trident-1.3.6.tar.bz2) = 6a58e3f3034abd8803af8a5c7dd5a6a4a28ed4fdac742ffb05518caaddc28104 -SIZE (xorg/driver/xf86-video-trident-1.3.6.tar.bz2) = 356092 +SHA256 (xorg/driver/xf86-video-trident-1.3.7.tar.bz2) = ecd518de627a0d49e17c158bfc72ab657386c6907c91ef89fa09332558e413ae +SIZE (xorg/driver/xf86-video-trident-1.3.7.tar.bz2) = 376898 diff --git a/x11-drivers/xf86-video-trident/files/patch-src_trident__driver.c b/x11-drivers/xf86-video-trident/files/patch-src_trident__driver.c deleted file mode 100644 index 22bdff2..0000000 --- a/x11-drivers/xf86-video-trident/files/patch-src_trident__driver.c +++ /dev/null @@ -1,18 +0,0 @@ ---- src/trident_driver.c.orig 2012-07-16 02:16:00 UTC -+++ src/trident_driver.c -@@ -56,7 +56,6 @@ - - #include "mipointer.h" - --#include "mibstore.h" - #include "shadow.h" - #include "trident.h" - #include "trident_regs.h" -@@ -3037,7 +3036,6 @@ TRIDENTScreenInit(SCREEN_INIT_ARGS_DECL) - TridentAccelInit(pScreen); - } - -- miInitializeBackingStore(pScreen); - xf86SetBackingStore(pScreen); - - /* Initialise cursor functions */ diff --git a/x11-drivers/xf86-video-tseng/Makefile b/x11-drivers/xf86-video-tseng/Makefile index ef4a214..59f4b45 100644 --- a/x11-drivers/xf86-video-tseng/Makefile +++ b/x11-drivers/xf86-video-tseng/Makefile @@ -2,7 +2,7 @@ PORTNAME= xf86-video-tseng PORTVERSION= 1.2.5 -PORTREVISION= 6 +PORTREVISION= 7 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-video-vesa/Makefile b/x11-drivers/xf86-video-vesa/Makefile index ac29d9e..2a6d248 100644 --- a/x11-drivers/xf86-video-vesa/Makefile +++ b/x11-drivers/xf86-video-vesa/Makefile @@ -1,8 +1,7 @@ # $FreeBSD$ PORTNAME= xf86-video-vesa -PORTVERSION= 2.3.3 -PORTREVISION= 5 +PORTVERSION= 2.3.4 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-video-vesa/distinfo b/x11-drivers/xf86-video-vesa/distinfo index f973eae..867416d 100644 --- a/x11-drivers/xf86-video-vesa/distinfo +++ b/x11-drivers/xf86-video-vesa/distinfo @@ -1,2 +1,2 @@ -SHA256 (xorg/driver/xf86-video-vesa-2.3.3.tar.bz2) = ce8b75e5a40e9dae76f2ac9e2880f7f73a848653ca2eed5880f52dc2c0d3aef8 -SIZE (xorg/driver/xf86-video-vesa-2.3.3.tar.bz2) = 300571 +SHA256 (xorg/driver/xf86-video-vesa-2.3.4.tar.bz2) = 7bddf4d879dd6f67088ecb203a31e12334aab980174bd0909930a21f32e251c1 +SIZE (xorg/driver/xf86-video-vesa-2.3.4.tar.bz2) = 285675 diff --git a/x11-drivers/xf86-video-voodoo/Makefile b/x11-drivers/xf86-video-voodoo/Makefile index 2442ed2..2113ace 100644 --- a/x11-drivers/xf86-video-voodoo/Makefile +++ b/x11-drivers/xf86-video-voodoo/Makefile @@ -2,7 +2,7 @@ PORTNAME= xf86-video-voodoo PORTVERSION= 1.2.5 -PORTREVISION= 6 +PORTREVISION= 7 CATEGORIES= x11-drivers MAINTAINER= x11@FreeBSD.org diff --git a/x11-drivers/xf86-video-voodoo/files/patch-src_voodoo.h b/x11-drivers/xf86-video-voodoo/files/patch-src_voodoo.h new file mode 100644 index 0000000..e10001f --- /dev/null +++ b/x11-drivers/xf86-video-voodoo/files/patch-src_voodoo.h @@ -0,0 +1,23 @@ +From 9172ae566a0e85313fc80ab62b4455393eefe593 Mon Sep 17 00:00:00 2001 +From: Dave Airlie <airlied@redhat.com> +Date: Mon, 22 Sep 2014 10:56:02 +1000 +Subject: don't use PCITAG in struct anymore + + +diff --git a/src/voodoo.h b/src/voodoo.h +index bfed497..c3eb64e 100644 +--- src/voodoo.h ++++ src/voodoo.h +@@ -23,7 +23,9 @@ typedef struct { + + Bool Voodoo2; /* Set if Voodoo2 */ + pciVideoPtr PciInfo; /* PCI data */ ++#ifndef XSERVER_LIBPCIACCESS + PCITAG PciTag; ++#endif + CARD32 PhysBase; + + CARD32 Width; /* Current width */ +-- +cgit v0.10.2 + diff --git a/x11-fonts/fontsproto/Makefile b/x11-fonts/fontsproto/Makefile index 07cc54d..4b52a2f 100644 --- a/x11-fonts/fontsproto/Makefile +++ b/x11-fonts/fontsproto/Makefile @@ -2,7 +2,7 @@ # $FreeBSD$ PORTNAME= fontsproto -PORTVERSION= 2.1.2 +PORTVERSION= 2.1.3 PORTEPOCH= 1 CATEGORIES= x11-fonts diff --git a/x11-fonts/fontsproto/distinfo b/x11-fonts/fontsproto/distinfo index 10e1d1e..ac15338 100644 --- a/x11-fonts/fontsproto/distinfo +++ b/x11-fonts/fontsproto/distinfo @@ -1,2 +1,2 @@ -SHA256 (xorg/proto/fontsproto-2.1.2.tar.bz2) = 869c97e5a536a8f3c9bc8b9923780ff1f062094bab935e26f96df3d6f1aa68a9 -SIZE (xorg/proto/fontsproto-2.1.2.tar.bz2) = 141990 +SHA256 (xorg/proto/fontsproto-2.1.3.tar.bz2) = 259046b0dd9130825c4a4c479ba3591d6d0f17a33f54e294b56478729a6e5ab8 +SIZE (xorg/proto/fontsproto-2.1.3.tar.bz2) = 154087 diff --git a/x11-fonts/libXfont/Makefile b/x11-fonts/libXfont/Makefile index a561d29..f842e82 100644 --- a/x11-fonts/libXfont/Makefile +++ b/x11-fonts/libXfont/Makefile @@ -2,7 +2,7 @@ # $FreeBSD$ PORTNAME= libXfont -PORTVERSION= 1.4.9 +PORTVERSION= 1.5.1 PORTEPOCH= 2 CATEGORIES= x11-fonts diff --git a/x11-fonts/libXfont/distinfo b/x11-fonts/libXfont/distinfo index dc33c69..c8b4d59 100644 --- a/x11-fonts/libXfont/distinfo +++ b/x11-fonts/libXfont/distinfo @@ -1,2 +1,2 @@ -SHA256 (xorg/lib/libXfont-1.4.9.tar.bz2) = 6c6b061a3aa44f0ac95785f9579f6427080c60ae6948b49bcc8d44f63942ad89 -SIZE (xorg/lib/libXfont-1.4.9.tar.bz2) = 495464 +SHA256 (xorg/lib/libXfont-1.5.1.tar.bz2) = b70898527c73f9758f551bbab612af611b8a0962202829568d94f3edf4d86098 +SIZE (xorg/lib/libXfont-1.5.1.tar.bz2) = 502903 diff --git a/x11-servers/xephyr/Makefile b/x11-servers/xephyr/Makefile index 708feee..9e04576 100644 --- a/x11-servers/xephyr/Makefile +++ b/x11-servers/xephyr/Makefile @@ -12,7 +12,7 @@ USE_XORG= x11 xf86driproto glproto randrproto renderproto fixesproto \ resourceproto fontsproto videoproto \ compositeproto trapproto recordproto \ xineramaproto xinerama evieproto xkbfile xfont \ - xau xdmcp xext fontenc xv pixman + xau xdmcp xext fontenc xv pixman presentproto CONFIGURE_ARGS= --enable-kdrive --enable-xephyr --disable-dmx --disable-xvfb \ --without-xmlto --disable-docs --disable-devel-docs \ diff --git a/x11-servers/xorg-dmx/Makefile b/x11-servers/xorg-dmx/Makefile index e54c94f..5b183e6 100644 --- a/x11-servers/xorg-dmx/Makefile +++ b/x11-servers/xorg-dmx/Makefile @@ -14,7 +14,7 @@ USE_XORG= x11 xf86driproto glproto randrproto renderproto fixesproto \ compositeproto trapproto recordproto resourceproto \ xineramaproto xinerama evieproto xkbfile xfont fontenc xkbui \ xxf86misc xxf86vm xaw7 xmu xpm xext xrender xfixes xi dmxproto \ - xau dmx xtst xres pixman xtrans + xau dmx xtst xres pixman xtrans presentproto CONFIGURE_ARGS= --disable-xvfb --disable-xnest \ --without-xmlto --disable-docs --disable-devel-docs \ diff --git a/x11-servers/xorg-nestserver/Makefile b/x11-servers/xorg-nestserver/Makefile index ae0ebf6..e24eafa 100644 --- a/x11-servers/xorg-nestserver/Makefile +++ b/x11-servers/xorg-nestserver/Makefile @@ -2,8 +2,7 @@ # $FreeBSD$ PORTNAME= xorg-nestserver -PORTVERSION= 1.14.7 -PORTREVISION= 2 +PORTVERSION= 1.17.2 PORTEPOCH= 1 CATEGORIES= x11-servers MASTER_SITES= XORG/individual/xserver @@ -13,6 +12,8 @@ DIST_SUBDIR= xorg/xserver MAINTAINER= x11@FreeBSD.org COMMENT= Nesting X server from X.Org +LIB_DEPENDS= libxcb-keysyms.so:x11/xcb-util-keysyms + USES= tar:bzip2 pkgconfig GNU_CONFIGURE= yes CONFIGURE_ARGS= --disable-dmx \ @@ -31,7 +32,6 @@ CONFIGURE_ARGS= --disable-dmx \ --localstatedir=/var \ --without-dtrace \ --without-doxygen \ - --disable-libpciaccess \ --disable-glx \ --disable-dri \ --disable-config-hal \ @@ -48,7 +48,7 @@ USE_XORG= x11 xf86driproto glproto randrproto renderproto fixesproto \ dri2proto resourceproto fontsproto xf86dgaproto videoproto \ compositeproto trapproto recordproto resourceproto \ xineramaproto xinerama evieproto xkbfile xfont fontenc xkbui \ - xxf86misc xxf86vm xaw7 xmu xpm xext pixman xtrans + xxf86misc xxf86vm xaw7 xmu xpm xext pixman xtrans presentproto PLIST_FILES= bin/Xnest \ man/man1/Xnest.1.gz diff --git a/x11-servers/xorg-nestserver/distinfo b/x11-servers/xorg-nestserver/distinfo index 7574aaa..878bc1b 100644 --- a/x11-servers/xorg-nestserver/distinfo +++ b/x11-servers/xorg-nestserver/distinfo @@ -1,2 +1,2 @@ -SHA256 (xorg/xserver/xorg-server-1.14.7.tar.bz2) = fcf66fa6ad86227613d2d3e8ae13ded297e2a1e947e9060a083eaf80d323451f -SIZE (xorg/xserver/xorg-server-1.14.7.tar.bz2) = 5520884 +SHA256 (xorg/xserver/xorg-server-1.17.2.tar.bz2) = f61120612728f2c5034671d0ca3e2273438c60aba93b3dda4a8aa40e6a257993 +SIZE (xorg/xserver/xorg-server-1.17.2.tar.bz2) = 5767983 diff --git a/x11-servers/xorg-server/Makefile b/x11-servers/xorg-server/Makefile index c99e28c..f5b939e 100644 --- a/x11-servers/xorg-server/Makefile +++ b/x11-servers/xorg-server/Makefile @@ -2,8 +2,8 @@ # $FreeBSD$ PORTNAME?= xorg-server -PORTVERSION= 1.14.7 -PORTREVISION?= 6 +PORTVERSION= 1.17.2 +PORTREVISION?= 0 PORTEPOCH?= 1 CATEGORIES= x11-servers MASTER_SITES= XORG/individual/xserver @@ -14,9 +14,10 @@ COMMENT?= X.Org X server and related programs LICENSE= MIT -LIB_DEPENDS= libdrm.so:${PORTSDIR}/graphics/libdrm -RUN_DEPENDS= xkeyboard-config>=2.5:${PORTSDIR}/x11/xkeyboard-config \ - xkbcomp:${PORTSDIR}/x11/xkbcomp +LIB_DEPENDS= libdrm.so:graphics/libdrm \ + libepoxy.so:graphics/libepoxy +RUN_DEPENDS= xkeyboard-config>=2.5:x11/xkeyboard-config \ + xkbcomp:x11/xkbcomp XORG_CAT= xserver SLAVE_PORT?= no @@ -36,20 +37,21 @@ OPTIONS_EXCLUDE_sparc64= HAL USES= gmake libtool perl5 tar:bzip2 USE_PERL5= build -USE_GL= gl +USE_GL= gbm egl gl USE_XORG?= xf86driproto glproto xdmcp x11 xkbfile xxf86misc xxf86vm xaw7 \ xmu xt xpm xext randrproto renderproto fixesproto damageproto \ - dri2proto xcmiscproto xextproto xproto xtrans xf86miscproto \ - xf86vidmodeproto xf86bigfontproto scrnsaverproto bigreqsproto \ - resourceproto fontsproto inputproto xf86dgaproto \ - videoproto compositeproto trapproto recordproto xineramaproto \ - xinerama evieproto xfont fontenc xkbui pixman pciaccess - + dri2proto xcmiscproto xextproto xproto xtrans \ + xf86miscproto xf86vidmodeproto xf86bigfontproto scrnsaverproto \ + bigreqsproto resourceproto fontsproto inputproto xf86dgaproto \ + videoproto compositeproto trapproto presentproto recordproto \ + xineramaproto xinerama evieproto xfont fontenc xkbui pixman \ + pciaccess xshmfence USE_OPENSSL= yes CONFIGURE_ARGS?=--disable-dmx --disable-xvfb --disable-xnest \ --without-xmlto --disable-docs --disable-devel-docs \ --localstatedir=/var --without-dtrace --disable-xephyr \ - --enable-record=yes + --enable-record=yes --disable-dri3 --disable-xwayland \ + --enable-glamor INSTALL_TARGET= install-strip .if ${SLAVE_PORT} == "no" @@ -70,7 +72,7 @@ CONFIGURE_ENV= SHA1_LIB="-L/usr/lib -lcrypto" SHA1_CFLAGS="-I/usr/include" .endif .if ${PORT_OPTIONS:MHAL} -LIB_DEPENDS+= libhal.so:${PORTSDIR}/sysutils/hal +LIB_DEPENDS+= libhal.so:sysutils/hal CONFIGURE_ARGS+= --enable-config-hal=yes .else CONFIGURE_ARGS+= --enable-config-hal=no @@ -79,11 +81,6 @@ CONFIGURE_ARGS+= --enable-config-hal=no # We handle Xorg setuid in the plist. This allows to build xorg-server as a user. CONFIGURE_ARGS+=--disable-install-setuid -.if ${ARCH} == armv6 -EXTRA_PATCHES+= ${FILESDIR}/extra-arm-patch-hw__xfree86__os-support__bsd__Makefile.in -EXTRA_PATCHES+= ${FILESDIR}/extra-arm-patch-include__servermd.h -.endif - .if ${ARCH} == i386 EXTRA_PATCHES+= ${FILESDIR}/extra-arch-i386 .endif diff --git a/x11-servers/xorg-server/distinfo b/x11-servers/xorg-server/distinfo index 7574aaa..878bc1b 100644 --- a/x11-servers/xorg-server/distinfo +++ b/x11-servers/xorg-server/distinfo @@ -1,2 +1,2 @@ -SHA256 (xorg/xserver/xorg-server-1.14.7.tar.bz2) = fcf66fa6ad86227613d2d3e8ae13ded297e2a1e947e9060a083eaf80d323451f -SIZE (xorg/xserver/xorg-server-1.14.7.tar.bz2) = 5520884 +SHA256 (xorg/xserver/xorg-server-1.17.2.tar.bz2) = f61120612728f2c5034671d0ca3e2273438c60aba93b3dda4a8aa40e6a257993 +SIZE (xorg/xserver/xorg-server-1.17.2.tar.bz2) = 5767983 diff --git a/x11-servers/xorg-server/files/extra-arch-i386 b/x11-servers/xorg-server/files/extra-arch-i386 index 1a0bdee..9bebe28 100644 --- a/x11-servers/xorg-server/files/extra-arch-i386 +++ b/x11-servers/xorg-server/files/extra-arch-i386 @@ -1,11 +1,70 @@ ---- hw/xfree86/common/compiler.h.orig 2012-05-17 19:09:03.000000000 +0200 -+++ hw/xfree86/common/compiler.h 2013-01-18 13:59:18.366436857 +0100 -@@ -1335,7 +1335,7 @@ +--- hw/xfree86/common/compiler.h.orig 2015-06-05 17:19:40.000000000 +0200 ++++ hw/xfree86/common/compiler.h 2015-10-12 15:41:30.817470000 +0200 +@@ -968,6 +968,59 @@ inl(unsigned PORT_SIZE port) + #endif /* NDS32_MMIO_SWAP */ - #if !defined(__SUNPRO_C) - #if !defined(FAKEIT) && !defined(__mc68000__) && !defined(__arm__) && !defined(__sh__) && !defined(__hppa__) && !defined(__s390__) && !defined(__m32r__) --#ifdef GCCUSESGAS -+#if defined(GCCUSESGAS) || defined(__clang__) + #elif defined(__i386__) || defined(__ia64__) ++#if defined(__clang__) ++ ++/* ++ * If gcc uses gas rather than the native assembler, the syntax of these ++ * inlines has to be different. DHD ++ */ ++ ++static __inline__ void ++outb(unsigned short port, unsigned char val) ++{ ++ __asm__ __volatile__("outb %0,%1"::"a"(val), "d"(port)); ++} ++ ++static __inline__ void ++outw(unsigned short port, unsigned short val) ++{ ++ __asm__ __volatile__("outw %0,%1"::"a"(val), "d"(port)); ++} ++ ++static __inline__ void ++outl(unsigned short port, unsigned int val) ++{ ++ __asm__ __volatile__("outl %0,%1"::"a"(val), "d"(port)); ++} ++ ++static __inline__ unsigned int ++inb(unsigned short port) ++{ ++ unsigned char ret; ++ __asm__ __volatile__("inb %1,%0":"=a"(ret):"d"(port)); ++ ++ return ret; ++} ++ ++static __inline__ unsigned int ++inw(unsigned short port) ++{ ++ unsigned short ret; ++ __asm__ __volatile__("inw %1,%0":"=a"(ret):"d"(port)); ++ ++ return ret; ++} ++ ++static __inline__ unsigned int ++inl(unsigned short port) ++{ ++ unsigned int ret; ++ __asm__ __volatile__("inl %1,%0":"=a"(ret):"d"(port)); ++ ++ return ret; ++} ++ ++#else /* !__clang__, presumable GAS */ - /* - * If gcc uses gas rather than the native assembler, the syntax of these + static __inline__ void + outb(unsigned short port, unsigned char val) +@@ -1014,6 +1067,7 @@ inl(unsigned short port) + return ret; + } + ++#endif /* !__clang__, GAS part */ + #endif /* arch madness */ + + #else /* !GNUC */ diff --git a/x11-servers/xorg-server/files/extra-arch-ia64 b/x11-servers/xorg-server/files/extra-arch-ia64 index 9a3f48e..77a84db 100644 --- a/x11-servers/xorg-server/files/extra-arch-ia64 +++ b/x11-servers/xorg-server/files/extra-arch-ia64 @@ -32,22 +32,6 @@ if test "x$PPC_VIDEO" = xyes; then PPC_VIDEO_TRUE= PPC_VIDEO_FALSE='#' ---- hw/xfree86/common/compiler.h.orig 2011-06-11 18:55:47.000000000 +0200 -+++ hw/xfree86/common/compiler.h 2011-07-21 20:34:44.000000000 +0200 -@@ -397,12 +397,10 @@ - #include <machine/pio.h> - #endif /* __NetBSD__ */ - --# elif defined(linux) && defined(__ia64__) -+# elif (defined(linux) || defined(__FreeBSD__)) && defined(__ia64__) - - # include <inttypes.h> - --# include <sys/io.h> -- - # undef outb - # undef outw - # undef outl --- hw/xfree86/os-support/bsd/Makefile.in.dist 2009-06-18 17:45:13.000000000 -0700 +++ hw/xfree86/os-support/bsd/Makefile.in 2009-06-18 17:45:19.000000000 -0700 @@ -63,6 +63,7 @@ diff --git a/x11-servers/xorg-server/files/extra-arch-powerpc b/x11-servers/xorg-server/files/extra-arch-powerpc index 389fc87..1feec00 100644 --- a/x11-servers/xorg-server/files/extra-arch-powerpc +++ b/x11-servers/xorg-server/files/extra-arch-powerpc @@ -1,70 +1,14 @@ ---- hw/xfree86/os-support/bsd/ppc_video.c.orig 2014-07-22 07:52:58.000000000 -0700 -+++ hw/xfree86/os-support/bsd/ppc_video.c 2014-07-22 08:00:21.000000000 -0700 -@@ -44,6 +44,8 @@ - #define DEV_MEM "/dev/xf86" - #endif - -+static int kmem = -1; -+ - static pointer ppcMapVidMem(int, unsigned long, unsigned long, int flags); - static void ppcUnmapVidMem(int, pointer, unsigned long); - -@@ -68,6 +70,17 @@ - int fd = xf86Info.consoleFd; - pointer base; - -+#ifdef __FreeBSD__ -+ if (kmem == -1) { -+ kmem = open(DEV_MEM, 2); -+ if (kmem == -1) { -+ FatalError("mapVidMem: open %s", DEV_MEM); -+ } -+ } -+ -+ fd = kmem; -+#endif -+ - #ifdef DEBUG - xf86MsgVerb(X_INFO, 3, "mapVidMem %lx, %lx, fd = %d", Base, Size, fd); - #endif -@@ -93,7 +106,6 @@ - int Len) +--- hw/xfree86/os-support/bsd/ppc_video.c.orig 2015-06-05 17:19:40.000000000 +0200 ++++ hw/xfree86/os-support/bsd/ppc_video.c 2015-10-12 15:23:47.470110000 +0200 +@@ -79,7 +79,11 @@ xf86DisableIO() { - int rv; -- static int kmem = -1; - if (kmem == -1) { - kmem = open(DEV_MEM, 2); -@@ -118,6 +130,8 @@ - int fd = xf86Info.consoleFd; - - xf86MsgVerb(X_WARNING, 3, "xf86EnableIO %d\n", fd); -+ -+#ifndef __FreeBSD__ - if (ioBase == MAP_FAILED) { - ioBase = mmap(NULL, 0x10000, PROT_READ | PROT_WRITE, MAP_SHARED, fd, - 0xf2000000); -@@ -127,6 +141,12 @@ - return FALSE; - } - } -+#endif -+ /* -+ * Note that outl() etc. check for ioBase == MAP_FAILED, so leaving it that -+ * way (e.g. on FreeBSD) is non-fatal. -+ */ -+ - return TRUE; - } - -@@ -134,8 +154,10 @@ - xf86DisableIO() - { - -+#ifndef __FreeBSD__ if (ioBase != MAP_FAILED) { ++#if defined(__FreeBSD__) ++ munmap(__DEVOLATILE(unsigned char *, ioBase), 0x10000); ++#else munmap(__UNVOLATILE(ioBase), 0x10000); ++#endif ioBase = MAP_FAILED; } -+#endif } diff --git a/x11-servers/xorg-server/files/extra-arm-patch-hw__xfree86__os-support__bsd__Makefile.in b/x11-servers/xorg-server/files/extra-arm-patch-hw__xfree86__os-support__bsd__Makefile.in deleted file mode 100644 index 3de22c4..0000000 --- a/x11-servers/xorg-server/files/extra-arm-patch-hw__xfree86__os-support__bsd__Makefile.in +++ /dev/null @@ -1,17 +0,0 @@ ---- hw/xfree86/os-support/bsd/Makefile.in.orig 2014-09-10 14:57:51 UTC -+++ hw/xfree86/os-support/bsd/Makefile.in -@@ -84,11 +84,13 @@ - $(srcdir)/../shared/pm_noop.c $(srcdir)/bsd_apm.c \ - $(srcdir)/bsd_kqueue_apm.c $(srcdir)/../shared/kmod_noop.c \ - bsd_kmod.c -+@FREEBSD_KLDLOAD_TRUE@@ARM_VIDEO_TRUE@am__objects_1 = sparc64_video.lo \ -+@FREEBSD_KLDLOAD_TRUE@@ARM_VIDEO_TRUE@ ioperm_noop.lo - @ALPHA_VIDEO_FALSE@@ARM_VIDEO_FALSE@@I386_VIDEO_FALSE@@PPC_VIDEO_FALSE@@SPARC64_VIDEO_TRUE@am__objects_1 = sparc64_video.lo \ - @ALPHA_VIDEO_FALSE@@ARM_VIDEO_FALSE@@I386_VIDEO_FALSE@@PPC_VIDEO_FALSE@@SPARC64_VIDEO_TRUE@ ioperm_noop.lo - @ALPHA_VIDEO_FALSE@@ARM_VIDEO_FALSE@@I386_VIDEO_FALSE@@PPC_VIDEO_TRUE@am__objects_1 = ppc_video.lo - @ALPHA_VIDEO_FALSE@@ARM_VIDEO_FALSE@@I386_VIDEO_TRUE@am__objects_1 = i386_video.lo --@ALPHA_VIDEO_FALSE@@ARM_VIDEO_TRUE@am__objects_1 = arm_video.lo -+@ALPHA_VIDEO_FALSE@@ARM_VIDEO_TRUE@@FREEBSD_KLDLOAD_FALSE@am__objects_1 = arm_video.lo - @ALPHA_VIDEO_TRUE@am__objects_1 = alpha_video.lo bsd_ev56.lo \ - @ALPHA_VIDEO_TRUE@ bsd_axp.lo xf86Axp.lo - @AGP_FALSE@am__objects_2 = agp_noop.lo diff --git a/x11-servers/xorg-server/files/extra-arm-patch-include__servermd.h b/x11-servers/xorg-server/files/extra-arm-patch-include__servermd.h deleted file mode 100644 index ff5f723..0000000 --- a/x11-servers/xorg-server/files/extra-arm-patch-include__servermd.h +++ /dev/null @@ -1,31 +0,0 @@ ---- include/servermd.h.orig 2014-09-10 15:01:49 UTC -+++ include/servermd.h -@@ -104,6 +104,19 @@ - - #endif /* __nds32__ */ - -+#if defined(__FreeBSD__) && defined(__arm__) -+ -+#ifdef __BIG_ENDIAN -+#define IMAGE_BYTE_ORDER MSBFirst -+#define BITMAP_BIT_ORDER MSBFirst -+#else -+#define IMAGE_BYTE_ORDER LSBFirst -+#define BITMAP_BIT_ORDER LSBFirst -+#endif -+#define GLYPHPADBYTES 4 -+ -+#endif /* __FreeBSD__ && __arm__ */ -+ - #if defined __hppa__ - - #define IMAGE_BYTE_ORDER MSBFirst -@@ -153,7 +166,7 @@ - defined(__sparc__) || defined(__mc68000__) - - #if defined(__sparc) || defined(__sparc__) --#if !defined(sparc) -+#if !defined(sparc) && !defined(__FreeBSD__) - #define sparc 1 - #endif - #endif diff --git a/x11-servers/xorg-server/files/patch-CVE-2014-8092-1-4 b/x11-servers/xorg-server/files/patch-CVE-2014-8092-1-4 deleted file mode 100644 index d04a03b..0000000 --- a/x11-servers/xorg-server/files/patch-CVE-2014-8092-1-4 +++ /dev/null @@ -1,37 +0,0 @@ -From eeae42d60bf3d5663ea088581f6c28a82cd17829 Mon Sep 17 00:00:00 2001 -From: Alan Coopersmith <alan.coopersmith@oracle.com> -Date: Wed, 22 Jan 2014 21:11:16 -0800 -Subject: [PATCH 01/40] dix: integer overflow in ProcPutImage() [CVE-2014-8092 - 1/4] - -ProcPutImage() calculates a length field from a width, left pad and depth -specified by the client (if the specified format is XYPixmap). - -The calculations for the total amount of memory the server needs for the -pixmap can overflow a 32-bit number, causing out-of-bounds memory writes -on 32-bit systems (since the length is stored in a long int variable). - -Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> -Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> -Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> ---- - dix/dispatch.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/dix/dispatch.c b/dix/dispatch.c -index d844a09..55b978d 100644 ---- dix/dispatch.c -+++ dix/dispatch.c -@@ -2000,6 +2000,9 @@ ProcPutImage(ClientPtr client) - tmpImage = (char *) &stuff[1]; - lengthProto = length; - -+ if (lengthProto >= (INT32_MAX / stuff->height)) -+ return BadLength; -+ - if ((bytes_to_int32(lengthProto * stuff->height) + - bytes_to_int32(sizeof(xPutImageReq))) != client->req_len) - return BadLength; --- -2.1.2 - diff --git a/x11-servers/xorg-server/files/patch-CVE-2014-8092-2-4 b/x11-servers/xorg-server/files/patch-CVE-2014-8092-2-4 deleted file mode 100644 index 25d58bd..0000000 --- a/x11-servers/xorg-server/files/patch-CVE-2014-8092-2-4 +++ /dev/null @@ -1,49 +0,0 @@ -From bc8e20430b6f6378daf6ce4329029248a88af08b Mon Sep 17 00:00:00 2001 -From: Alan Coopersmith <alan.coopersmith@oracle.com> -Date: Mon, 6 Jan 2014 23:30:14 -0800 -Subject: [PATCH 02/40] dix: integer overflow in GetHosts() [CVE-2014-8092 2/4] - -GetHosts() iterates over all the hosts it has in memory, and copies -them to a buffer. The buffer length is calculated by iterating over -all the hosts and adding up all of their combined length. There is a -potential integer overflow, if there are lots and lots of hosts (with -a combined length of > ~4 gig). This should be possible by repeatedly -calling ProcChangeHosts() on 64bit machines with enough memory. - -This patch caps the list at 1mb, because multi-megabyte hostname -lists for X access control are insane. - -Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> -Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> -Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> ---- - os/access.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/os/access.c b/os/access.c -index 5c510de..f393c8d 100644 ---- os/access.c -+++ os/access.c -@@ -1296,6 +1296,10 @@ GetHosts(void **data, int *pnHosts, int *pLen, BOOL * pEnabled) - for (host = validhosts; host; host = host->next) { - nHosts++; - n += pad_to_int32(host->len) + sizeof(xHostEntry); -+ /* Could check for INT_MAX, but in reality having more than 1mb of -+ hostnames in the access list is ridiculous */ -+ if (n >= 1048576) -+ break; - } - if (n) { - *data = ptr = malloc(n); -@@ -1304,6 +1308,8 @@ GetHosts(void **data, int *pnHosts, int *pLen, BOOL * pEnabled) - } - for (host = validhosts; host; host = host->next) { - len = host->len; -+ if ((ptr + sizeof(xHostEntry) + len) > (data + n)) -+ break; - ((xHostEntry *) ptr)->family = host->family; - ((xHostEntry *) ptr)->length = len; - ptr += sizeof(xHostEntry); --- -2.1.2 - diff --git a/x11-servers/xorg-server/files/patch-CVE-2014-8092-3-4 b/x11-servers/xorg-server/files/patch-CVE-2014-8092-3-4 deleted file mode 100644 index 1d40d04..0000000 --- a/x11-servers/xorg-server/files/patch-CVE-2014-8092-3-4 +++ /dev/null @@ -1,128 +0,0 @@ -From 97015a07b9e15d8ec5608b95d95ec0eb51202acb Mon Sep 17 00:00:00 2001 -From: Alan Coopersmith <alan.coopersmith@oracle.com> -Date: Wed, 22 Jan 2014 22:37:15 -0800 -Subject: [PATCH 03/40] dix: integer overflow in RegionSizeof() [CVE-2014-8092 - 3/4] - -RegionSizeof contains several integer overflows if a large length -value is passed in. Once we fix it to return 0 on overflow, we -also have to fix the callers to handle this error condition - -v2: Fixed limit calculation in RegionSizeof as pointed out by jcristau. - -Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> -Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> -Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> -Reviewed-by: Julien Cristau <jcristau@debian.org> ---- - dix/region.c | 20 +++++++++++++------- - include/regionstr.h | 10 +++++++--- - 2 files changed, 20 insertions(+), 10 deletions(-) - -diff --git a/dix/region.c b/dix/region.c -index ce1014e..04e5901 100644 ---- dix/region.c -+++ dix/region.c -@@ -169,7 +169,6 @@ Equipment Corporation. - ((r1)->y1 <= (r2)->y1) && \ - ((r1)->y2 >= (r2)->y2) ) - --#define xallocData(n) malloc(RegionSizeof(n)) - #define xfreeData(reg) if ((reg)->data && (reg)->data->size) free((reg)->data) - - #define RECTALLOC_BAIL(pReg,n,bail) \ -@@ -205,8 +204,9 @@ if (!(pReg)->data || (((pReg)->data->numRects + (n)) > (pReg)->data->size)) \ - #define DOWNSIZE(reg,numRects) \ - if (((numRects) < ((reg)->data->size >> 1)) && ((reg)->data->size > 50)) \ - { \ -- RegDataPtr NewData; \ -- NewData = (RegDataPtr)realloc((reg)->data, RegionSizeof(numRects)); \ -+ size_t NewSize = RegionSizeof(numRects); \ -+ RegDataPtr NewData = \ -+ (NewSize > 0) ? realloc((reg)->data, NewSize) : NULL ; \ - if (NewData) \ - { \ - NewData->size = (numRects); \ -@@ -345,17 +345,20 @@ Bool - RegionRectAlloc(RegionPtr pRgn, int n) - { - RegDataPtr data; -+ size_t rgnSize; - - if (!pRgn->data) { - n++; -- pRgn->data = xallocData(n); -+ rgnSize = RegionSizeof(n); -+ pRgn->data = (rgnSize > 0) ? malloc(rgnSize) : NULL; - if (!pRgn->data) - return RegionBreak(pRgn); - pRgn->data->numRects = 1; - *RegionBoxptr(pRgn) = pRgn->extents; - } - else if (!pRgn->data->size) { -- pRgn->data = xallocData(n); -+ rgnSize = RegionSizeof(n); -+ pRgn->data = (rgnSize > 0) ? malloc(rgnSize) : NULL; - if (!pRgn->data) - return RegionBreak(pRgn); - pRgn->data->numRects = 0; -@@ -367,7 +370,8 @@ RegionRectAlloc(RegionPtr pRgn, int n) - n = 250; - } - n += pRgn->data->numRects; -- data = (RegDataPtr) realloc(pRgn->data, RegionSizeof(n)); -+ rgnSize = RegionSizeof(n); -+ data = (rgnSize > 0) ? realloc(pRgn->data, rgnSize) : NULL; - if (!data) - return RegionBreak(pRgn); - pRgn->data = data; -@@ -1312,6 +1316,7 @@ RegionFromRects(int nrects, xRectangle *prect, int ctype) - { - - RegionPtr pRgn; -+ size_t rgnSize; - RegDataPtr pData; - BoxPtr pBox; - int i; -@@ -1338,7 +1343,8 @@ RegionFromRects(int nrects, xRectangle *prect, int ctype) - } - return pRgn; - } -- pData = xallocData(nrects); -+ rgnSize = RegionSizeof(nrects); -+ pData = (rgnSize > 0) ? malloc(rgnSize) : NULL; - if (!pData) { - RegionBreak(pRgn); - return pRgn; -diff --git a/include/regionstr.h b/include/regionstr.h -index 515e93f..079375d 100644 ---- include/regionstr.h -+++ include/regionstr.h -@@ -127,7 +127,10 @@ RegionEnd(RegionPtr reg) - static inline size_t - RegionSizeof(size_t n) - { -- return (sizeof(RegDataRec) + ((n) * sizeof(BoxRec))); -+ if (n < ((INT_MAX - sizeof(RegDataRec)) / sizeof(BoxRec))) -+ return (sizeof(RegDataRec) + ((n) * sizeof(BoxRec))); -+ else -+ return 0; - } - - static inline void -@@ -138,9 +141,10 @@ RegionInit(RegionPtr _pReg, BoxPtr _rect, int _size) - (_pReg)->data = (RegDataPtr) NULL; - } - else { -+ size_t rgnSize; - (_pReg)->extents = RegionEmptyBox; -- if (((_size) > 1) && ((_pReg)->data = -- (RegDataPtr) malloc(RegionSizeof(_size)))) { -+ if (((_size) > 1) && ((rgnSize = RegionSizeof(_size)) > 0) && -+ (((_pReg)->data = (RegDataPtr) malloc(rgnSize)) != NULL)) { - (_pReg)->data->size = (_size); - (_pReg)->data->numRects = 0; - } --- -2.1.2 - diff --git a/x11-servers/xorg-server/files/patch-CVE-2014-8092-4-4 b/x11-servers/xorg-server/files/patch-CVE-2014-8092-4-4 deleted file mode 100644 index 64436ed..0000000 --- a/x11-servers/xorg-server/files/patch-CVE-2014-8092-4-4 +++ /dev/null @@ -1,34 +0,0 @@ -From e0e11644622a589129a01e11e5d105dc74a098de Mon Sep 17 00:00:00 2001 -From: Alan Coopersmith <alan.coopersmith@oracle.com> -Date: Wed, 22 Jan 2014 23:44:46 -0800 -Subject: [PATCH 04/40] dix: integer overflow in REQUEST_FIXED_SIZE() - [CVE-2014-8092 4/4] - -Force use of 64-bit integers when evaluating data provided by clients -in 32-bit fields which can overflow when added or multiplied during -checks. - -Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> -Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> -Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> ---- - include/dix.h | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/include/dix.h b/include/dix.h -index 991a3ce..e0c6ed8 100644 ---- include/dix.h -+++ include/dix.h -@@ -76,7 +76,8 @@ SOFTWARE. - - #define REQUEST_FIXED_SIZE(req, n)\ - if (((sizeof(req) >> 2) > client->req_len) || \ -- (((sizeof(req) + (n) + 3) >> 2) != client->req_len)) \ -+ ((n >> 2) >= client->req_len) || \ -+ ((((uint64_t) sizeof(req) + (n) + 3) >> 2) != (uint64_t) client->req_len)) \ - return(BadLength) - - #define LEGAL_NEW_RESOURCE(id,client)\ --- -2.1.2 - diff --git a/x11-servers/xorg-server/files/patch-CVE-2014-8092-pt5 b/x11-servers/xorg-server/files/patch-CVE-2014-8092-pt5 deleted file mode 100644 index 4446b48..0000000 --- a/x11-servers/xorg-server/files/patch-CVE-2014-8092-pt5 +++ /dev/null @@ -1,32 +0,0 @@ -From 9802a0162f738de03585ca3f3b8a8266494f7d45 Mon Sep 17 00:00:00 2001 -From: Keith Packard <keithp@keithp.com> -Date: Tue, 9 Dec 2014 09:30:59 -0800 -Subject: [PATCH 38/40] Missing parens in REQUEST_FIXED_SIZE macro - [CVE-2014-8092 pt. 5] - -The 'n' parameter must be surrounded by parens in both places to -prevent precedence from mis-computing things. - -Signed-off-by: Keith Packard <keithp@keithp.com> -Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com> -Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> ---- - include/dix.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/include/dix.h b/include/dix.h -index 21176a8..921156b 100644 ---- include/dix.h -+++ include/dix.h -@@ -80,7 +80,7 @@ SOFTWARE. - - #define REQUEST_FIXED_SIZE(req, n)\ - if (((sizeof(req) >> 2) > client->req_len) || \ -- ((n >> 2) >= client->req_len) || \ -+ (((n) >> 2) >= client->req_len) || \ - ((((uint64_t) sizeof(req) + (n) + 3) >> 2) != (uint64_t) client->req_len)) \ - return(BadLength) - --- -2.1.2 - diff --git a/x11-servers/xorg-server/files/patch-CVE-2014-8092-pt6 b/x11-servers/xorg-server/files/patch-CVE-2014-8092-pt6 deleted file mode 100644 index 5adb2b0..0000000 --- a/x11-servers/xorg-server/files/patch-CVE-2014-8092-pt6 +++ /dev/null @@ -1,35 +0,0 @@ -From 1559a94395258fd73e369f1a2c98a44bfe21a486 Mon Sep 17 00:00:00 2001 -From: Keith Packard <keithp@keithp.com> -Date: Tue, 9 Dec 2014 09:31:00 -0800 -Subject: [PATCH 39/40] dix: GetHosts bounds check using wrong pointer value - [CVE-2014-8092 pt. 6] - -GetHosts saves the pointer to allocated memory in *data, and then -wants to bounds-check writes to that region, but was mistakenly using -a bare 'data' instead of '*data'. Also, data is declared as void **, -so we need a cast to turn it into a byte pointer so we can actually do -pointer comparisons. - -Signed-off-by: Keith Packard <keithp@keithp.com> -Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com> -Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> ---- - os/access.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/os/access.c b/os/access.c -index f393c8d..28f2d32 100644 ---- os/access.c -+++ os/access.c -@@ -1308,7 +1308,7 @@ GetHosts(void **data, int *pnHosts, int *pLen, BOOL * pEnabled) - } - for (host = validhosts; host; host = host->next) { - len = host->len; -- if ((ptr + sizeof(xHostEntry) + len) > (data + n)) -+ if ((ptr + sizeof(xHostEntry) + len) > ((unsigned char *) *data + n)) - break; - ((xHostEntry *) ptr)->family = host->family; - ((xHostEntry *) ptr)->length = len; --- -2.1.2 - diff --git a/x11-servers/xorg-server/files/patch-CVE-2014-8093-1-6 b/x11-servers/xorg-server/files/patch-CVE-2014-8093-1-6 deleted file mode 100644 index ffa7e39..0000000 --- a/x11-servers/xorg-server/files/patch-CVE-2014-8093-1-6 +++ /dev/null @@ -1,47 +0,0 @@ -From 23fe7718bb171e71db2d1a30505c2ca2988799d9 Mon Sep 17 00:00:00 2001 -From: Adam Jackson <ajax@redhat.com> -Date: Mon, 10 Nov 2014 12:13:36 -0500 -Subject: [PATCH 19/40] glx: Be more paranoid about variable-length requests - [CVE-2014-8093 1/6] - -If the size computation routine returns -1 we should just reject the -request outright. Clamping it to zero could give an attacker the -opportunity to also mangle cmdlen in such a way that the subsequent -length check passes, and the request would get executed, thus passing -data we wanted to reject to the renderer. - -Reviewed-by: Keith Packard <keithp@keithp.com> -Reviewed-by: Julien Cristau <jcristau@debian.org> -Reviewed-by: Michal Srb <msrb@suse.com> -Reviewed-by: Andy Ritger <aritger@nvidia.com> -Signed-off-by: Adam Jackson <ajax@redhat.com> -Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> ---- - glx/glxcmds.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/glx/glxcmds.c b/glx/glxcmds.c -index 009fd9b..ea42e2a 100644 ---- glx/glxcmds.c -+++ glx/glxcmds.c -@@ -2062,7 +2062,7 @@ __glXDisp_Render(__GLXclientState * cl, GLbyte * pc) - extra = (*entry.varsize) (pc + __GLX_RENDER_HDR_SIZE, - client->swapped); - if (extra < 0) { -- extra = 0; -+ return BadLength; - } - if (cmdlen != __GLX_PAD(entry.bytes + extra)) { - return BadLength; -@@ -2179,7 +2179,7 @@ __glXDisp_RenderLarge(__GLXclientState * cl, GLbyte * pc) - extra = (*entry.varsize) (pc + __GLX_RENDER_LARGE_HDR_SIZE, - client->swapped); - if (extra < 0) { -- extra = 0; -+ return BadLength; - } - /* large command's header is 4 bytes longer, so add 4 */ - if (cmdlen != __GLX_PAD(entry.bytes + 4 + extra)) { --- -2.1.2 - diff --git a/x11-servers/xorg-server/files/patch-CVE-2014-8093-2-6 b/x11-servers/xorg-server/files/patch-CVE-2014-8093-2-6 deleted file mode 100644 index 6be2721..0000000 --- a/x11-servers/xorg-server/files/patch-CVE-2014-8093-2-6 +++ /dev/null @@ -1,165 +0,0 @@ -From ab2ba9338aa5e85b4487bc7fbe69985c76483e01 Mon Sep 17 00:00:00 2001 -From: Adam Jackson <ajax@redhat.com> -Date: Mon, 10 Nov 2014 12:13:37 -0500 -Subject: [PATCH 20/40] glx: Be more strict about rejecting invalid image sizes - [CVE-2014-8093 2/6] - -Before this we'd just clamp the image size to 0, which was just -hideously stupid; if the parameters were such that they'd overflow an -integer, you'd allocate a small buffer, then pass huge values into (say) -ReadPixels, and now you're scribbling over arbitrary server memory. - -Reviewed-by: Keith Packard <keithp@keithp.com> -Reviewed-by: Julien Cristau <jcristau@debian.org> -Reviewed-by: Michal Srb <msrb@suse.com> -Reviewed-by: Andy Ritger <aritger@nvidia.com> -Signed-off-by: Adam Jackson <ajax@redhat.com> -Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> ---- - glx/singlepix.c | 16 ++++++++-------- - glx/singlepixswap.c | 16 ++++++++-------- - 2 files changed, 16 insertions(+), 16 deletions(-) - -diff --git a/glx/singlepix.c b/glx/singlepix.c -index 506fdaa..8b6c261 100644 ---- glx/singlepix.c -+++ glx/singlepix.c -@@ -65,7 +65,7 @@ __glXDisp_ReadPixels(__GLXclientState * cl, GLbyte * pc) - lsbFirst = *(GLboolean *) (pc + 25); - compsize = __glReadPixels_size(format, type, width, height); - if (compsize < 0) -- compsize = 0; -+ return BadLength; - - glPixelStorei(GL_PACK_SWAP_BYTES, swapBytes); - glPixelStorei(GL_PACK_LSB_FIRST, lsbFirst); -@@ -124,7 +124,7 @@ __glXDisp_GetTexImage(__GLXclientState * cl, GLbyte * pc) - compsize = - __glGetTexImage_size(target, level, format, type, width, height, depth); - if (compsize < 0) -- compsize = 0; -+ return BadLength; - - glPixelStorei(GL_PACK_SWAP_BYTES, swapBytes); - __GLX_GET_ANSWER_BUFFER(answer, cl, compsize, 1); -@@ -218,9 +218,9 @@ GetSeparableFilter(__GLXclientState * cl, GLbyte * pc, GLXContextTag tag) - compsize2 = __glGetTexImage_size(target, 1, format, type, height, 1, 1); - - if (compsize < 0) -- compsize = 0; -+ return BadLength; - if (compsize2 < 0) -- compsize2 = 0; -+ return BadLength; - compsize = __GLX_PAD(compsize); - compsize2 = __GLX_PAD(compsize2); - -@@ -296,7 +296,7 @@ GetConvolutionFilter(__GLXclientState * cl, GLbyte * pc, GLXContextTag tag) - */ - compsize = __glGetTexImage_size(target, 1, format, type, width, height, 1); - if (compsize < 0) -- compsize = 0; -+ return BadLength; - - glPixelStorei(GL_PACK_SWAP_BYTES, swapBytes); - __GLX_GET_ANSWER_BUFFER(answer, cl, compsize, 1); -@@ -365,7 +365,7 @@ GetHistogram(__GLXclientState * cl, GLbyte * pc, GLXContextTag tag) - */ - compsize = __glGetTexImage_size(target, 1, format, type, width, 1, 1); - if (compsize < 0) -- compsize = 0; -+ return BadLength; - - glPixelStorei(GL_PACK_SWAP_BYTES, swapBytes); - __GLX_GET_ANSWER_BUFFER(answer, cl, compsize, 1); -@@ -426,7 +426,7 @@ GetMinmax(__GLXclientState * cl, GLbyte * pc, GLXContextTag tag) - - compsize = __glGetTexImage_size(target, 1, format, type, 2, 1, 1); - if (compsize < 0) -- compsize = 0; -+ return BadLength; - - glPixelStorei(GL_PACK_SWAP_BYTES, swapBytes); - __GLX_GET_ANSWER_BUFFER(answer, cl, compsize, 1); -@@ -491,7 +491,7 @@ GetColorTable(__GLXclientState * cl, GLbyte * pc, GLXContextTag tag) - */ - compsize = __glGetTexImage_size(target, 1, format, type, width, 1, 1); - if (compsize < 0) -- compsize = 0; -+ return BadLength; - - glPixelStorei(GL_PACK_SWAP_BYTES, swapBytes); - __GLX_GET_ANSWER_BUFFER(answer, cl, compsize, 1); -diff --git a/glx/singlepixswap.c b/glx/singlepixswap.c -index 8469101..8dc304f 100644 ---- glx/singlepixswap.c -+++ glx/singlepixswap.c -@@ -75,7 +75,7 @@ __glXDispSwap_ReadPixels(__GLXclientState * cl, GLbyte * pc) - lsbFirst = *(GLboolean *) (pc + 25); - compsize = __glReadPixels_size(format, type, width, height); - if (compsize < 0) -- compsize = 0; -+ return BadLength; - - glPixelStorei(GL_PACK_SWAP_BYTES, !swapBytes); - glPixelStorei(GL_PACK_LSB_FIRST, lsbFirst); -@@ -144,7 +144,7 @@ __glXDispSwap_GetTexImage(__GLXclientState * cl, GLbyte * pc) - compsize = - __glGetTexImage_size(target, level, format, type, width, height, depth); - if (compsize < 0) -- compsize = 0; -+ return BadLength; - - glPixelStorei(GL_PACK_SWAP_BYTES, !swapBytes); - __GLX_GET_ANSWER_BUFFER(answer, cl, compsize, 1); -@@ -252,9 +252,9 @@ GetSeparableFilter(__GLXclientState * cl, GLbyte * pc, GLXContextTag tag) - compsize2 = __glGetTexImage_size(target, 1, format, type, height, 1, 1); - - if (compsize < 0) -- compsize = 0; -+ return BadLength; - if (compsize2 < 0) -- compsize2 = 0; -+ return BadLength; - compsize = __GLX_PAD(compsize); - compsize2 = __GLX_PAD(compsize2); - -@@ -338,7 +338,7 @@ GetConvolutionFilter(__GLXclientState * cl, GLbyte * pc, GLXContextTag tag) - */ - compsize = __glGetTexImage_size(target, 1, format, type, width, height, 1); - if (compsize < 0) -- compsize = 0; -+ return BadLength; - - glPixelStorei(GL_PACK_SWAP_BYTES, !swapBytes); - __GLX_GET_ANSWER_BUFFER(answer, cl, compsize, 1); -@@ -415,7 +415,7 @@ GetHistogram(__GLXclientState * cl, GLbyte * pc, GLXContextTag tag) - */ - compsize = __glGetTexImage_size(target, 1, format, type, width, 1, 1); - if (compsize < 0) -- compsize = 0; -+ return BadLength; - - glPixelStorei(GL_PACK_SWAP_BYTES, !swapBytes); - __GLX_GET_ANSWER_BUFFER(answer, cl, compsize, 1); -@@ -483,7 +483,7 @@ GetMinmax(__GLXclientState * cl, GLbyte * pc, GLXContextTag tag) - - compsize = __glGetTexImage_size(target, 1, format, type, 2, 1, 1); - if (compsize < 0) -- compsize = 0; -+ return BadLength; - - glPixelStorei(GL_PACK_SWAP_BYTES, !swapBytes); - __GLX_GET_ANSWER_BUFFER(answer, cl, compsize, 1); -@@ -554,7 +554,7 @@ GetColorTable(__GLXclientState * cl, GLbyte * pc, GLXContextTag tag) - */ - compsize = __glGetTexImage_size(target, 1, format, type, width, 1, 1); - if (compsize < 0) -- compsize = 0; -+ return BadLength; - - glPixelStorei(GL_PACK_SWAP_BYTES, !swapBytes); - __GLX_GET_ANSWER_BUFFER(answer, cl, compsize, 1); --- -2.1.2 - diff --git a/x11-servers/xorg-server/files/patch-CVE-2014-8093-3-6 b/x11-servers/xorg-server/files/patch-CVE-2014-8093-3-6 deleted file mode 100644 index 0145fc1..0000000 --- a/x11-servers/xorg-server/files/patch-CVE-2014-8093-3-6 +++ /dev/null @@ -1,59 +0,0 @@ -From 717a1b37767b41e14859e5022ae9e679152821a9 Mon Sep 17 00:00:00 2001 -From: Adam Jackson <ajax@redhat.com> -Date: Mon, 10 Nov 2014 12:13:38 -0500 -Subject: [PATCH 21/40] glx: Additional paranoia in __glXGetAnswerBuffer / - __GLX_GET_ANSWER_BUFFER (v2) [CVE-2014-8093 3/6] - -If the computed reply size is negative, something went wrong, treat it -as an error. - -v2: Be more careful about size_t being unsigned (Matthieu Herrb) -v3: SIZE_MAX not SIZE_T_MAX (Alan Coopersmith) - -Reviewed-by: Julien Cristau <jcristau@debian.org> -Reviewed-by: Michal Srb <msrb@suse.com> -Reviewed-by: Andy Ritger <aritger@nvidia.com> -Signed-off-by: Adam Jackson <ajax@redhat.com> -Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> ---- - glx/indirect_util.c | 7 ++++++- - glx/unpack.h | 3 ++- - 2 files changed, 8 insertions(+), 2 deletions(-) - -diff --git a/glx/indirect_util.c b/glx/indirect_util.c -index 926e57c..de81491 100644 ---- glx/indirect_util.c -+++ glx/indirect_util.c -@@ -76,9 +76,14 @@ __glXGetAnswerBuffer(__GLXclientState * cl, size_t required_size, - const unsigned mask = alignment - 1; - - if (local_size < required_size) { -- const size_t worst_case_size = required_size + alignment; -+ size_t worst_case_size; - intptr_t temp_buf; - -+ if (required_size < SIZE_MAX - alignment) -+ worst_case_size = required_size + alignment; -+ else -+ return NULL; -+ - if (cl->returnBufSize < worst_case_size) { - void *temp = realloc(cl->returnBuf, worst_case_size); - -diff --git a/glx/unpack.h b/glx/unpack.h -index 52fba74..2b1ebcf 100644 ---- glx/unpack.h -+++ glx/unpack.h -@@ -83,7 +83,8 @@ extern xGLXSingleReply __glXReply; - ** pointer. - */ - #define __GLX_GET_ANSWER_BUFFER(res,cl,size,align) \ -- if ((size) > sizeof(answerBuffer)) { \ -+ if (size < 0) return BadLength; \ -+ else if ((size) > sizeof(answerBuffer)) { \ - int bump; \ - if ((cl)->returnBufSize < (size)+(align)) { \ - (cl)->returnBuf = (GLbyte*)realloc((cl)->returnBuf, \ --- -2.1.2 - diff --git a/x11-servers/xorg-server/files/patch-CVE-2014-8093-4-6 b/x11-servers/xorg-server/files/patch-CVE-2014-8093-4-6 deleted file mode 100644 index 6a461c9..0000000 --- a/x11-servers/xorg-server/files/patch-CVE-2014-8093-4-6 +++ /dev/null @@ -1,82 +0,0 @@ -From 2a5cbc17fc72185bf0fa06fef26d1f782de72595 Mon Sep 17 00:00:00 2001 -From: Adam Jackson <ajax@redhat.com> -Date: Mon, 10 Nov 2014 12:13:40 -0500 -Subject: [PATCH 23/40] glx: Add safe_{add,mul,pad} (v3) [CVE-2014-8093 4/6] - -These are paranoid about integer overflow, and will return -1 if their -operation would overflow a (signed) integer or if either argument is -negative. - -Note that RenderLarge requests are sized with a uint32_t so in principle -this could be sketchy there, but dix limits bigreqs to 128M so you -shouldn't ever notice, and honestly if you're sending more than 2G of -rendering commands you're already doing something very wrong. - -v2: Use INT_MAX for consistency with the rest of the server (jcristau) -v3: Reject negative arguments (anholt) - -Reviewed-by: Keith Packard <keithp@keithp.com> -Reviewed-by: Julien Cristau <jcristau@debian.org> -Reviewed-by: Michal Srb <msrb@suse.com> -Reviewed-by: Andy Ritger <aritger@nvidia.com> -Signed-off-by: Adam Jackson <ajax@redhat.com> -Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> ---- - glx/glxserver.h | 41 +++++++++++++++++++++++++++++++++++++++++ - 1 file changed, 41 insertions(+) - -diff --git a/glx/glxserver.h b/glx/glxserver.h -index a324b29..9482601 100644 ---- glx/glxserver.h -+++ glx/glxserver.h -@@ -228,6 +228,47 @@ extern void glxSwapQueryServerStringReply(ClientPtr client, - * Routines for computing the size of variably-sized rendering commands. - */ - -+static _X_INLINE int -+safe_add(int a, int b) -+{ -+ if (a < 0 || b < 0) -+ return -1; -+ -+ if (INT_MAX - a < b) -+ return -1; -+ -+ return a + b; -+} -+ -+static _X_INLINE int -+safe_mul(int a, int b) -+{ -+ if (a < 0 || b < 0) -+ return -1; -+ -+ if (a == 0 || b == 0) -+ return 0; -+ -+ if (a > INT_MAX / b) -+ return -1; -+ -+ return a * b; -+} -+ -+static _X_INLINE int -+safe_pad(int a) -+{ -+ int ret; -+ -+ if (a < 0) -+ return -1; -+ -+ if ((ret = safe_add(a, 3)) < 0) -+ return -1; -+ -+ return ret & (GLuint)~3; -+} -+ - extern int __glXTypeSize(GLenum enm); - extern int __glXImageSize(GLenum format, GLenum type, - GLenum target, GLsizei w, GLsizei h, GLsizei d, --- -2.1.2 - diff --git a/x11-servers/xorg-server/files/patch-CVE-2014-8093-5-6 b/x11-servers/xorg-server/files/patch-CVE-2014-8093-5-6 deleted file mode 100644 index 6384cd6..0000000 --- a/x11-servers/xorg-server/files/patch-CVE-2014-8093-5-6 +++ /dev/null @@ -1,225 +0,0 @@ -From 698888e6671d54c7ae41e9d456f7f5483a3459d2 Mon Sep 17 00:00:00 2001 -From: Adam Jackson <ajax@redhat.com> -Date: Mon, 10 Nov 2014 12:13:42 -0500 -Subject: [PATCH 25/40] glx: Integer overflow protection for non-generated - render requests (v3) [CVE-2014-8093 5/6] - -v2: -Fix constants in __glXMap2fReqSize (Michal Srb) -Validate w/h/d for proxy targets too (Keith Packard) - -v3: -Fix Map[12]Size to correctly reject order == 0 (Julien Cristau) - -Reviewed-by: Keith Packard <keithp@keithp.com> -Reviewed-by: Michal Srb <msrb@suse.com> -Reviewed-by: Andy Ritger <aritger@nvidia.com> -Signed-off-by: Adam Jackson <ajax@redhat.com> -Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> ---- - glx/rensize.c | 77 +++++++++++++++++++++++++++++++---------------------------- - 1 file changed, 41 insertions(+), 36 deletions(-) - -diff --git a/glx/rensize.c b/glx/rensize.c -index 9ff73c7..d46334a 100644 ---- glx/rensize.c -+++ glx/rensize.c -@@ -43,19 +43,11 @@ - (((a & 0xff000000U)>>24) | ((a & 0xff0000U)>>8) | \ - ((a & 0xff00U)<<8) | ((a & 0xffU)<<24)) - --static int --Map1Size(GLint k, GLint order) --{ -- if (order <= 0 || k < 0) -- return -1; -- return k * order; --} -- - int - __glXMap1dReqSize(const GLbyte * pc, Bool swap) - { - GLenum target; -- GLint order, k; -+ GLint order; - - target = *(GLenum *) (pc + 16); - order = *(GLint *) (pc + 20); -@@ -63,15 +55,16 @@ __glXMap1dReqSize(const GLbyte * pc, Bool swap) - target = SWAPL(target); - order = SWAPL(order); - } -- k = __glMap1d_size(target); -- return 8 * Map1Size(k, order); -+ if (order < 1) -+ return -1; -+ return safe_mul(8, safe_mul(__glMap1d_size(target), order)); - } - - int - __glXMap1fReqSize(const GLbyte * pc, Bool swap) - { - GLenum target; -- GLint order, k; -+ GLint order; - - target = *(GLenum *) (pc + 0); - order = *(GLint *) (pc + 12); -@@ -79,23 +72,24 @@ __glXMap1fReqSize(const GLbyte * pc, Bool swap) - target = SWAPL(target); - order = SWAPL(order); - } -- k = __glMap1f_size(target); -- return 4 * Map1Size(k, order); -+ if (order < 1) -+ return -1; -+ return safe_mul(4, safe_mul(__glMap1f_size(target), order)); - } - - static int - Map2Size(int k, int majorOrder, int minorOrder) - { -- if (majorOrder <= 0 || minorOrder <= 0 || k < 0) -+ if (majorOrder < 1 || minorOrder < 1) - return -1; -- return k * majorOrder * minorOrder; -+ return safe_mul(k, safe_mul(majorOrder, minorOrder)); - } - - int - __glXMap2dReqSize(const GLbyte * pc, Bool swap) - { - GLenum target; -- GLint uorder, vorder, k; -+ GLint uorder, vorder; - - target = *(GLenum *) (pc + 32); - uorder = *(GLint *) (pc + 36); -@@ -105,15 +99,14 @@ __glXMap2dReqSize(const GLbyte * pc, Bool swap) - uorder = SWAPL(uorder); - vorder = SWAPL(vorder); - } -- k = __glMap2d_size(target); -- return 8 * Map2Size(k, uorder, vorder); -+ return safe_mul(8, Map2Size(__glMap2d_size(target), uorder, vorder)); - } - - int - __glXMap2fReqSize(const GLbyte * pc, Bool swap) - { - GLenum target; -- GLint uorder, vorder, k; -+ GLint uorder, vorder; - - target = *(GLenum *) (pc + 0); - uorder = *(GLint *) (pc + 12); -@@ -123,8 +116,7 @@ __glXMap2fReqSize(const GLbyte * pc, Bool swap) - uorder = SWAPL(uorder); - vorder = SWAPL(vorder); - } -- k = __glMap2f_size(target); -- return 4 * Map2Size(k, uorder, vorder); -+ return safe_mul(4, Map2Size(__glMap2f_size(target), uorder, vorder)); - } - - /** -@@ -175,14 +167,16 @@ __glXImageSize(GLenum format, GLenum type, GLenum target, - GLint bytesPerElement, elementsPerGroup, groupsPerRow; - GLint groupSize, rowSize, padding, imageSize; - -+ if (w == 0 || h == 0 || d == 0) -+ return 0; -+ - if (w < 0 || h < 0 || d < 0 || - (type == GL_BITMAP && - (format != GL_COLOR_INDEX && format != GL_STENCIL_INDEX))) { - return -1; - } -- if (w == 0 || h == 0 || d == 0) -- return 0; - -+ /* proxy targets have no data */ - switch (target) { - case GL_PROXY_TEXTURE_1D: - case GL_PROXY_TEXTURE_2D: -@@ -199,6 +193,12 @@ __glXImageSize(GLenum format, GLenum type, GLenum target, - return 0; - } - -+ /* real data has to have real sizes */ -+ if (imageHeight < 0 || rowLength < 0 || skipImages < 0 || skipRows < 0) -+ return -1; -+ if (alignment != 1 && alignment != 2 && alignment != 4 && alignment != 8) -+ return -1; -+ - if (type == GL_BITMAP) { - if (rowLength > 0) { - groupsPerRow = rowLength; -@@ -207,11 +207,14 @@ __glXImageSize(GLenum format, GLenum type, GLenum target, - groupsPerRow = w; - } - rowSize = bits_to_bytes(groupsPerRow); -+ if (rowSize < 0) -+ return -1; - padding = (rowSize % alignment); - if (padding) { - rowSize += alignment - padding; - } -- return ((h + skipRows) * rowSize); -+ -+ return safe_mul(safe_add(h, skipRows), rowSize); - } - else { - switch (format) { -@@ -303,6 +306,7 @@ __glXImageSize(GLenum format, GLenum type, GLenum target, - default: - return -1; - } -+ /* known safe by the switches above, not checked */ - groupSize = bytesPerElement * elementsPerGroup; - if (rowLength > 0) { - groupsPerRow = rowLength; -@@ -310,18 +314,21 @@ __glXImageSize(GLenum format, GLenum type, GLenum target, - else { - groupsPerRow = w; - } -- rowSize = groupsPerRow * groupSize; -+ -+ if ((rowSize = safe_mul(groupsPerRow, groupSize)) < 0) -+ return -1; - padding = (rowSize % alignment); - if (padding) { - rowSize += alignment - padding; - } -- if (imageHeight > 0) { -- imageSize = (imageHeight + skipRows) * rowSize; -- } -- else { -- imageSize = (h + skipRows) * rowSize; -- } -- return ((d + skipImages) * imageSize); -+ -+ if (imageHeight > 0) -+ h = imageHeight; -+ h = safe_add(h, skipRows); -+ -+ imageSize = safe_mul(h, rowSize); -+ -+ return safe_mul(safe_add(d, skipImages), imageSize); - } - } - -@@ -445,9 +452,7 @@ __glXSeparableFilter2DReqSize(const GLbyte * pc, Bool swap) - /* XXX Should rowLength be used for either or both image? */ - image1size = __glXImageSize(format, type, 0, w, 1, 1, - 0, rowLength, 0, 0, alignment); -- image1size = __GLX_PAD(image1size); - image2size = __glXImageSize(format, type, 0, h, 1, 1, - 0, rowLength, 0, 0, alignment); -- return image1size + image2size; -- -+ return safe_add(safe_pad(image1size), image2size); - } --- -2.1.2 - diff --git a/x11-servers/xorg-server/files/patch-CVE-2014-8093-6-6 b/x11-servers/xorg-server/files/patch-CVE-2014-8093-6-6 deleted file mode 100644 index ce30413..0000000 --- a/x11-servers/xorg-server/files/patch-CVE-2014-8093-6-6 +++ /dev/null @@ -1,34 +0,0 @@ -From 7e7630bbb775573eea2a2335adb9d190c3e1e971 Mon Sep 17 00:00:00 2001 -From: Robert Morell <rmorell@nvidia.com> -Date: Wed, 12 Nov 2014 18:51:43 -0800 -Subject: [PATCH 32/40] glx: Fix mask truncation in __glXGetAnswerBuffer - [CVE-2014-8093 6/6] - -On a system where sizeof(unsigned) != sizeof(intptr_t), the unary -bitwise not operation will result in a mask that clears all high bits -from temp_buf in the expression: - temp_buf = (temp_buf + mask) & ~mask; - -Signed-off-by: Robert Morell <rmorell@nvidia.com> -Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com> -Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> ---- - glx/indirect_util.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/glx/indirect_util.c b/glx/indirect_util.c -index de81491..9ba2815 100644 ---- glx/indirect_util.c -+++ glx/indirect_util.c -@@ -73,7 +73,7 @@ __glXGetAnswerBuffer(__GLXclientState * cl, size_t required_size, - void *local_buffer, size_t local_size, unsigned alignment) - { - void *buffer = local_buffer; -- const unsigned mask = alignment - 1; -+ const intptr_t mask = alignment - 1; - - if (local_size < required_size) { - size_t worst_case_size; --- -2.1.2 - diff --git a/x11-servers/xorg-server/files/patch-CVE-2014-8094 b/x11-servers/xorg-server/files/patch-CVE-2014-8094 deleted file mode 100644 index b634b65..0000000 --- a/x11-servers/xorg-server/files/patch-CVE-2014-8094 +++ /dev/null @@ -1,35 +0,0 @@ -From 6692670fde081bbfe9313f17d84037ae9116702a Mon Sep 17 00:00:00 2001 -From: Alan Coopersmith <alan.coopersmith@oracle.com> -Date: Wed, 22 Jan 2014 23:40:18 -0800 -Subject: [PATCH 05/40] dri2: integer overflow in ProcDRI2GetBuffers() - [CVE-2014-8094] - -ProcDRI2GetBuffers() tries to validate a length field (count). -There is an integer overflow in the validation. This can cause -out of bound reads and memory corruption later on. - -Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> -Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> -Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> -Reviewed-by: Julien Cristau <jcristau@debian.org> ---- - hw/xfree86/dri2/dri2ext.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/hw/xfree86/dri2/dri2ext.c b/hw/xfree86/dri2/dri2ext.c -index ffd66fa..221ec53 100644 ---- hw/xfree86/dri2/dri2ext.c -+++ hw/xfree86/dri2/dri2ext.c -@@ -270,6 +270,9 @@ ProcDRI2GetBuffers(ClientPtr client) - unsigned int *attachments; - - REQUEST_FIXED_SIZE(xDRI2GetBuffersReq, stuff->count * 4); -+ if (stuff->count > (INT_MAX / 4)) -+ return BadLength; -+ - if (!validDrawable(client, stuff->drawable, DixReadAccess | DixWriteAccess, - &pDrawable, &status)) - return status; --- -2.1.2 - diff --git a/x11-servers/xorg-server/files/patch-CVE-2014-8095 b/x11-servers/xorg-server/files/patch-CVE-2014-8095 deleted file mode 100644 index 8fddc45..0000000 --- a/x11-servers/xorg-server/files/patch-CVE-2014-8095 +++ /dev/null @@ -1,551 +0,0 @@ -From 73c63afb93c0af1bfd1969bf6e71c9edca586c77 Mon Sep 17 00:00:00 2001 -From: Alan Coopersmith <alan.coopersmith@oracle.com> -Date: Sun, 26 Jan 2014 10:54:41 -0800 -Subject: [PATCH 07/40] Xi: unvalidated lengths in Xinput extension - [CVE-2014-8095] - -Multiple functions in the Xinput extension handling of requests from -clients failed to check that the length of the request sent by the -client was large enough to perform all the required operations and -thus could read or write to memory outside the bounds of the request -buffer. - -This commit includes the creation of a new REQUEST_AT_LEAST_EXTRA_SIZE -macro in include/dix.h for the common case of needing to ensure a -request is large enough to include both the request itself and a -minimum amount of extra data following the request header. - -Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> -Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> ---- - Xi/chgdctl.c | 8 ++++++-- - Xi/chgfctl.c | 2 ++ - Xi/sendexev.c | 3 +++ - Xi/xiallowev.c | 2 ++ - Xi/xichangecursor.c | 2 +- - Xi/xichangehierarchy.c | 35 ++++++++++++++++++++++++++++++++--- - Xi/xigetclientpointer.c | 1 + - Xi/xigrabdev.c | 9 ++++++++- - Xi/xipassivegrab.c | 12 ++++++++++-- - Xi/xiproperty.c | 14 ++++++-------- - Xi/xiquerydevice.c | 1 + - Xi/xiquerypointer.c | 2 ++ - Xi/xiselectev.c | 8 ++++++++ - Xi/xisetclientpointer.c | 3 ++- - Xi/xisetdevfocus.c | 4 ++++ - Xi/xiwarppointer.c | 2 ++ - include/dix.h | 4 ++++ - 17 files changed, 94 insertions(+), 18 deletions(-) - -diff --git a/Xi/chgdctl.c b/Xi/chgdctl.c -index d078aa2..b3ee867 100644 ---- Xi/chgdctl.c -+++ Xi/chgdctl.c -@@ -78,7 +78,7 @@ SProcXChangeDeviceControl(ClientPtr client) - - REQUEST(xChangeDeviceControlReq); - swaps(&stuff->length); -- REQUEST_AT_LEAST_SIZE(xChangeDeviceControlReq); -+ REQUEST_AT_LEAST_EXTRA_SIZE(xChangeDeviceControlReq, sizeof(xDeviceCtl)); - swaps(&stuff->control); - ctl = (xDeviceCtl *) &stuff[1]; - swaps(&ctl->control); -@@ -115,7 +115,7 @@ ProcXChangeDeviceControl(ClientPtr client) - xDeviceEnableCtl *e; - - REQUEST(xChangeDeviceControlReq); -- REQUEST_AT_LEAST_SIZE(xChangeDeviceControlReq); -+ REQUEST_AT_LEAST_EXTRA_SIZE(xChangeDeviceControlReq, sizeof(xDeviceCtl)); - - len = stuff->length - bytes_to_int32(sizeof(xChangeDeviceControlReq)); - ret = dixLookupDevice(&dev, stuff->deviceid, client, DixManageAccess); -@@ -192,6 +192,10 @@ ProcXChangeDeviceControl(ClientPtr client) - break; - case DEVICE_ENABLE: - e = (xDeviceEnableCtl *) &stuff[1]; -+ if ((len != bytes_to_int32(sizeof(xDeviceEnableCtl)))) { -+ ret = BadLength; -+ goto out; -+ } - - if (IsXTestDevice(dev, NULL)) - status = !Success; -diff --git a/Xi/chgfctl.c b/Xi/chgfctl.c -index 6dcf60c..224c2ba 100644 ---- Xi/chgfctl.c -+++ Xi/chgfctl.c -@@ -467,6 +467,8 @@ ProcXChangeFeedbackControl(ClientPtr client) - xStringFeedbackCtl *f = ((xStringFeedbackCtl *) &stuff[1]); - - if (client->swapped) { -+ if (len < bytes_to_int32(sizeof(xStringFeedbackCtl))) -+ return BadLength; - swaps(&f->num_keysyms); - } - if (len != -diff --git a/Xi/sendexev.c b/Xi/sendexev.c -index 3c21386..183f88d 100644 ---- Xi/sendexev.c -+++ Xi/sendexev.c -@@ -135,6 +135,9 @@ ProcXSendExtensionEvent(ClientPtr client) - if (ret != Success) - return ret; - -+ if (stuff->num_events == 0) -+ return ret; -+ - /* The client's event type must be one defined by an extension. */ - - first = ((xEvent *) &stuff[1]); -diff --git a/Xi/xiallowev.c b/Xi/xiallowev.c -index ebef233..ca263ef 100644 ---- Xi/xiallowev.c -+++ Xi/xiallowev.c -@@ -48,6 +48,7 @@ int - SProcXIAllowEvents(ClientPtr client) - { - REQUEST(xXIAllowEventsReq); -+ REQUEST_AT_LEAST_SIZE(xXIAllowEventsReq); - - swaps(&stuff->length); - swaps(&stuff->deviceid); -@@ -55,6 +56,7 @@ SProcXIAllowEvents(ClientPtr client) - if (stuff->length > 3) { - xXI2_2AllowEventsReq *req_xi22 = (xXI2_2AllowEventsReq *) stuff; - -+ REQUEST_AT_LEAST_SIZE(xXI2_2AllowEventsReq); - swapl(&req_xi22->touchid); - swapl(&req_xi22->grab_window); - } -diff --git a/Xi/xichangecursor.c b/Xi/xichangecursor.c -index 7a1bb7a..8e6255b 100644 ---- Xi/xichangecursor.c -+++ Xi/xichangecursor.c -@@ -57,11 +57,11 @@ int - SProcXIChangeCursor(ClientPtr client) - { - REQUEST(xXIChangeCursorReq); -+ REQUEST_SIZE_MATCH(xXIChangeCursorReq); - swaps(&stuff->length); - swapl(&stuff->win); - swapl(&stuff->cursor); - swaps(&stuff->deviceid); -- REQUEST_SIZE_MATCH(xXIChangeCursorReq); - return (ProcXIChangeCursor(client)); - } - -diff --git a/Xi/xichangehierarchy.c b/Xi/xichangehierarchy.c -index 9e36354..2732445 100644 ---- Xi/xichangehierarchy.c -+++ Xi/xichangehierarchy.c -@@ -411,7 +411,7 @@ int - ProcXIChangeHierarchy(ClientPtr client) - { - xXIAnyHierarchyChangeInfo *any; -- int required_len = sizeof(xXIChangeHierarchyReq); -+ size_t len; /* length of data remaining in request */ - int rc = Success; - int flags[MAXDEVICES] = { 0 }; - -@@ -421,21 +421,46 @@ ProcXIChangeHierarchy(ClientPtr client) - if (!stuff->num_changes) - return rc; - -+ if (stuff->length > (INT_MAX >> 2)) -+ return BadAlloc; -+ len = (stuff->length << 2) - sizeof(xXIAnyHierarchyChangeInfo); -+ - any = (xXIAnyHierarchyChangeInfo *) &stuff[1]; - while (stuff->num_changes--) { -+ if (len < sizeof(xXIAnyHierarchyChangeInfo)) { -+ rc = BadLength; -+ goto unwind; -+ } -+ - SWAPIF(swaps(&any->type)); - SWAPIF(swaps(&any->length)); - -- required_len += any->length; -- if ((stuff->length * 4) < required_len) -+ if ((any->length > (INT_MAX >> 2)) || (len < (any->length << 2))) - return BadLength; - -+#define CHANGE_SIZE_MATCH(type) \ -+ do { \ -+ if ((len < sizeof(type)) || (any->length != (sizeof(type) >> 2))) { \ -+ rc = BadLength; \ -+ goto unwind; \ -+ } \ -+ } while(0) -+ - switch (any->type) { - case XIAddMaster: - { - xXIAddMasterInfo *c = (xXIAddMasterInfo *) any; - -+ /* Variable length, due to appended name string */ -+ if (len < sizeof(xXIAddMasterInfo)) { -+ rc = BadLength; -+ goto unwind; -+ } - SWAPIF(swaps(&c->name_len)); -+ if (c->name_len > (len - sizeof(xXIAddMasterInfo))) { -+ rc = BadLength; -+ goto unwind; -+ } - - rc = add_master(client, c, flags); - if (rc != Success) -@@ -446,6 +471,7 @@ ProcXIChangeHierarchy(ClientPtr client) - { - xXIRemoveMasterInfo *r = (xXIRemoveMasterInfo *) any; - -+ CHANGE_SIZE_MATCH(xXIRemoveMasterInfo); - rc = remove_master(client, r, flags); - if (rc != Success) - goto unwind; -@@ -455,6 +481,7 @@ ProcXIChangeHierarchy(ClientPtr client) - { - xXIDetachSlaveInfo *c = (xXIDetachSlaveInfo *) any; - -+ CHANGE_SIZE_MATCH(xXIDetachSlaveInfo); - rc = detach_slave(client, c, flags); - if (rc != Success) - goto unwind; -@@ -464,6 +491,7 @@ ProcXIChangeHierarchy(ClientPtr client) - { - xXIAttachSlaveInfo *c = (xXIAttachSlaveInfo *) any; - -+ CHANGE_SIZE_MATCH(xXIAttachSlaveInfo); - rc = attach_slave(client, c, flags); - if (rc != Success) - goto unwind; -@@ -471,6 +499,7 @@ ProcXIChangeHierarchy(ClientPtr client) - break; - } - -+ len -= any->length * 4; - any = (xXIAnyHierarchyChangeInfo *) ((char *) any + any->length * 4); - } - -diff --git a/Xi/xigetclientpointer.c b/Xi/xigetclientpointer.c -index 3c90d58..306dd39 100644 ---- Xi/xigetclientpointer.c -+++ Xi/xigetclientpointer.c -@@ -50,6 +50,7 @@ int - SProcXIGetClientPointer(ClientPtr client) - { - REQUEST(xXIGetClientPointerReq); -+ REQUEST_SIZE_MATCH(xXIGetClientPointerReq); - - swaps(&stuff->length); - swapl(&stuff->win); -diff --git a/Xi/xigrabdev.c b/Xi/xigrabdev.c -index 63d95bc..e2a2ae3 100644 ---- Xi/xigrabdev.c -+++ Xi/xigrabdev.c -@@ -47,6 +47,11 @@ int - SProcXIGrabDevice(ClientPtr client) - { - REQUEST(xXIGrabDeviceReq); -+ /* -+ * Check here for at least the length of the struct we swap, then -+ * let ProcXIGrabDevice check the full size after we swap mask_len. -+ */ -+ REQUEST_AT_LEAST_SIZE(xXIGrabDeviceReq); - - swaps(&stuff->length); - swaps(&stuff->deviceid); -@@ -71,7 +76,7 @@ ProcXIGrabDevice(ClientPtr client) - unsigned int pointer_mode; - - REQUEST(xXIGrabDeviceReq); -- REQUEST_AT_LEAST_SIZE(xXIGrabDeviceReq); -+ REQUEST_FIXED_SIZE(xXIGrabDeviceReq, ((size_t) stuff->mask_len) * 4); - - ret = dixLookupDevice(&dev, stuff->deviceid, client, DixGrabAccess); - if (ret != Success) -@@ -131,6 +136,7 @@ int - SProcXIUngrabDevice(ClientPtr client) - { - REQUEST(xXIUngrabDeviceReq); -+ REQUEST_SIZE_MATCH(xXIUngrabDeviceReq); - - swaps(&stuff->length); - swaps(&stuff->deviceid); -@@ -148,6 +154,7 @@ ProcXIUngrabDevice(ClientPtr client) - TimeStamp time; - - REQUEST(xXIUngrabDeviceReq); -+ REQUEST_SIZE_MATCH(xXIUngrabDeviceReq); - - ret = dixLookupDevice(&dev, stuff->deviceid, client, DixGetAttrAccess); - if (ret != Success) ---- Xi/xipassivegrab.c.orig 2014-04-15 03:01:56.000000000 +0200 -+++ Xi/xipassivegrab.c 2014-12-11 09:00:53.965074134 +0100 -@@ -53,6 +53,7 @@ - uint32_t *mods; - - REQUEST(xXIPassiveGrabDeviceReq); -+ REQUEST_AT_LEAST_SIZE(xXIPassiveGrabDeviceReq); - - swaps(&stuff->length); - swaps(&stuff->deviceid); -@@ -63,7 +64,9 @@ - swaps(&stuff->mask_len); - swaps(&stuff->num_modifiers); - -- mods = (uint32_t *) &stuff[1]; -+ REQUEST_FIXED_SIZE(xXIPassiveGrabDeviceReq, -+ ((uint32_t) stuff->mask_len + stuff->num_modifiers) *4); -+ mods = (uint32_t *) &stuff[1] + stuff->mask_len; - - for (i = 0; i < stuff->num_modifiers; i++, mods++) { - swapl(mods); -@@ -92,7 +95,8 @@ - int mask_len; - - REQUEST(xXIPassiveGrabDeviceReq); -- REQUEST_AT_LEAST_SIZE(xXIPassiveGrabDeviceReq); -+ REQUEST_FIXED_SIZE(xXIPassiveGrabDeviceReq, -+ ((uint32_t) stuff->mask_len + stuff->num_modifiers) * 4); - - if (stuff->deviceid == XIAllDevices) - dev = inputInfo.all_devices; -@@ -248,6 +252,7 @@ - uint32_t *modifiers; - - REQUEST(xXIPassiveUngrabDeviceReq); -+ REQUEST_AT_LEAST_SIZE(xXIPassiveUngrabDeviceReq); - - swaps(&stuff->length); - swapl(&stuff->grab_window); -@@ -255,6 +260,8 @@ - swapl(&stuff->detail); - swaps(&stuff->num_modifiers); - -+ REQUEST_FIXED_SIZE(xXIPassiveUngrabDeviceReq, -+ ((uint32_t) stuff->num_modifiers) << 2); - modifiers = (uint32_t *) &stuff[1]; - - for (i = 0; i < stuff->num_modifiers; i++, modifiers++) -@@ -273,7 +280,8 @@ - int i, rc; - - REQUEST(xXIPassiveUngrabDeviceReq); -- REQUEST_AT_LEAST_SIZE(xXIPassiveUngrabDeviceReq); -+ REQUEST_FIXED_SIZE(xXIPassiveUngrabDeviceReq, -+ ((uint32_t) stuff->num_modifiers) << 2); - - if (stuff->deviceid == XIAllDevices) - dev = inputInfo.all_devices; -diff --git a/Xi/xiproperty.c b/Xi/xiproperty.c -index 463607d..8e8e4b0 100644 ---- Xi/xiproperty.c -+++ Xi/xiproperty.c -@@ -1013,10 +1013,9 @@ int - SProcXListDeviceProperties(ClientPtr client) - { - REQUEST(xListDevicePropertiesReq); -+ REQUEST_SIZE_MATCH(xListDevicePropertiesReq); - - swaps(&stuff->length); -- -- REQUEST_SIZE_MATCH(xListDevicePropertiesReq); - return (ProcXListDeviceProperties(client)); - } - -@@ -1037,10 +1036,10 @@ int - SProcXDeleteDeviceProperty(ClientPtr client) - { - REQUEST(xDeleteDevicePropertyReq); -+ REQUEST_SIZE_MATCH(xDeleteDevicePropertyReq); - - swaps(&stuff->length); - swapl(&stuff->property); -- REQUEST_SIZE_MATCH(xDeleteDevicePropertyReq); - return (ProcXDeleteDeviceProperty(client)); - } - -@@ -1048,13 +1047,13 @@ int - SProcXGetDeviceProperty(ClientPtr client) - { - REQUEST(xGetDevicePropertyReq); -+ REQUEST_SIZE_MATCH(xGetDevicePropertyReq); - - swaps(&stuff->length); - swapl(&stuff->property); - swapl(&stuff->type); - swapl(&stuff->longOffset); - swapl(&stuff->longLength); -- REQUEST_SIZE_MATCH(xGetDevicePropertyReq); - return (ProcXGetDeviceProperty(client)); - } - -@@ -1253,11 +1252,10 @@ int - SProcXIListProperties(ClientPtr client) - { - REQUEST(xXIListPropertiesReq); -+ REQUEST_SIZE_MATCH(xXIListPropertiesReq); - - swaps(&stuff->length); - swaps(&stuff->deviceid); -- -- REQUEST_SIZE_MATCH(xXIListPropertiesReq); - return (ProcXIListProperties(client)); - } - -@@ -1279,11 +1277,11 @@ int - SProcXIDeleteProperty(ClientPtr client) - { - REQUEST(xXIDeletePropertyReq); -+ REQUEST_SIZE_MATCH(xXIDeletePropertyReq); - - swaps(&stuff->length); - swaps(&stuff->deviceid); - swapl(&stuff->property); -- REQUEST_SIZE_MATCH(xXIDeletePropertyReq); - return (ProcXIDeleteProperty(client)); - } - -@@ -1291,6 +1289,7 @@ int - SProcXIGetProperty(ClientPtr client) - { - REQUEST(xXIGetPropertyReq); -+ REQUEST_SIZE_MATCH(xXIGetPropertyReq); - - swaps(&stuff->length); - swaps(&stuff->deviceid); -@@ -1298,7 +1297,6 @@ SProcXIGetProperty(ClientPtr client) - swapl(&stuff->type); - swapl(&stuff->offset); - swapl(&stuff->len); -- REQUEST_SIZE_MATCH(xXIGetPropertyReq); - return (ProcXIGetProperty(client)); - } - -diff --git a/Xi/xiquerydevice.c b/Xi/xiquerydevice.c -index 4e544f0..67a9a4f 100644 ---- Xi/xiquerydevice.c -+++ Xi/xiquerydevice.c -@@ -54,6 +54,7 @@ int - SProcXIQueryDevice(ClientPtr client) - { - REQUEST(xXIQueryDeviceReq); -+ REQUEST_SIZE_MATCH(xXIQueryDeviceReq); - - swaps(&stuff->length); - swaps(&stuff->deviceid); -diff --git a/Xi/xiquerypointer.c b/Xi/xiquerypointer.c -index e9bdd42..7ec0c85 100644 ---- Xi/xiquerypointer.c -+++ Xi/xiquerypointer.c -@@ -63,6 +63,8 @@ int - SProcXIQueryPointer(ClientPtr client) - { - REQUEST(xXIQueryPointerReq); -+ REQUEST_SIZE_MATCH(xXIQueryPointerReq); -+ - swaps(&stuff->length); - swaps(&stuff->deviceid); - swapl(&stuff->win); -diff --git a/Xi/xiselectev.c b/Xi/xiselectev.c -index 45a996e..168579f 100644 ---- Xi/xiselectev.c -+++ Xi/xiselectev.c -@@ -114,6 +114,7 @@ int - SProcXISelectEvents(ClientPtr client) - { - int i; -+ int len; - xXIEventMask *evmask; - - REQUEST(xXISelectEventsReq); -@@ -122,10 +123,17 @@ SProcXISelectEvents(ClientPtr client) - swapl(&stuff->win); - swaps(&stuff->num_masks); - -+ len = stuff->length - bytes_to_int32(sizeof(xXISelectEventsReq)); - evmask = (xXIEventMask *) &stuff[1]; - for (i = 0; i < stuff->num_masks; i++) { -+ if (len < bytes_to_int32(sizeof(xXIEventMask))) -+ return BadLength; -+ len -= bytes_to_int32(sizeof(xXIEventMask)); - swaps(&evmask->deviceid); - swaps(&evmask->mask_len); -+ if (len < evmask->mask_len) -+ return BadLength; -+ len -= evmask->mask_len; - evmask = - (xXIEventMask *) (((char *) &evmask[1]) + evmask->mask_len * 4); - } -diff --git a/Xi/xisetclientpointer.c b/Xi/xisetclientpointer.c -index 38ff51e..24d4a53 100644 ---- Xi/xisetclientpointer.c -+++ Xi/xisetclientpointer.c -@@ -51,10 +51,11 @@ int - SProcXISetClientPointer(ClientPtr client) - { - REQUEST(xXISetClientPointerReq); -+ REQUEST_SIZE_MATCH(xXISetClientPointerReq); -+ - swaps(&stuff->length); - swapl(&stuff->win); - swaps(&stuff->deviceid); -- REQUEST_SIZE_MATCH(xXISetClientPointerReq); - return (ProcXISetClientPointer(client)); - } - -diff --git a/Xi/xisetdevfocus.c b/Xi/xisetdevfocus.c -index 372ec24..96a9a16 100644 ---- Xi/xisetdevfocus.c -+++ Xi/xisetdevfocus.c -@@ -44,6 +44,8 @@ int - SProcXISetFocus(ClientPtr client) - { - REQUEST(xXISetFocusReq); -+ REQUEST_AT_LEAST_SIZE(xXISetFocusReq); -+ - swaps(&stuff->length); - swaps(&stuff->deviceid); - swapl(&stuff->focus); -@@ -56,6 +58,8 @@ int - SProcXIGetFocus(ClientPtr client) - { - REQUEST(xXIGetFocusReq); -+ REQUEST_AT_LEAST_SIZE(xXIGetFocusReq); -+ - swaps(&stuff->length); - swaps(&stuff->deviceid); - -diff --git a/Xi/xiwarppointer.c b/Xi/xiwarppointer.c -index 3f051f7..780758a 100644 ---- Xi/xiwarppointer.c -+++ Xi/xiwarppointer.c -@@ -56,6 +56,8 @@ int - SProcXIWarpPointer(ClientPtr client) - { - REQUEST(xXIWarpPointerReq); -+ REQUEST_SIZE_MATCH(xXIWarpPointerReq); -+ - swaps(&stuff->length); - swapl(&stuff->src_win); - swapl(&stuff->dst_win); -diff --git a/include/dix.h b/include/dix.h -index e0c6ed8..21176a8 100644 ---- include/dix.h -+++ include/dix.h -@@ -74,6 +74,10 @@ SOFTWARE. - if ((sizeof(req) >> 2) > client->req_len )\ - return(BadLength) - -+#define REQUEST_AT_LEAST_EXTRA_SIZE(req, extra) \ -+ if (((sizeof(req) + ((uint64_t) extra)) >> 2) > client->req_len ) \ -+ return(BadLength) -+ - #define REQUEST_FIXED_SIZE(req, n)\ - if (((sizeof(req) >> 2) > client->req_len) || \ - ((n >> 2) >= client->req_len) || \ --- -cgit v0.10.2 - diff --git a/x11-servers/xorg-server/files/patch-CVE-2014-8096 b/x11-servers/xorg-server/files/patch-CVE-2014-8096 deleted file mode 100644 index 789801a..0000000 --- a/x11-servers/xorg-server/files/patch-CVE-2014-8096 +++ /dev/null @@ -1,27 +0,0 @@ -From 7553082b9b883b5f130044f3d53bce2f0b660e52 Mon Sep 17 00:00:00 2001 -From: Alan Coopersmith <alan.coopersmith@oracle.com> -Date: Sun, 26 Jan 2014 17:18:54 -0800 -Subject: [PATCH 08/40] xcmisc: unvalidated length in SProcXCMiscGetXIDList() - [CVE-2014-8096] - -Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> -Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> ---- - Xext/xcmisc.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/Xext/xcmisc.c b/Xext/xcmisc.c -index 034bfb6..1e91010 100644 ---- Xext/xcmisc.c -+++ Xext/xcmisc.c -@@ -167,6 +167,7 @@ static int - SProcXCMiscGetXIDList(ClientPtr client) - { - REQUEST(xXCMiscGetXIDListReq); -+ REQUEST_SIZE_MATCH(xXCMiscGetXIDListReq); - - swaps(&stuff->length); - swapl(&stuff->count); --- -2.1.2 - diff --git a/x11-servers/xorg-server/files/patch-CVE-2014-8097 b/x11-servers/xorg-server/files/patch-CVE-2014-8097 deleted file mode 100644 index 19964c2..0000000 --- a/x11-servers/xorg-server/files/patch-CVE-2014-8097 +++ /dev/null @@ -1,73 +0,0 @@ -From 2ef42519c41e793579c9cea699c866fee3d9321f Mon Sep 17 00:00:00 2001 -From: Alan Coopersmith <alan.coopersmith@oracle.com> -Date: Wed, 22 Jan 2014 23:12:04 -0800 -Subject: [PATCH 06/40] dbe: unvalidated lengths in DbeSwapBuffers calls - [CVE-2014-8097] - -ProcDbeSwapBuffers() has a 32bit (n) length value that it uses to read -from a buffer. The length is never validated, which can lead to out of -bound reads, and possibly returning the data read from out of bounds to -the misbehaving client via an X Error packet. - -SProcDbeSwapBuffers() swaps data (for correct endianness) before -handing it off to the real proc. While doing the swapping, the -length field is not validated, which can cause memory corruption. - -v2: reorder checks to avoid compilers optimizing out checks for overflow -that happen after we'd already have done the overflowing multiplications. - -Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> -Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> -Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> ---- - dbe/dbe.c | 11 ++++++++--- - 1 file changed, 8 insertions(+), 3 deletions(-) - -diff --git a/dbe/dbe.c b/dbe/dbe.c -index 527588c..df2ad5c 100644 ---- dbe/dbe.c -+++ dbe/dbe.c -@@ -450,18 +450,20 @@ ProcDbeSwapBuffers(ClientPtr client) - DbeSwapInfoPtr swapInfo; - xDbeSwapInfo *dbeSwapInfo; - int error; -- register int i, j; -- int nStuff; -+ unsigned int i, j; -+ unsigned int nStuff; - - REQUEST_AT_LEAST_SIZE(xDbeSwapBuffersReq); - nStuff = stuff->n; /* use local variable for performance. */ - - if (nStuff == 0) { -+ REQUEST_SIZE_MATCH(xDbeSwapBuffersReq); - return Success; - } - - if (nStuff > UINT32_MAX / sizeof(DbeSwapInfoRec)) - return BadAlloc; -+ REQUEST_FIXED_SIZE(xDbeSwapBuffersReq, nStuff * sizeof(xDbeSwapInfo)); - - /* Get to the swap info appended to the end of the request. */ - dbeSwapInfo = (xDbeSwapInfo *) &stuff[1]; -@@ -914,13 +916,16 @@ static int - SProcDbeSwapBuffers(ClientPtr client) - { - REQUEST(xDbeSwapBuffersReq); -- register int i; -+ unsigned int i; - xDbeSwapInfo *pSwapInfo; - - swaps(&stuff->length); - REQUEST_AT_LEAST_SIZE(xDbeSwapBuffersReq); - - swapl(&stuff->n); -+ if (stuff->n > UINT32_MAX / sizeof(DbeSwapInfoRec)) -+ return BadAlloc; -+ REQUEST_FIXED_SIZE(xDbeSwapBuffersReq, stuff->n * sizeof(xDbeSwapInfo)); - - if (stuff->n != 0) { - pSwapInfo = (xDbeSwapInfo *) stuff + 1; --- -2.1.2 - diff --git a/x11-servers/xorg-server/files/patch-CVE-2014-8097-pt2 b/x11-servers/xorg-server/files/patch-CVE-2014-8097-pt2 deleted file mode 100644 index 70b8987..0000000 --- a/x11-servers/xorg-server/files/patch-CVE-2014-8097-pt2 +++ /dev/null @@ -1,50 +0,0 @@ -From b20912c3d45cbbde3c443e6c3d9e189092fe65e1 Mon Sep 17 00:00:00 2001 -From: Keith Packard <keithp@keithp.com> -Date: Tue, 9 Dec 2014 09:30:57 -0800 -Subject: [PATCH 36/40] dbe: Call to DDX SwapBuffers requires address of int, - not unsigned int [CVE-2014-8097 pt. 2] - -When the local types used to walk the DBE request were changed, this -changed the type of the parameter passed to the DDX SwapBuffers API, -but there wasn't a matching change in the API definition. - -At this point, with the API frozen, I just stuck a new variable in -with the correct type. Because we've already bounds-checked nStuff to -be smaller than UINT32_MAX / sizeof(DbeSwapInfoRec), we know it will -fit in a signed int without overflow. - -Signed-off-by: Keith Packard <keithp@keithp.com -Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com> -Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> ---- - dbe/dbe.c | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - -diff --git a/dbe/dbe.c b/dbe/dbe.c -index df2ad5c..e5d928d 100644 ---- dbe/dbe.c -+++ dbe/dbe.c -@@ -452,6 +452,7 @@ ProcDbeSwapBuffers(ClientPtr client) - int error; - unsigned int i, j; - unsigned int nStuff; -+ int nStuff_i; /* DDX API requires int for nStuff */ - - REQUEST_AT_LEAST_SIZE(xDbeSwapBuffersReq); - nStuff = stuff->n; /* use local variable for performance. */ -@@ -527,9 +528,10 @@ ProcDbeSwapBuffers(ClientPtr client) - * could deal with cross-screen synchronization. - */ - -- while (nStuff > 0) { -+ nStuff_i = nStuff; -+ while (nStuff_i > 0) { - pDbeScreenPriv = DBE_SCREEN_PRIV_FROM_WINDOW(swapInfo[0].pWindow); -- error = (*pDbeScreenPriv->SwapBuffers) (client, &nStuff, swapInfo); -+ error = (*pDbeScreenPriv->SwapBuffers) (client, &nStuff_i, swapInfo); - if (error != Success) { - free(swapInfo); - return error; --- -2.1.2 - diff --git a/x11-servers/xorg-server/files/patch-CVE-2014-8098-1-8 b/x11-servers/xorg-server/files/patch-CVE-2014-8098-1-8 deleted file mode 100644 index 658fa96..0000000 --- a/x11-servers/xorg-server/files/patch-CVE-2014-8098-1-8 +++ /dev/null @@ -1,59 +0,0 @@ -From 13d36923e0ddb077f4854e354c3d5c80590b5d9d Mon Sep 17 00:00:00 2001 -From: Adam Jackson <ajax@redhat.com> -Date: Mon, 10 Nov 2014 12:13:39 -0500 -Subject: [PATCH 22/40] glx: Fix image size computation for EXT_texture_integer - [CVE-2014-8098 1/8] - -Without this we'd reject the request with BadLength. Note that some old -versions of Mesa had a bug in the same place, and would _send_ zero -bytes of image data; these will now be rejected, correctly. - -Reviewed-by: Keith Packard <keithp@keithp.com> -Reviewed-by: Julien Cristau <jcristau@debian.org> -Reviewed-by: Michal Srb <msrb@suse.com> -Reviewed-by: Andy Ritger <aritger@nvidia.com> -Signed-off-by: Adam Jackson <ajax@redhat.com> -Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> ---- - glx/rensize.c | 10 ++++++++++ - 1 file changed, 10 insertions(+) - -diff --git a/glx/rensize.c b/glx/rensize.c -index ba22d10..9ff73c7 100644 ---- glx/rensize.c -+++ glx/rensize.c -@@ -224,6 +224,11 @@ __glXImageSize(GLenum format, GLenum type, GLenum target, - case GL_ALPHA: - case GL_LUMINANCE: - case GL_INTENSITY: -+ case GL_RED_INTEGER_EXT: -+ case GL_GREEN_INTEGER_EXT: -+ case GL_BLUE_INTEGER_EXT: -+ case GL_ALPHA_INTEGER_EXT: -+ case GL_LUMINANCE_INTEGER_EXT: - elementsPerGroup = 1; - break; - case GL_422_EXT: -@@ -234,14 +239,19 @@ __glXImageSize(GLenum format, GLenum type, GLenum target, - case GL_DEPTH_STENCIL_MESA: - case GL_YCBCR_MESA: - case GL_LUMINANCE_ALPHA: -+ case GL_LUMINANCE_ALPHA_INTEGER_EXT: - elementsPerGroup = 2; - break; - case GL_RGB: - case GL_BGR: -+ case GL_RGB_INTEGER_EXT: -+ case GL_BGR_INTEGER_EXT: - elementsPerGroup = 3; - break; - case GL_RGBA: - case GL_BGRA: -+ case GL_RGBA_INTEGER_EXT: -+ case GL_BGRA_INTEGER_EXT: - case GL_ABGR_EXT: - elementsPerGroup = 4; - break; --- -2.1.2 - diff --git a/x11-servers/xorg-server/files/patch-CVE-2014-8098-2-8 b/x11-servers/xorg-server/files/patch-CVE-2014-8098-2-8 deleted file mode 100644 index bbbc5b6..0000000 --- a/x11-servers/xorg-server/files/patch-CVE-2014-8098-2-8 +++ /dev/null @@ -1,75 +0,0 @@ -From be09e0c988ffdb0371293af49fb4ea8f49ed324a Mon Sep 17 00:00:00 2001 -From: Julien Cristau <jcristau@debian.org> -Date: Mon, 10 Nov 2014 12:13:41 -0500 -Subject: [PATCH 24/40] glx: Length checking for GLXRender requests (v2) - [CVE-2014-8098 2/8] - -v2: -Remove can't-happen comparison for cmdlen < 0 (Michal Srb) - -Reviewed-by: Adam Jackson <ajax@redhat.com> -Reviewed-by: Michal Srb <msrb@suse.com> -Reviewed-by: Andy Ritger <aritger@nvidia.com> -Signed-off-by: Julien Cristau <jcristau@debian.org> -Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> ---- - glx/glxcmds.c | 21 ++++++++++----------- - 1 file changed, 10 insertions(+), 11 deletions(-) - -diff --git a/glx/glxcmds.c b/glx/glxcmds.c -index ea42e2a..ddd9119 100644 ---- glx/glxcmds.c -+++ glx/glxcmds.c -@@ -2025,7 +2025,7 @@ __glXDisp_Render(__GLXclientState * cl, GLbyte * pc) - left = (req->length << 2) - sz_xGLXRenderReq; - while (left > 0) { - __GLXrenderSizeData entry; -- int extra; -+ int extra = 0; - __GLXdispatchRenderProcPtr proc; - int err; - -@@ -2044,6 +2044,9 @@ __glXDisp_Render(__GLXclientState * cl, GLbyte * pc) - cmdlen = hdr->length; - opcode = hdr->opcode; - -+ if (left < cmdlen) -+ return BadLength; -+ - /* - ** Check for core opcodes and grab entry data. - */ -@@ -2057,6 +2060,10 @@ __glXDisp_Render(__GLXclientState * cl, GLbyte * pc) - return __glXError(GLXBadRenderRequest); - } - -+ if (cmdlen < entry.bytes) { -+ return BadLength; -+ } -+ - if (entry.varsize) { - /* variable size command */ - extra = (*entry.varsize) (pc + __GLX_RENDER_HDR_SIZE, -@@ -2064,17 +2071,9 @@ __glXDisp_Render(__GLXclientState * cl, GLbyte * pc) - if (extra < 0) { - return BadLength; - } -- if (cmdlen != __GLX_PAD(entry.bytes + extra)) { -- return BadLength; -- } - } -- else { -- /* constant size command */ -- if (cmdlen != __GLX_PAD(entry.bytes)) { -- return BadLength; -- } -- } -- if (left < cmdlen) { -+ -+ if (cmdlen != safe_pad(safe_add(entry.bytes, extra))) { - return BadLength; - } - --- -2.1.2 - diff --git a/x11-servers/xorg-server/files/patch-CVE-2014-8098-3-8 b/x11-servers/xorg-server/files/patch-CVE-2014-8098-3-8 deleted file mode 100644 index 0f54277..0000000 --- a/x11-servers/xorg-server/files/patch-CVE-2014-8098-3-8 +++ /dev/null @@ -1,153 +0,0 @@ -From a33a939e6abb255b14d8dbc85fcbd2c55b958bae Mon Sep 17 00:00:00 2001 -From: Adam Jackson <ajax@redhat.com> -Date: Mon, 10 Nov 2014 12:13:43 -0500 -Subject: [PATCH 26/40] glx: Length checking for RenderLarge requests (v2) - [CVE-2014-8098 3/8] - -This is a half-measure until we start passing request length into the -varsize function, but it's better than the nothing we had before. - -v2: Verify that there's at least a large render header's worth of -dataBytes (Julien Cristau) - -Reviewed-by: Michal Srb <msrb@suse.com> -Reviewed-by: Andy Ritger <aritger@nvidia.com> -Signed-off-by: Adam Jackson <ajax@redhat.com> -Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> ---- - glx/glxcmds.c | 57 ++++++++++++++++++++++++++++++++++----------------------- - 1 file changed, 34 insertions(+), 23 deletions(-) - ---- glx/glxcmds.c.orig 2014-12-10 14:30:17.826442820 +0100 -+++ glx/glxcmds.c 2014-12-10 14:32:34.472432537 +0100 -@@ -2032,6 +2032,8 @@ - - __GLX_DECLARE_SWAP_VARIABLES; - -+ REQUEST_AT_LEAST_SIZE(xGLXRenderLargeReq); -+ - req = (xGLXRenderLargeReq *) pc; - if (client->swapped) { - __GLX_SWAP_SHORT(&req->length); -@@ -2047,12 +2049,14 @@ - __glXResetLargeCommandStatus(cl); - return error; - } -+ if (safe_pad(req->dataBytes) < 0) -+ return BadLength; - dataBytes = req->dataBytes; - - /* - ** Check the request length. - */ -- if ((req->length << 2) != __GLX_PAD(dataBytes) + sz_xGLXRenderLargeReq) { -+ if ((req->length << 2) != safe_pad(dataBytes) + sz_xGLXRenderLargeReq) { - client->errorValue = req->length; - /* Reset in case this isn't 1st request. */ - __glXResetLargeCommandStatus(cl); -@@ -2062,7 +2066,7 @@ - - if (cl->largeCmdRequestsSoFar == 0) { - __GLXrenderSizeData entry; -- int extra; -+ int extra = 0; - size_t cmdlen; - int err; - -@@ -2075,13 +2079,17 @@ - return __glXError(GLXBadLargeRequest); - } - -+ if (dataBytes < __GLX_RENDER_LARGE_HDR_SIZE) -+ return BadLength; -+ - hdr = (__GLXrenderLargeHeader *) pc; - if (client->swapped) { - __GLX_SWAP_INT(&hdr->length); - __GLX_SWAP_INT(&hdr->opcode); - } -- cmdlen = hdr->length; - opcode = hdr->opcode; -+ if ((cmdlen = safe_pad(hdr->length)) < 0) -+ return BadLength; - - /* - ** Check for core opcodes and grab entry data. -@@ -2103,17 +2111,13 @@ - if (extra < 0) { - return BadLength; - } -- /* large command's header is 4 bytes longer, so add 4 */ -- if (cmdlen != __GLX_PAD(entry.bytes + 4 + extra)) { -- return BadLength; -- } - } -- else { -- /* constant size command */ -- if (cmdlen != __GLX_PAD(entry.bytes + 4)) { -- return BadLength; -- } -+ -+ /* the +4 is safe because we know entry.bytes is small */ -+ if (cmdlen != safe_pad(safe_add(entry.bytes + 4, extra))) { -+ return BadLength; - } -+ - /* - ** Make enough space in the buffer, then copy the entire request. - */ -@@ -2143,6 +2147,7 @@ - ** We are receiving subsequent (i.e. not the first) requests of a - ** multi request command. - */ -+ int bytesSoFar; /* including this packet */ - - /* - ** Check the request number and the total request count. -@@ -2161,11 +2166,18 @@ - /* - ** Check that we didn't get too much data. - */ -- if ((cl->largeCmdBytesSoFar + dataBytes) > cl->largeCmdBytesTotal) { -+ if ((bytesSoFar = safe_add(cl->largeCmdBytesSoFar, dataBytes)) < 0) { -+ client->errorValue = dataBytes; -+ __glXResetLargeCommandStatus(cl); -+ return __glXError(GLXBadLargeRequest); -+ } -+ -+ if (bytesSoFar > cl->largeCmdBytesTotal) { - client->errorValue = dataBytes; - __glXResetLargeCommandStatus(cl); - return __glXError(GLXBadLargeRequest); - } -+ - memcpy(cl->largeCmdBuf + cl->largeCmdBytesSoFar, pc, dataBytes); - cl->largeCmdBytesSoFar += dataBytes; - cl->largeCmdRequestsSoFar++; -@@ -2177,17 +2189,16 @@ - ** This is the last request; it must have enough bytes to complete - ** the command. - */ -- /* NOTE: the two pad macros have been added below; they are needed -- ** because the client library pads the total byte count, but not -- ** the per-request byte counts. The Protocol Encoding says the -- ** total byte count should not be padded, so a proposal will be -- ** made to the ARB to relax the padding constraint on the total -- ** byte count, thus preserving backward compatibility. Meanwhile, -- ** the padding done below fixes a bug that did not allow -- ** large commands of odd sizes to be accepted by the server. -+ /* NOTE: the pad macro below is needed because the client library -+ ** pads the total byte count, but not the per-request byte counts. -+ ** The Protocol Encoding says the total byte count should not be -+ ** padded, so a proposal will be made to the ARB to relax the -+ ** padding constraint on the total byte count, thus preserving -+ ** backward compatibility. Meanwhile, the padding done below -+ ** fixes a bug that did not allow large commands of odd sizes to -+ ** be accepted by the server. - */ -- if (__GLX_PAD(cl->largeCmdBytesSoFar) != -- __GLX_PAD(cl->largeCmdBytesTotal)) { -+ if (safe_pad(cl->largeCmdBytesSoFar) != cl->largeCmdBytesTotal) { - client->errorValue = dataBytes; - __glXResetLargeCommandStatus(cl); - return __glXError(GLXBadLargeRequest); diff --git a/x11-servers/xorg-server/files/patch-CVE-2014-8098-4-8 b/x11-servers/xorg-server/files/patch-CVE-2014-8098-4-8 deleted file mode 100644 index 3a89be2..0000000 --- a/x11-servers/xorg-server/files/patch-CVE-2014-8098-4-8 +++ /dev/null @@ -1,51 +0,0 @@ -From c91e4abc3b892f42802efa20fef7ada442c2d3f5 Mon Sep 17 00:00:00 2001 -From: Adam Jackson <ajax@redhat.com> -Date: Mon, 10 Nov 2014 12:13:44 -0500 -Subject: [PATCH 27/40] glx: Top-level length checking for swapped - VendorPrivate requests [CVE-2014-8098 4/8] - -Reviewed-by: Keith Packard <keithp@keithp.com> -Reviewed-by: Julien Cristau <jcristau@debian.org> -Reviewed-by: Michal Srb <msrb@suse.com> -Reviewed-by: Andy Ritger <aritger@nvidia.com> -Signed-off-by: Adam Jackson <ajax@redhat.com> -Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> ---- - glx/glxcmdsswap.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/glx/glxcmdsswap.c b/glx/glxcmdsswap.c -index 5d179f3..9ec1222 100644 ---- glx/glxcmdsswap.c -+++ glx/glxcmdsswap.c -@@ -958,11 +958,13 @@ __glXDispSwap_RenderLarge(__GLXclientState * cl, GLbyte * pc) - int - __glXDispSwap_VendorPrivate(__GLXclientState * cl, GLbyte * pc) - { -+ ClientPtr client = cl->client; - xGLXVendorPrivateReq *req; - GLint vendorcode; - __GLXdispatchVendorPrivProcPtr proc; - - __GLX_DECLARE_SWAP_VARIABLES; -+ REQUEST_AT_LEAST_SIZE(xGLXVendorPrivateReq); - - req = (xGLXVendorPrivateReq *) pc; - __GLX_SWAP_SHORT(&req->length); -@@ -985,11 +987,13 @@ __glXDispSwap_VendorPrivate(__GLXclientState * cl, GLbyte * pc) - int - __glXDispSwap_VendorPrivateWithReply(__GLXclientState * cl, GLbyte * pc) - { -+ ClientPtr client = cl->client; - xGLXVendorPrivateWithReplyReq *req; - GLint vendorcode; - __GLXdispatchVendorPrivProcPtr proc; - - __GLX_DECLARE_SWAP_VARIABLES; -+ REQUEST_AT_LEAST_SIZE(xGLXVendorPrivateWithReplyReq); - - req = (xGLXVendorPrivateWithReplyReq *) pc; - __GLX_SWAP_SHORT(&req->length); --- -2.1.2 - diff --git a/x11-servers/xorg-server/files/patch-CVE-2014-8098-6-8 b/x11-servers/xorg-server/files/patch-CVE-2014-8098-6-8 deleted file mode 100644 index 1a043b8..0000000 --- a/x11-servers/xorg-server/files/patch-CVE-2014-8098-6-8 +++ /dev/null @@ -1,45 +0,0 @@ -From 44ba149f28ece93c2fbfc9cc980588de5322dd4b Mon Sep 17 00:00:00 2001 -From: Adam Jackson <ajax@redhat.com> -Date: Mon, 10 Nov 2014 12:13:46 -0500 -Subject: [PATCH 29/40] glx: Length-checking for non-generated vendor private - requests [CVE-2014-8098 6/8] - -Reviewed-by: Keith Packard <keithp@keithp.com> -Reviewed-by: Michal Srb <msrb@suse.com> -Reviewed-by: Andy Ritger <aritger@nvidia.com> -Signed-off-by: Adam Jackson <ajax@redhat.com> -Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> ---- - glx/indirect_program.c | 2 ++ - glx/swap_interval.c | 2 ++ - 2 files changed, 4 insertions(+) - -diff --git a/glx/indirect_program.c b/glx/indirect_program.c -index cda139e..5caee7b 100644 ---- glx/indirect_program.c -+++ glx/indirect_program.c -@@ -56,6 +56,8 @@ DoGetProgramString(struct __GLXclientStateRec *cl, GLbyte * pc, - __GLXcontext *const cx = __glXForceCurrent(cl, req->contextTag, &error); - ClientPtr client = cl->client; - -+ REQUEST_FIXED_SIZE(xGLXVendorPrivateWithReplyReq, 8); -+ - pc += __GLX_VENDPRIV_HDR_SIZE; - if (cx != NULL) { - GLenum target; -diff --git a/glx/swap_interval.c b/glx/swap_interval.c -index 17bc992..2320550 100644 ---- glx/swap_interval.c -+++ glx/swap_interval.c -@@ -46,6 +46,8 @@ DoSwapInterval(__GLXclientState * cl, GLbyte * pc, int do_swap) - __GLXcontext *cx; - GLint interval; - -+ REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 4); -+ - cx = __glXLookupContextByTag(cl, tag); - - if ((cx == NULL) || (cx->pGlxScreen == NULL)) { --- -2.1.2 - diff --git a/x11-servers/xorg-server/files/patch-CVE-2014-8098-7-8 b/x11-servers/xorg-server/files/patch-CVE-2014-8098-7-8 deleted file mode 100644 index 76fa0e0..0000000 --- a/x11-servers/xorg-server/files/patch-CVE-2014-8098-7-8 +++ /dev/null @@ -1,553 +0,0 @@ -From 984583a497c813df5827ae22483133e704fee79c Mon Sep 17 00:00:00 2001 -From: Adam Jackson <ajax@redhat.com> -Date: Mon, 10 Nov 2014 12:13:47 -0500 -Subject: [PATCH 30/40] glx: Length checking for non-generated single requests - (v2) [CVE-2014-8098 7/8] - -v2: -Fix single versus vendor-private length checking for ARB_imaging subset -extensions. (Julien Cristau) - -v3: -Fix single versus vendor-private length checking for ARB_imaging subset -extensions. (Julien Cristau) - -Reviewed-by: Michal Srb <msrb@suse.com> -Reviewed-by: Andy Ritger <aritger@nvidia.com> -Signed-off-by: Adam Jackson <ajax@redhat.com> -Signed-off-by: Julien Cristau <jcristau@debian.org> -Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> ---- - glx/indirect_texture_compression.c | 4 ++++ - glx/single2.c | 23 +++++++++++++++----- - glx/single2swap.c | 19 ++++++++++++---- - glx/singlepix.c | 44 +++++++++++++++++++++++++------------- - glx/singlepixswap.c | 34 ++++++++++++++++++++++++----- - 5 files changed, 95 insertions(+), 29 deletions(-) - -diff --git a/glx/indirect_texture_compression.c b/glx/indirect_texture_compression.c -index cda7656..1ebf7f3 100644 ---- glx/indirect_texture_compression.c -+++ glx/indirect_texture_compression.c -@@ -43,6 +43,8 @@ __glXDisp_GetCompressedTexImage(struct __GLXclientStateRec *cl, GLbyte * pc) - __GLXcontext *const cx = __glXForceCurrent(cl, req->contextTag, &error); - ClientPtr client = cl->client; - -+ REQUEST_FIXED_SIZE(xGLXSingleReq, 8); -+ - pc += __GLX_SINGLE_HDR_SIZE; - if (cx != NULL) { - const GLenum target = *(GLenum *) (pc + 0); -@@ -87,6 +89,8 @@ __glXDispSwap_GetCompressedTexImage(struct __GLXclientStateRec *cl, GLbyte * pc) - __glXForceCurrent(cl, bswap_32(req->contextTag), &error); - ClientPtr client = cl->client; - -+ REQUEST_FIXED_SIZE(xGLXSingleReq, 8); -+ - pc += __GLX_SINGLE_HDR_SIZE; - if (cx != NULL) { - const GLenum target = (GLenum) bswap_32(*(int *) (pc + 0)); ---- glx/single2.c.orig 2014-04-15 03:01:57.000000000 +0200 -+++ glx/single2.c 2014-12-11 09:08:22.788060618 +0100 -@@ -49,11 +49,14 @@ - int - __glXDisp_FeedbackBuffer(__GLXclientState * cl, GLbyte * pc) - { -+ ClientPtr client = cl->client; - GLsizei size; - GLenum type; - __GLXcontext *cx; - int error; - -+ REQUEST_FIXED_SIZE(xGLXSingleReq, 8); -+ - cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error); - if (!cx) { - return error; -@@ -80,10 +83,13 @@ - int - __glXDisp_SelectBuffer(__GLXclientState * cl, GLbyte * pc) - { -+ ClientPtr client = cl->client; - __GLXcontext *cx; - GLsizei size; - int error; - -+ REQUEST_FIXED_SIZE(xGLXSingleReq, 4); -+ - cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error); - if (!cx) { - return error; -@@ -108,7 +114,7 @@ - int - __glXDisp_RenderMode(__GLXclientState * cl, GLbyte * pc) - { -- ClientPtr client; -+ ClientPtr client = cl->client; - xGLXRenderModeReply reply; - __GLXcontext *cx; - GLint nitems = 0, retBytes = 0, retval, newModeCheck; -@@ -116,6 +122,8 @@ - GLenum newMode; - int error; - -+ REQUEST_FIXED_SIZE(xGLXSingleReq, 4); -+ - cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error); - if (!cx) { - return error; -@@ -192,7 +200,6 @@ - ** selection array, as per the API for glRenderMode itself. - */ - noChangeAllowed:; -- client = cl->client; - reply = (xGLXRenderModeReply) { - .type = X_Reply, - .sequenceNumber = client->sequence, -@@ -211,9 +218,12 @@ - int - __glXDisp_Flush(__GLXclientState * cl, GLbyte * pc) - { -+ ClientPtr client = cl->client; - __GLXcontext *cx; - int error; - -+ REQUEST_SIZE_MATCH(xGLXSingleReq); -+ - cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error); - if (!cx) { - return error; -@@ -227,10 +237,12 @@ - int - __glXDisp_Finish(__GLXclientState * cl, GLbyte * pc) - { -+ ClientPtr client = cl->client; - __GLXcontext *cx; -- ClientPtr client; - int error; - -+ REQUEST_SIZE_MATCH(xGLXSingleReq); -+ - cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error); - if (!cx) { - return error; -@@ -321,7 +332,7 @@ - int - DoGetString(__GLXclientState * cl, GLbyte * pc, GLboolean need_swap) - { -- ClientPtr client; -+ ClientPtr client = cl->client; - __GLXcontext *cx; - GLenum name; - const char *string; -@@ -331,6 +342,8 @@ - char *buf = NULL, *buf1 = NULL; - GLint length = 0; - -+ REQUEST_FIXED_SIZE(xGLXSingleReq, 4); -+ - /* If the client has the opposite byte order, swap the contextTag and - * the name. - */ -@@ -347,7 +360,6 @@ - pc += __GLX_SINGLE_HDR_SIZE; - name = *(GLenum *) (pc + 0); - string = (const char *) CALL_GetString(GET_DISPATCH(), (name)); -- client = cl->client; - - if (string == NULL) - string = ""; ---- glx/single2swap.c.orig 2014-04-15 03:01:57.000000000 +0200 -+++ glx/single2swap.c 2014-12-11 09:05:12.670056539 +0100 -@@ -45,6 +45,7 @@ - int - __glXDispSwap_FeedbackBuffer(__GLXclientState * cl, GLbyte * pc) - { -+ ClientPtr client = cl->client; - GLsizei size; - GLenum type; - -@@ -52,6 +53,8 @@ - __GLXcontext *cx; - int error; - -+ REQUEST_FIXED_SIZE(xGLXSingleReq, 8); -+ - __GLX_SWAP_INT(&((xGLXSingleReq *) pc)->contextTag); - cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error); - if (!cx) { -@@ -81,12 +84,15 @@ - int - __glXDispSwap_SelectBuffer(__GLXclientState * cl, GLbyte * pc) - { -+ ClientPtr client = cl->client; - __GLXcontext *cx; - GLsizei size; - - __GLX_DECLARE_SWAP_VARIABLES; - int error; - -+ REQUEST_FIXED_SIZE(xGLXSingleReq, 4); -+ - __GLX_SWAP_INT(&((xGLXSingleReq *) pc)->contextTag); - cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error); - if (!cx) { -@@ -113,7 +119,7 @@ - int - __glXDispSwap_RenderMode(__GLXclientState * cl, GLbyte * pc) - { -- ClientPtr client; -+ ClientPtr client = cl->client; - __GLXcontext *cx; - xGLXRenderModeReply reply; - GLint nitems = 0, retBytes = 0, retval, newModeCheck; -@@ -124,6 +130,8 @@ - __GLX_DECLARE_SWAP_ARRAY_VARIABLES; - int error; - -+ REQUEST_FIXED_SIZE(xGLXSingleReq, 4); -+ - __GLX_SWAP_INT(&((xGLXSingleReq *) pc)->contextTag); - cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error); - if (!cx) { -@@ -204,7 +212,6 @@ - ** selection array, as per the API for glRenderMode itself. - */ - noChangeAllowed:; -- client = cl->client; - reply = (xGLXRenderModeReply) { - .type = X_Reply, - .sequenceNumber = client->sequence, -@@ -228,11 +235,14 @@ - int - __glXDispSwap_Flush(__GLXclientState * cl, GLbyte * pc) - { -+ ClientPtr client = cl->client; - __GLXcontext *cx; - int error; - - __GLX_DECLARE_SWAP_VARIABLES; - -+ REQUEST_SIZE_MATCH(xGLXSingleReq); -+ - __GLX_SWAP_INT(&((xGLXSingleReq *) pc)->contextTag); - cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error); - if (!cx) { -@@ -247,12 +257,14 @@ - int - __glXDispSwap_Finish(__GLXclientState * cl, GLbyte * pc) - { -+ ClientPtr client = cl->client; - __GLXcontext *cx; -- ClientPtr client; - int error; - - __GLX_DECLARE_SWAP_VARIABLES; - -+ REQUEST_SIZE_MATCH(xGLXSingleReq); -+ - __GLX_SWAP_INT(&((xGLXSingleReq *) pc)->contextTag); - cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error); - if (!cx) { -@@ -264,7 +276,6 @@ - cx->hasUnflushedCommands = GL_FALSE; - - /* Send empty reply packet to indicate finish is finished */ -- client = cl->client; - __GLX_BEGIN_REPLY(0); - __GLX_PUT_RETVAL(0); - __GLX_SWAP_REPLY_HEADER(); ---- glx/singlepix.c.orig 2014-12-11 09:04:51.072058678 +0100 -+++ glx/singlepix.c 2014-12-11 09:10:51.484033826 +0100 -@@ -55,6 +55,8 @@ - int error; - char *answer, answerBuffer[200]; - -+ REQUEST_FIXED_SIZE(xGLXSingleReq, 28); -+ - cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error); - if (!cx) { - return error; -@@ -107,6 +109,8 @@ - char *answer, answerBuffer[200]; - GLint width = 0, height = 0, depth = 1; - -+ REQUEST_FIXED_SIZE(xGLXSingleReq, 20); -+ - cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error); - if (!cx) { - return error; -@@ -169,6 +173,8 @@ - GLubyte answerBuffer[200]; - char *answer; - -+ REQUEST_FIXED_SIZE(xGLXSingleReq, 4); -+ - cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error); - if (!cx) { - return error; -@@ -231,15 +237,13 @@ - compsize = __glGetTexImage_size(target, 1, format, type, width, 1, 1); - compsize2 = __glGetTexImage_size(target, 1, format, type, height, 1, 1); - -- if (compsize < 0) -+ if ((compsize = safe_pad(compsize)) < 0) - return BadLength; -- if (compsize2 < 0) -+ if ((compsize2 = safe_pad(compsize2)) < 0) - return BadLength; -- compsize = __GLX_PAD(compsize); -- compsize2 = __GLX_PAD(compsize2); - - CALL_PixelStorei(GET_DISPATCH(), (GL_PACK_SWAP_BYTES, swapBytes)); -- __GLX_GET_ANSWER_BUFFER(answer, cl, compsize + compsize2, 1); -+ __GLX_GET_ANSWER_BUFFER(answer, cl, safe_add(compsize, compsize2), 1); - __glXClearErrorOccured(); - CALL_GetSeparableFilter(GET_DISPATCH(), (*(GLenum *) (pc + 0), - *(GLenum *) (pc + 4), -@@ -265,7 +269,8 @@ - __glXDisp_GetSeparableFilter(__GLXclientState * cl, GLbyte * pc) - { - const GLXContextTag tag = __GLX_GET_SINGLE_CONTEXT_TAG(pc); -- -+ ClientPtr client = cl->client; -+ REQUEST_FIXED_SIZE(xGLXSingleReq, 16); - return GetSeparableFilter(cl, pc + __GLX_SINGLE_HDR_SIZE, tag); - } - -@@ -273,7 +278,8 @@ - __glXDisp_GetSeparableFilterEXT(__GLXclientState * cl, GLbyte * pc) - { - const GLXContextTag tag = __GLX_GET_VENDPRIV_CONTEXT_TAG(pc); -- -+ ClientPtr client = cl->client; -+ REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 16); - return GetSeparableFilter(cl, pc + __GLX_VENDPRIV_HDR_SIZE, tag); - } - -@@ -343,7 +349,8 @@ - __glXDisp_GetConvolutionFilter(__GLXclientState * cl, GLbyte * pc) - { - const GLXContextTag tag = __GLX_GET_SINGLE_CONTEXT_TAG(pc); -- -+ ClientPtr client = cl->client; -+ REQUEST_FIXED_SIZE(xGLXSingleReq, 16); - return GetConvolutionFilter(cl, pc + __GLX_SINGLE_HDR_SIZE, tag); - } - -@@ -351,7 +358,8 @@ - __glXDisp_GetConvolutionFilterEXT(__GLXclientState * cl, GLbyte * pc) - { - const GLXContextTag tag = __GLX_GET_VENDPRIV_CONTEXT_TAG(pc); -- -+ ClientPtr client = cl->client; -+ REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 16); - return GetConvolutionFilter(cl, pc + __GLX_VENDPRIV_HDR_SIZE, tag); - } - -@@ -411,7 +419,8 @@ - __glXDisp_GetHistogram(__GLXclientState * cl, GLbyte * pc) - { - const GLXContextTag tag = __GLX_GET_SINGLE_CONTEXT_TAG(pc); -- -+ ClientPtr client = cl->client; -+ REQUEST_FIXED_SIZE(xGLXSingleReq, 16); - return GetHistogram(cl, pc + __GLX_SINGLE_HDR_SIZE, tag); - } - -@@ -419,7 +428,8 @@ - __glXDisp_GetHistogramEXT(__GLXclientState * cl, GLbyte * pc) - { - const GLXContextTag tag = __GLX_GET_VENDPRIV_CONTEXT_TAG(pc); -- -+ ClientPtr client = cl->client; -+ REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 16); - return GetHistogram(cl, pc + __GLX_VENDPRIV_HDR_SIZE, tag); - } - -@@ -471,7 +481,8 @@ - __glXDisp_GetMinmax(__GLXclientState * cl, GLbyte * pc) - { - const GLXContextTag tag = __GLX_GET_SINGLE_CONTEXT_TAG(pc); -- -+ ClientPtr client = cl->client; -+ REQUEST_FIXED_SIZE(xGLXSingleReq, 16); - return GetMinmax(cl, pc + __GLX_SINGLE_HDR_SIZE, tag); - } - -@@ -479,7 +490,8 @@ - __glXDisp_GetMinmaxEXT(__GLXclientState * cl, GLbyte * pc) - { - const GLXContextTag tag = __GLX_GET_VENDPRIV_CONTEXT_TAG(pc); -- -+ ClientPtr client = cl->client; -+ REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 16); - return GetMinmax(cl, pc + __GLX_VENDPRIV_HDR_SIZE, tag); - } - -@@ -540,7 +552,8 @@ - __glXDisp_GetColorTable(__GLXclientState * cl, GLbyte * pc) - { - const GLXContextTag tag = __GLX_GET_SINGLE_CONTEXT_TAG(pc); -- -+ ClientPtr client = cl->client; -+ REQUEST_FIXED_SIZE(xGLXSingleReq, 16); - return GetColorTable(cl, pc + __GLX_SINGLE_HDR_SIZE, tag); - } - -@@ -548,6 +561,7 @@ - __glXDisp_GetColorTableSGI(__GLXclientState * cl, GLbyte * pc) - { - const GLXContextTag tag = __GLX_GET_VENDPRIV_CONTEXT_TAG(pc); -- -+ ClientPtr client = cl->client; -+ REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 16); - return GetColorTable(cl, pc + __GLX_VENDPRIV_HDR_SIZE, tag); - } ---- glx/singlepixswap.c.orig 2014-12-11 09:04:51.073058638 +0100 -+++ glx/singlepixswap.c 2014-12-11 09:12:14.151301716 +0100 -@@ -57,6 +57,8 @@ - int error; - char *answer, answerBuffer[200]; - -+ REQUEST_FIXED_SIZE(xGLXSingleReq, 28); -+ - __GLX_SWAP_INT(&((xGLXSingleReq *) pc)->contextTag); - cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error); - if (!cx) { -@@ -122,6 +124,8 @@ - char *answer, answerBuffer[200]; - GLint width = 0, height = 0, depth = 1; - -+ REQUEST_FIXED_SIZE(xGLXSingleReq, 20); -+ - __GLX_SWAP_INT(&((xGLXSingleReq *) pc)->contextTag); - cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error); - if (!cx) { -@@ -197,6 +201,8 @@ - - __GLX_DECLARE_SWAP_VARIABLES; - -+ REQUEST_FIXED_SIZE(xGLXSingleReq, 4); -+ - __GLX_SWAP_INT(&((xGLXSingleReq *) pc)->contextTag); - cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error); - if (!cx) { -@@ -266,15 +272,13 @@ - compsize = __glGetTexImage_size(target, 1, format, type, width, 1, 1); - compsize2 = __glGetTexImage_size(target, 1, format, type, height, 1, 1); - -- if (compsize < 0) -+ if ((compsize =safe_pad(compsize)) < 0) - return BadLength; -- if (compsize2 < 0) -+ if ((compsize2 = safe_pad(compsize2)) < 0) - return BadLength; -- compsize = __GLX_PAD(compsize); -- compsize2 = __GLX_PAD(compsize2); - - CALL_PixelStorei(GET_DISPATCH(), (GL_PACK_SWAP_BYTES, !swapBytes)); -- __GLX_GET_ANSWER_BUFFER(answer, cl, compsize + compsize2, 1); -+ __GLX_GET_ANSWER_BUFFER(answer, cl, safe_add(compsize, compsize2), 1); - __glXClearErrorOccured(); - CALL_GetSeparableFilter(GET_DISPATCH(), (*(GLenum *) (pc + 0), - *(GLenum *) (pc + 4), -@@ -302,7 +306,9 @@ - __glXDispSwap_GetSeparableFilter(__GLXclientState * cl, GLbyte * pc) - { - const GLXContextTag tag = __GLX_GET_SINGLE_CONTEXT_TAG(pc); -+ ClientPtr client = cl->client; - -+ REQUEST_FIXED_SIZE(xGLXSingleReq, 16); - return GetSeparableFilter(cl, pc + __GLX_SINGLE_HDR_SIZE, tag); - } - -@@ -310,7 +316,9 @@ - __glXDispSwap_GetSeparableFilterEXT(__GLXclientState * cl, GLbyte * pc) - { - const GLXContextTag tag = __GLX_GET_VENDPRIV_CONTEXT_TAG(pc); -+ ClientPtr client = cl->client; - -+ REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 16); - return GetSeparableFilter(cl, pc + __GLX_VENDPRIV_HDR_SIZE, tag); - } - -@@ -388,7 +396,9 @@ - __glXDispSwap_GetConvolutionFilter(__GLXclientState * cl, GLbyte * pc) - { - const GLXContextTag tag = __GLX_GET_SINGLE_CONTEXT_TAG(pc); -+ ClientPtr client = cl->client; - -+ REQUEST_FIXED_SIZE(xGLXSingleReq, 16); - return GetConvolutionFilter(cl, pc + __GLX_SINGLE_HDR_SIZE, tag); - } - -@@ -396,7 +406,9 @@ - __glXDispSwap_GetConvolutionFilterEXT(__GLXclientState * cl, GLbyte * pc) - { - const GLXContextTag tag = __GLX_GET_VENDPRIV_CONTEXT_TAG(pc); -+ ClientPtr client = cl->client; - -+ REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 16); - return GetConvolutionFilter(cl, pc + __GLX_VENDPRIV_HDR_SIZE, tag); - } - -@@ -463,7 +475,9 @@ - __glXDispSwap_GetHistogram(__GLXclientState * cl, GLbyte * pc) - { - const GLXContextTag tag = __GLX_GET_SINGLE_CONTEXT_TAG(pc); -+ ClientPtr client = cl->client; - -+ REQUEST_FIXED_SIZE(xGLXSingleReq, 16); - return GetHistogram(cl, pc + __GLX_SINGLE_HDR_SIZE, tag); - } - -@@ -471,7 +485,9 @@ - __glXDispSwap_GetHistogramEXT(__GLXclientState * cl, GLbyte * pc) - { - const GLXContextTag tag = __GLX_GET_VENDPRIV_CONTEXT_TAG(pc); -+ ClientPtr client = cl->client; - -+ REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 16); - return GetHistogram(cl, pc + __GLX_VENDPRIV_HDR_SIZE, tag); - } - -@@ -529,7 +545,9 @@ - __glXDispSwap_GetMinmax(__GLXclientState * cl, GLbyte * pc) - { - const GLXContextTag tag = __GLX_GET_SINGLE_CONTEXT_TAG(pc); -+ ClientPtr client = cl->client; - -+ REQUEST_FIXED_SIZE(xGLXSingleReq, 16); - return GetMinmax(cl, pc + __GLX_SINGLE_HDR_SIZE, tag); - } - -@@ -537,7 +555,9 @@ - __glXDispSwap_GetMinmaxEXT(__GLXclientState * cl, GLbyte * pc) - { - const GLXContextTag tag = __GLX_GET_VENDPRIV_CONTEXT_TAG(pc); -+ ClientPtr client = cl->client; - -+ REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 16); - return GetMinmax(cl, pc + __GLX_VENDPRIV_HDR_SIZE, tag); - } - -@@ -605,7 +625,9 @@ - __glXDispSwap_GetColorTable(__GLXclientState * cl, GLbyte * pc) - { - const GLXContextTag tag = __GLX_GET_SINGLE_CONTEXT_TAG(pc); -+ ClientPtr client = cl->client; - -+ REQUEST_FIXED_SIZE(xGLXSingleReq, 16); - return GetColorTable(cl, pc + __GLX_SINGLE_HDR_SIZE, tag); - } - -@@ -613,6 +635,8 @@ - __glXDispSwap_GetColorTableSGI(__GLXclientState * cl, GLbyte * pc) - { - const GLXContextTag tag = __GLX_GET_VENDPRIV_CONTEXT_TAG(pc); -+ ClientPtr client = cl->client; - -+ REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 16); - return GetColorTable(cl, pc + __GLX_VENDPRIV_HDR_SIZE, tag); - } diff --git a/x11-servers/xorg-server/files/patch-CVE-2014-8098-8-8 b/x11-servers/xorg-server/files/patch-CVE-2014-8098-8-8 deleted file mode 100644 index defe212..0000000 --- a/x11-servers/xorg-server/files/patch-CVE-2014-8098-8-8 +++ /dev/null @@ -1,964 +0,0 @@ -From e883c170c15493ab3637c0a01890f5a7ca4e16a5 Mon Sep 17 00:00:00 2001 -From: Adam Jackson <ajax@redhat.com> -Date: Mon, 10 Nov 2014 12:13:48 -0500 -Subject: [PATCH 31/40] glx: Pass remaining request length into ->varsize (v2) - [CVE-2014-8098 8/8] - -v2: Handle more multiplies in indirect_reqsize.c (Julien Cristau) - -Reviewed-by: Julien Cristau <jcristau@debian.org> -Reviewed-by: Michal Srb <msrb@suse.com> -Reviewed-by: Andy Ritger <aritger@nvidia.com> -Signed-off-by: Adam Jackson <ajax@redhat.com> -Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> ---- - glx/glxcmds.c | 7 +- - glx/glxserver.h | 2 +- - glx/indirect_reqsize.c | 142 +++++++++++++++++++------------------- - glx/indirect_reqsize.h | 181 ++++++++++++++++++++++++++++++------------------- - glx/rensize.c | 27 +++++--- - 5 files changed, 205 insertions(+), 154 deletions(-) - ---- glx/glxcmds.c.orig 2014-12-10 15:58:29.877078381 +0100 -+++ glx/glxcmds.c 2014-12-10 16:02:02.578063888 +0100 -@@ -1990,7 +1990,8 @@ - if (entry.varsize) { - /* variable size command */ - extra = (*entry.varsize) (pc + __GLX_RENDER_HDR_SIZE, -- client->swapped); -+ client->swapped, -+ left - __GLX_RENDER_HDR_SIZE); - if (extra < 0) { - return BadLength; - } -@@ -2067,6 +2068,7 @@ - if (cl->largeCmdRequestsSoFar == 0) { - __GLXrenderSizeData entry; - int extra = 0; -+ int left = (req->length << 2) - sz_xGLXRenderLargeReq; - size_t cmdlen; - int err; - -@@ -2107,7 +2109,8 @@ - ** will be in the 1st request, so it's okay to do this. - */ - extra = (*entry.varsize) (pc + __GLX_RENDER_LARGE_HDR_SIZE, -- client->swapped); -+ client->swapped, -+ left - __GLX_RENDER_LARGE_HDR_SIZE); - if (extra < 0) { - return BadLength; - } ---- glx/glxserver.h.orig 2012-05-17 19:09:02.000000000 +0200 -+++ glx/glxserver.h 2014-12-10 14:55:50.575337222 +0100 -@@ -167,7 +167,7 @@ - /* - * Tables for computing the size of each rendering command. - */ --typedef int (*gl_proto_size_func) (const GLbyte *, Bool); -+typedef int (*gl_proto_size_func) (const GLbyte *, Bool, int); - - typedef struct { - int bytes; ---- glx/indirect_reqsize.c.orig 2012-05-17 19:09:02.000000000 +0200 -+++ glx/indirect_reqsize.c 2014-12-10 15:28:31.264202211 +0100 -@@ -31,24 +31,22 @@ - #include "indirect_size.h" - #include "indirect_reqsize.h" - --#define __GLX_PAD(x) (((x) + 3) & ~3) -- - #if defined(__CYGWIN__) || defined(__MINGW32__) - #undef HAVE_ALIAS - #endif - #ifdef HAVE_ALIAS - #define ALIAS2(from,to) \ -- GLint __glX ## from ## ReqSize( const GLbyte * pc, Bool swap ) \ -+ GLint __glX ## from ## ReqSize( const GLbyte * pc, Bool swap, int reqlen ) \ - __attribute__ ((alias( # to ))); - #define ALIAS(from,to) ALIAS2( from, __glX ## to ## ReqSize ) - #else - #define ALIAS(from,to) \ -- GLint __glX ## from ## ReqSize( const GLbyte * pc, Bool swap ) \ -- { return __glX ## to ## ReqSize( pc, swap ); } -+ GLint __glX ## from ## ReqSize( const GLbyte * pc, Bool swap, int reqlen ) \ -+ { return __glX ## to ## ReqSize( pc, swap, reqlen ); } - #endif - - int --__glXCallListsReqSize(const GLbyte * pc, Bool swap) -+__glXCallListsReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLsizei n = *(GLsizei *) (pc + 0); - GLenum type = *(GLenum *) (pc + 4); -@@ -60,11 +58,11 @@ - } - - compsize = __glCallLists_size(type); -- return __GLX_PAD((compsize * n)); -+ return safe_pad(safe_mul(compsize, n)); - } - - int --__glXBitmapReqSize(const GLbyte * pc, Bool swap) -+__glXBitmapReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLint row_length = *(GLint *) (pc + 4); - GLint image_height = 0; -@@ -88,7 +86,7 @@ - } - - int --__glXFogfvReqSize(const GLbyte * pc, Bool swap) -+__glXFogfvReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLenum pname = *(GLenum *) (pc + 0); - GLsizei compsize; -@@ -98,11 +96,11 @@ - } - - compsize = __glFogfv_size(pname); -- return __GLX_PAD((compsize * 4)); -+ return safe_pad(safe_mul(compsize, 4)); - } - - int --__glXLightfvReqSize(const GLbyte * pc, Bool swap) -+__glXLightfvReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLenum pname = *(GLenum *) (pc + 4); - GLsizei compsize; -@@ -112,11 +110,11 @@ - } - - compsize = __glLightfv_size(pname); -- return __GLX_PAD((compsize * 4)); -+ return safe_pad(safe_mul(compsize, 4)); - } - - int --__glXLightModelfvReqSize(const GLbyte * pc, Bool swap) -+__glXLightModelfvReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLenum pname = *(GLenum *) (pc + 0); - GLsizei compsize; -@@ -126,11 +124,11 @@ - } - - compsize = __glLightModelfv_size(pname); -- return __GLX_PAD((compsize * 4)); -+ return safe_pad(safe_mul(compsize, 4)); - } - - int --__glXMaterialfvReqSize(const GLbyte * pc, Bool swap) -+__glXMaterialfvReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLenum pname = *(GLenum *) (pc + 4); - GLsizei compsize; -@@ -140,11 +138,11 @@ - } - - compsize = __glMaterialfv_size(pname); -- return __GLX_PAD((compsize * 4)); -+ return safe_pad(safe_mul(compsize, 4)); - } - - int --__glXPolygonStippleReqSize(const GLbyte * pc, Bool swap) -+__glXPolygonStippleReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLint row_length = *(GLint *) (pc + 4); - GLint image_height = 0; -@@ -164,7 +162,7 @@ - } - - int --__glXTexParameterfvReqSize(const GLbyte * pc, Bool swap) -+__glXTexParameterfvReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLenum pname = *(GLenum *) (pc + 4); - GLsizei compsize; -@@ -174,11 +172,11 @@ - } - - compsize = __glTexParameterfv_size(pname); -- return __GLX_PAD((compsize * 4)); -+ return safe_pad(safe_mul(compsize, 4)); - } - - int --__glXTexImage1DReqSize(const GLbyte * pc, Bool swap) -+__glXTexImage1DReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLint row_length = *(GLint *) (pc + 4); - GLint image_height = 0; -@@ -206,7 +204,7 @@ - } - - int --__glXTexImage2DReqSize(const GLbyte * pc, Bool swap) -+__glXTexImage2DReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLint row_length = *(GLint *) (pc + 4); - GLint image_height = 0; -@@ -236,7 +234,7 @@ - } - - int --__glXTexEnvfvReqSize(const GLbyte * pc, Bool swap) -+__glXTexEnvfvReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLenum pname = *(GLenum *) (pc + 4); - GLsizei compsize; -@@ -246,11 +244,11 @@ - } - - compsize = __glTexEnvfv_size(pname); -- return __GLX_PAD((compsize * 4)); -+ return safe_pad(safe_mul(compsize, 4)); - } - - int --__glXTexGendvReqSize(const GLbyte * pc, Bool swap) -+__glXTexGendvReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLenum pname = *(GLenum *) (pc + 4); - GLsizei compsize; -@@ -260,11 +258,11 @@ - } - - compsize = __glTexGendv_size(pname); -- return __GLX_PAD((compsize * 8)); -+ return safe_pad(safe_mul(compsize, 8)); - } - - int --__glXTexGenfvReqSize(const GLbyte * pc, Bool swap) -+__glXTexGenfvReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLenum pname = *(GLenum *) (pc + 4); - GLsizei compsize; -@@ -274,11 +272,11 @@ - } - - compsize = __glTexGenfv_size(pname); -- return __GLX_PAD((compsize * 4)); -+ return safe_pad(safe_mul(compsize, 4)); - } - - int --__glXPixelMapfvReqSize(const GLbyte * pc, Bool swap) -+__glXPixelMapfvReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLsizei mapsize = *(GLsizei *) (pc + 4); - -@@ -286,11 +284,11 @@ - mapsize = bswap_32(mapsize); - } - -- return __GLX_PAD((mapsize * 4)); -+ return safe_pad(safe_mul(mapsize, 4)); - } - - int --__glXPixelMapusvReqSize(const GLbyte * pc, Bool swap) -+__glXPixelMapusvReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLsizei mapsize = *(GLsizei *) (pc + 4); - -@@ -298,11 +296,11 @@ - mapsize = bswap_32(mapsize); - } - -- return __GLX_PAD((mapsize * 2)); -+ return safe_pad(safe_mul(mapsize, 2)); - } - - int --__glXDrawPixelsReqSize(const GLbyte * pc, Bool swap) -+__glXDrawPixelsReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLint row_length = *(GLint *) (pc + 4); - GLint image_height = 0; -@@ -330,7 +328,7 @@ - } - - int --__glXPrioritizeTexturesReqSize(const GLbyte * pc, Bool swap) -+__glXPrioritizeTexturesReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLsizei n = *(GLsizei *) (pc + 0); - -@@ -338,11 +336,11 @@ - n = bswap_32(n); - } - -- return __GLX_PAD((n * 4) + (n * 4)); -+ return safe_pad(safe_add(safe_mul(n, 4), safe_mul(n, 4))); - } - - int --__glXTexSubImage1DReqSize(const GLbyte * pc, Bool swap) -+__glXTexSubImage1DReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLint row_length = *(GLint *) (pc + 4); - GLint image_height = 0; -@@ -370,7 +368,7 @@ - } - - int --__glXTexSubImage2DReqSize(const GLbyte * pc, Bool swap) -+__glXTexSubImage2DReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLint row_length = *(GLint *) (pc + 4); - GLint image_height = 0; -@@ -400,7 +398,7 @@ - } - - int --__glXColorTableReqSize(const GLbyte * pc, Bool swap) -+__glXColorTableReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLint row_length = *(GLint *) (pc + 4); - GLint image_height = 0; -@@ -428,7 +426,7 @@ - } - - int --__glXColorTableParameterfvReqSize(const GLbyte * pc, Bool swap) -+__glXColorTableParameterfvReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLenum pname = *(GLenum *) (pc + 4); - GLsizei compsize; -@@ -438,11 +436,11 @@ - } - - compsize = __glColorTableParameterfv_size(pname); -- return __GLX_PAD((compsize * 4)); -+ return safe_pad(safe_mul(compsize, 4)); - } - - int --__glXColorSubTableReqSize(const GLbyte * pc, Bool swap) -+__glXColorSubTableReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLint row_length = *(GLint *) (pc + 4); - GLint image_height = 0; -@@ -470,7 +468,7 @@ - } - - int --__glXConvolutionFilter1DReqSize(const GLbyte * pc, Bool swap) -+__glXConvolutionFilter1DReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLint row_length = *(GLint *) (pc + 4); - GLint image_height = 0; -@@ -498,7 +496,7 @@ - } - - int --__glXConvolutionFilter2DReqSize(const GLbyte * pc, Bool swap) -+__glXConvolutionFilter2DReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLint row_length = *(GLint *) (pc + 4); - GLint image_height = 0; -@@ -528,7 +526,7 @@ - } - - int --__glXConvolutionParameterfvReqSize(const GLbyte * pc, Bool swap) -+__glXConvolutionParameterfvReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLenum pname = *(GLenum *) (pc + 4); - GLsizei compsize; -@@ -538,11 +536,11 @@ - } - - compsize = __glConvolutionParameterfv_size(pname); -- return __GLX_PAD((compsize * 4)); -+ return safe_pad(safe_mul(compsize, 4)); - } - - int --__glXTexImage3DReqSize(const GLbyte * pc, Bool swap) -+__glXTexImage3DReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLint row_length = *(GLint *) (pc + 4); - GLint image_height = *(GLint *) (pc + 8); -@@ -579,7 +577,7 @@ - } - - int --__glXTexSubImage3DReqSize(const GLbyte * pc, Bool swap) -+__glXTexSubImage3DReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLint row_length = *(GLint *) (pc + 4); - GLint image_height = *(GLint *) (pc + 8); -@@ -613,7 +611,7 @@ - } - - int --__glXCompressedTexImage1DARBReqSize(const GLbyte * pc, Bool swap) -+__glXCompressedTexImage1DARBReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLsizei imageSize = *(GLsizei *) (pc + 20); - -@@ -621,11 +619,11 @@ - imageSize = bswap_32(imageSize); - } - -- return __GLX_PAD(imageSize); -+ return safe_pad(imageSize); - } - - int --__glXCompressedTexImage2DARBReqSize(const GLbyte * pc, Bool swap) -+__glXCompressedTexImage2DARBReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLsizei imageSize = *(GLsizei *) (pc + 24); - -@@ -633,11 +631,11 @@ - imageSize = bswap_32(imageSize); - } - -- return __GLX_PAD(imageSize); -+ return safe_pad(imageSize); - } - - int --__glXCompressedTexImage3DARBReqSize(const GLbyte * pc, Bool swap) -+__glXCompressedTexImage3DARBReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLsizei imageSize = *(GLsizei *) (pc + 28); - -@@ -645,11 +643,11 @@ - imageSize = bswap_32(imageSize); - } - -- return __GLX_PAD(imageSize); -+ return safe_pad(imageSize); - } - - int --__glXCompressedTexSubImage3DARBReqSize(const GLbyte * pc, Bool swap) -+__glXCompressedTexSubImage3DARBReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLsizei imageSize = *(GLsizei *) (pc + 36); - -@@ -657,11 +655,11 @@ - imageSize = bswap_32(imageSize); - } - -- return __GLX_PAD(imageSize); -+ return safe_pad(imageSize); - } - - int --__glXProgramStringARBReqSize(const GLbyte * pc, Bool swap) -+__glXProgramStringARBReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLsizei len = *(GLsizei *) (pc + 8); - -@@ -669,11 +667,11 @@ - len = bswap_32(len); - } - -- return __GLX_PAD(len); -+ return safe_pad(len); - } - - int --__glXDrawBuffersARBReqSize(const GLbyte * pc, Bool swap) -+__glXDrawBuffersARBReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLsizei n = *(GLsizei *) (pc + 0); - -@@ -681,11 +679,11 @@ - n = bswap_32(n); - } - -- return __GLX_PAD((n * 4)); -+ return safe_pad(safe_mul(n, 4)); - } - - int --__glXPointParameterfvEXTReqSize(const GLbyte * pc, Bool swap) -+__glXPointParameterfvEXTReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLenum pname = *(GLenum *) (pc + 0); - GLsizei compsize; -@@ -695,11 +693,11 @@ - } - - compsize = __glPointParameterfvEXT_size(pname); -- return __GLX_PAD((compsize * 4)); -+ return safe_pad(safe_mul(compsize, 4)); - } - - int --__glXProgramParameters4dvNVReqSize(const GLbyte * pc, Bool swap) -+__glXProgramParameters4dvNVReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLsizei num = *(GLsizei *) (pc + 8); - -@@ -707,11 +705,11 @@ - num = bswap_32(num); - } - -- return __GLX_PAD((num * 32)); -+ return safe_pad(safe_mul(num, 32)); - } - - int --__glXProgramParameters4fvNVReqSize(const GLbyte * pc, Bool swap) -+__glXProgramParameters4fvNVReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLsizei num = *(GLsizei *) (pc + 8); - -@@ -719,11 +717,11 @@ - num = bswap_32(num); - } - -- return __GLX_PAD((num * 16)); -+ return safe_pad(safe_mul(num, 16)); - } - - int --__glXVertexAttribs1dvNVReqSize(const GLbyte * pc, Bool swap) -+__glXVertexAttribs1dvNVReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLsizei n = *(GLsizei *) (pc + 4); - -@@ -731,11 +729,11 @@ - n = bswap_32(n); - } - -- return __GLX_PAD((n * 8)); -+ return safe_pad(safe_mul(n, 8)); - } - - int --__glXVertexAttribs2dvNVReqSize(const GLbyte * pc, Bool swap) -+__glXVertexAttribs2dvNVReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLsizei n = *(GLsizei *) (pc + 4); - -@@ -743,11 +741,11 @@ - n = bswap_32(n); - } - -- return __GLX_PAD((n * 16)); -+ return safe_pad(safe_mul(n, 16)); - } - - int --__glXVertexAttribs3dvNVReqSize(const GLbyte * pc, Bool swap) -+__glXVertexAttribs3dvNVReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLsizei n = *(GLsizei *) (pc + 4); - -@@ -755,11 +753,11 @@ - n = bswap_32(n); - } - -- return __GLX_PAD((n * 24)); -+ return safe_pad(safe_mul(n, 24)); - } - - int --__glXVertexAttribs3fvNVReqSize(const GLbyte * pc, Bool swap) -+__glXVertexAttribs3fvNVReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLsizei n = *(GLsizei *) (pc + 4); - -@@ -767,11 +765,11 @@ - n = bswap_32(n); - } - -- return __GLX_PAD((n * 12)); -+ return safe_pad(safe_mul(n, 12)); - } - - int --__glXVertexAttribs3svNVReqSize(const GLbyte * pc, Bool swap) -+__glXVertexAttribs3svNVReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLsizei n = *(GLsizei *) (pc + 4); - -@@ -779,11 +777,11 @@ - n = bswap_32(n); - } - -- return __GLX_PAD((n * 6)); -+ return safe_pad(safe_mul(n, 6)); - } - - int --__glXVertexAttribs4dvNVReqSize(const GLbyte * pc, Bool swap) -+__glXVertexAttribs4dvNVReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLsizei n = *(GLsizei *) (pc + 4); - -@@ -791,11 +789,11 @@ - n = bswap_32(n); - } - -- return __GLX_PAD((n * 32)); -+ return safe_pad(safe_mul(n, 32)); - } - - int --__glXProgramNamedParameter4fvNVReqSize(const GLbyte * pc, Bool swap) -+__glXProgramNamedParameter4fvNVReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLsizei len = *(GLsizei *) (pc + 4); - -@@ -803,7 +801,7 @@ - len = bswap_32(len); - } - -- return __GLX_PAD(len); -+ return safe_pad(len); - } - - ALIAS(Fogiv, Fogfv) ---- glx/indirect_reqsize.h.orig 2012-05-17 19:09:02.000000000 +0200 -+++ glx/indirect_reqsize.h 2014-12-10 15:45:48.967149775 +0100 -@@ -36,128 +36,169 @@ - #define PURE - #endif - --extern PURE _X_HIDDEN int __glXCallListsReqSize(const GLbyte * pc, Bool swap); --extern PURE _X_HIDDEN int __glXBitmapReqSize(const GLbyte * pc, Bool swap); --extern PURE _X_HIDDEN int __glXFogfvReqSize(const GLbyte * pc, Bool swap); --extern PURE _X_HIDDEN int __glXFogivReqSize(const GLbyte * pc, Bool swap); --extern PURE _X_HIDDEN int __glXLightfvReqSize(const GLbyte * pc, Bool swap); --extern PURE _X_HIDDEN int __glXLightivReqSize(const GLbyte * pc, Bool swap); --extern PURE _X_HIDDEN int __glXLightModelfvReqSize(const GLbyte * pc, -- Bool swap); --extern PURE _X_HIDDEN int __glXLightModelivReqSize(const GLbyte * pc, -- Bool swap); --extern PURE _X_HIDDEN int __glXMaterialfvReqSize(const GLbyte * pc, Bool swap); --extern PURE _X_HIDDEN int __glXMaterialivReqSize(const GLbyte * pc, Bool swap); -+extern PURE _X_HIDDEN int __glXCallListsReqSize(const GLbyte * pc, Bool swap, -+ int reqlen); -+extern PURE _X_HIDDEN int __glXBitmapReqSize(const GLbyte * pc, Bool swap, -+ int reqlen); -+extern PURE _X_HIDDEN int __glXFogfvReqSize(const GLbyte * pc, Bool swap, -+ int reqlen); -+extern PURE _X_HIDDEN int __glXFogivReqSize(const GLbyte * pc, Bool swap, -+ int reqlen); -+extern PURE _X_HIDDEN int __glXLightfvReqSize(const GLbyte * pc, Bool swap, -+ int reqlen); -+extern PURE _X_HIDDEN int __glXLightivReqSize(const GLbyte * pc, Bool swap, -+ int reqlen); -+extern PURE _X_HIDDEN int __glXLightModelfvReqSize(const GLbyte * pc, Bool swap, -+ int reqlen); -+extern PURE _X_HIDDEN int __glXLightModelivReqSize(const GLbyte * pc, Bool swap, -+ int reqlen); -+extern PURE _X_HIDDEN int __glXMaterialfvReqSize(const GLbyte * pc, Bool swap, -+ int reqlen); -+extern PURE _X_HIDDEN int __glXMaterialivReqSize(const GLbyte * pc, Bool swap, -+ int reqlen); - extern PURE _X_HIDDEN int __glXPolygonStippleReqSize(const GLbyte * pc, -- Bool swap); -+ Bool swap, int reqlen); - extern PURE _X_HIDDEN int __glXTexParameterfvReqSize(const GLbyte * pc, -- Bool swap); -+ Bool swap, int reqlen); - extern PURE _X_HIDDEN int __glXTexParameterivReqSize(const GLbyte * pc, -- Bool swap); --extern PURE _X_HIDDEN int __glXTexImage1DReqSize(const GLbyte * pc, Bool swap); --extern PURE _X_HIDDEN int __glXTexImage2DReqSize(const GLbyte * pc, Bool swap); --extern PURE _X_HIDDEN int __glXTexEnvfvReqSize(const GLbyte * pc, Bool swap); --extern PURE _X_HIDDEN int __glXTexEnvivReqSize(const GLbyte * pc, Bool swap); --extern PURE _X_HIDDEN int __glXTexGendvReqSize(const GLbyte * pc, Bool swap); --extern PURE _X_HIDDEN int __glXTexGenfvReqSize(const GLbyte * pc, Bool swap); --extern PURE _X_HIDDEN int __glXTexGenivReqSize(const GLbyte * pc, Bool swap); --extern PURE _X_HIDDEN int __glXMap1dReqSize(const GLbyte * pc, Bool swap); --extern PURE _X_HIDDEN int __glXMap1fReqSize(const GLbyte * pc, Bool swap); --extern PURE _X_HIDDEN int __glXMap2dReqSize(const GLbyte * pc, Bool swap); --extern PURE _X_HIDDEN int __glXMap2fReqSize(const GLbyte * pc, Bool swap); --extern PURE _X_HIDDEN int __glXPixelMapfvReqSize(const GLbyte * pc, Bool swap); --extern PURE _X_HIDDEN int __glXPixelMapuivReqSize(const GLbyte * pc, Bool swap); --extern PURE _X_HIDDEN int __glXPixelMapusvReqSize(const GLbyte * pc, Bool swap); --extern PURE _X_HIDDEN int __glXDrawPixelsReqSize(const GLbyte * pc, Bool swap); --extern PURE _X_HIDDEN int __glXDrawArraysReqSize(const GLbyte * pc, Bool swap); -+ Bool swap, int reqlen); -+extern PURE _X_HIDDEN int __glXTexImage1DReqSize(const GLbyte * pc, Bool swap, -+ int reqlen); -+extern PURE _X_HIDDEN int __glXTexImage2DReqSize(const GLbyte * pc, Bool swap, -+ int reqlen); -+extern PURE _X_HIDDEN int __glXTexEnvfvReqSize(const GLbyte * pc, Bool swap, -+ int reqlen); -+extern PURE _X_HIDDEN int __glXTexEnvivReqSize(const GLbyte * pc, Bool swap, -+ int reqlen); -+extern PURE _X_HIDDEN int __glXTexGendvReqSize(const GLbyte * pc, Bool swap, -+ int reqlen); -+extern PURE _X_HIDDEN int __glXTexGenfvReqSize(const GLbyte * pc, Bool swap, -+ int reqlen); -+extern PURE _X_HIDDEN int __glXTexGenivReqSize(const GLbyte * pc, Bool swap, -+ int reqlen); -+extern PURE _X_HIDDEN int __glXMap1dReqSize(const GLbyte * pc, Bool swap, -+ int reqlen); -+extern PURE _X_HIDDEN int __glXMap1fReqSize(const GLbyte * pc, Bool swap, -+ int reqlen); -+extern PURE _X_HIDDEN int __glXMap2dReqSize(const GLbyte * pc, Bool swap, -+ int reqlen); -+extern PURE _X_HIDDEN int __glXMap2fReqSize(const GLbyte * pc, Bool swap, -+ int reqlen); -+extern PURE _X_HIDDEN int __glXPixelMapfvReqSize(const GLbyte * pc, Bool swap, -+ int reqlen); -+extern PURE _X_HIDDEN int __glXPixelMapuivReqSize(const GLbyte * pc, Bool swap, -+ int reqlen); -+extern PURE _X_HIDDEN int __glXPixelMapusvReqSize(const GLbyte * pc, Bool swap, -+ int reqlen); -+extern PURE _X_HIDDEN int __glXDrawPixelsReqSize(const GLbyte * pc, Bool swap, -+ int reqlen); -+extern PURE _X_HIDDEN int __glXDrawArraysReqSize(const GLbyte * pc, Bool swap, -+ int reqlen); - extern PURE _X_HIDDEN int __glXPrioritizeTexturesReqSize(const GLbyte * pc, -- Bool swap); -+ Bool swap, int reqlen); - extern PURE _X_HIDDEN int __glXTexSubImage1DReqSize(const GLbyte * pc, -- Bool swap); -+ Bool swap, int reqlen); - extern PURE _X_HIDDEN int __glXTexSubImage2DReqSize(const GLbyte * pc, -- Bool swap); --extern PURE _X_HIDDEN int __glXColorTableReqSize(const GLbyte * pc, Bool swap); -+ Bool swap, int reqlen); -+extern PURE _X_HIDDEN int __glXColorTableReqSize(const GLbyte * pc, Bool swap, -+ int reqlen); - extern PURE _X_HIDDEN int __glXColorTableParameterfvReqSize(const GLbyte * pc, -- Bool swap); -+ Bool swap, -+ int reqlen); - extern PURE _X_HIDDEN int __glXColorTableParameterivReqSize(const GLbyte * pc, -- Bool swap); -+ Bool swap, -+ int reqlen); - extern PURE _X_HIDDEN int __glXColorSubTableReqSize(const GLbyte * pc, -- Bool swap); -+ Bool swap, int reqlen); - extern PURE _X_HIDDEN int __glXConvolutionFilter1DReqSize(const GLbyte * pc, -- Bool swap); -+ Bool swap, -+ int reqlen); - extern PURE _X_HIDDEN int __glXConvolutionFilter2DReqSize(const GLbyte * pc, -- Bool swap); -+ Bool swap, -+ int reqlen); - extern PURE _X_HIDDEN int __glXConvolutionParameterfvReqSize(const GLbyte * pc, -- Bool swap); -+ Bool swap, -+ int reqlen); - extern PURE _X_HIDDEN int __glXConvolutionParameterivReqSize(const GLbyte * pc, -- Bool swap); -+ Bool swap, -+ int reqlen); - extern PURE _X_HIDDEN int __glXSeparableFilter2DReqSize(const GLbyte * pc, -- Bool swap); --extern PURE _X_HIDDEN int __glXTexImage3DReqSize(const GLbyte * pc, Bool swap); -+ Bool swap, int reqlen); -+extern PURE _X_HIDDEN int __glXTexImage3DReqSize(const GLbyte * pc, Bool swap, -+ int reqlen); - extern PURE _X_HIDDEN int __glXTexSubImage3DReqSize(const GLbyte * pc, -- Bool swap); -+ Bool swap, int reqlen); - extern PURE _X_HIDDEN int __glXCompressedTexImage1DARBReqSize(const GLbyte * pc, -- Bool swap); -+ Bool swap, -+ int reqlen); - extern PURE _X_HIDDEN int __glXCompressedTexImage2DARBReqSize(const GLbyte * pc, -- Bool swap); -+ Bool swap, -+ int reqlen); - extern PURE _X_HIDDEN int __glXCompressedTexImage3DARBReqSize(const GLbyte * pc, -- Bool swap); -+ Bool swap, -+ int reqlen); - extern PURE _X_HIDDEN int __glXCompressedTexSubImage1DARBReqSize(const GLbyte * -- pc, Bool swap); -+ pc, Bool swap, -+ int reqlen); - extern PURE _X_HIDDEN int __glXCompressedTexSubImage2DARBReqSize(const GLbyte * -- pc, Bool swap); -+ pc, Bool swap, -+ int reqlen); - extern PURE _X_HIDDEN int __glXCompressedTexSubImage3DARBReqSize(const GLbyte * -- pc, Bool swap); -+ pc, Bool swap, -+ int reqlen); - extern PURE _X_HIDDEN int __glXProgramStringARBReqSize(const GLbyte * pc, -- Bool swap); -+ Bool swap, int reqlen); - extern PURE _X_HIDDEN int __glXDrawBuffersARBReqSize(const GLbyte * pc, -- Bool swap); -+ Bool swap, int reqlen); - extern PURE _X_HIDDEN int __glXPointParameterfvEXTReqSize(const GLbyte * pc, -- Bool swap); -+ Bool swap, int reqlen); - extern PURE _X_HIDDEN int __glXLoadProgramNVReqSize(const GLbyte * pc, -- Bool swap); -+ Bool swap, int reqlen); - extern PURE _X_HIDDEN int __glXProgramParameters4dvNVReqSize(const GLbyte * pc, -- Bool swap); -+ Bool swap, int reqlen); - extern PURE _X_HIDDEN int __glXProgramParameters4fvNVReqSize(const GLbyte * pc, -- Bool swap); -+ Bool swap, int reqlen); - extern PURE _X_HIDDEN int __glXRequestResidentProgramsNVReqSize(const GLbyte * -- pc, Bool swap); -+ pc, Bool swap, -+ int reqlen); - extern PURE _X_HIDDEN int __glXVertexAttribs1dvNVReqSize(const GLbyte * pc, -- Bool swap); -+ Bool swap, int reqlen); - extern PURE _X_HIDDEN int __glXVertexAttribs1fvNVReqSize(const GLbyte * pc, -- Bool swap); -+ Bool swap, int reqlen); - extern PURE _X_HIDDEN int __glXVertexAttribs1svNVReqSize(const GLbyte * pc, -- Bool swap); -+ Bool swap, int reqlen); - extern PURE _X_HIDDEN int __glXVertexAttribs2dvNVReqSize(const GLbyte * pc, -- Bool swap); -+ Bool swap, int reqlen); - extern PURE _X_HIDDEN int __glXVertexAttribs2fvNVReqSize(const GLbyte * pc, -- Bool swap); -+ Bool swap, int reqlen); - extern PURE _X_HIDDEN int __glXVertexAttribs2svNVReqSize(const GLbyte * pc, -- Bool swap); -+ Bool swap, int reqlen); - extern PURE _X_HIDDEN int __glXVertexAttribs3dvNVReqSize(const GLbyte * pc, -- Bool swap); -+ Bool swap, int reqlen); - extern PURE _X_HIDDEN int __glXVertexAttribs3fvNVReqSize(const GLbyte * pc, -- Bool swap); -+ Bool swap, int reqlen); - extern PURE _X_HIDDEN int __glXVertexAttribs3svNVReqSize(const GLbyte * pc, -- Bool swap); -+ Bool swap, int reqlen); - extern PURE _X_HIDDEN int __glXVertexAttribs4dvNVReqSize(const GLbyte * pc, -- Bool swap); -+ Bool swap, int reqlen); - extern PURE _X_HIDDEN int __glXVertexAttribs4fvNVReqSize(const GLbyte * pc, -- Bool swap); -+ Bool swap, int reqlen); - extern PURE _X_HIDDEN int __glXVertexAttribs4svNVReqSize(const GLbyte * pc, -- Bool swap); -+ Bool swap, int reqlen); - extern PURE _X_HIDDEN int __glXVertexAttribs4ubvNVReqSize(const GLbyte * pc, -- Bool swap); -+ Bool swap, int reqlen); - extern PURE _X_HIDDEN int __glXPointParameterivNVReqSize(const GLbyte * pc, -- Bool swap); -+ Bool swap, int reqlen); - extern PURE _X_HIDDEN int __glXProgramNamedParameter4dvNVReqSize(const GLbyte * -- pc, Bool swap); -+ pc, Bool swap, -+ int reqlen); - extern PURE _X_HIDDEN int __glXProgramNamedParameter4fvNVReqSize(const GLbyte * -- pc, Bool swap); -+ pc, Bool swap, -+ int reqlen); - extern PURE _X_HIDDEN int __glXDeleteFramebuffersEXTReqSize(const GLbyte * pc, -- Bool swap); -+ Bool swap, int reqlen); - extern PURE _X_HIDDEN int __glXDeleteRenderbuffersEXTReqSize(const GLbyte * pc, -- Bool swap); -+ Bool swap, int reqlen); - - #undef PURE - ---- glx/rensize.c.orig 2012-05-17 19:09:02.000000000 +0200 -+++ glx/rensize.c 2014-12-10 14:55:50.580336482 +0100 -@@ -52,7 +52,7 @@ - } - - int --__glXMap1dReqSize(const GLbyte * pc, Bool swap) -+__glXMap1dReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLenum target; - GLint order, k; -@@ -68,7 +68,7 @@ - } - - int --__glXMap1fReqSize(const GLbyte * pc, Bool swap) -+__glXMap1fReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLenum target; - GLint order, k; -@@ -92,7 +92,7 @@ - } - - int --__glXMap2dReqSize(const GLbyte * pc, Bool swap) -+__glXMap2dReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLenum target; - GLint uorder, vorder, k; -@@ -110,7 +110,7 @@ - } - - int --__glXMap2fReqSize(const GLbyte * pc, Bool swap) -+__glXMap2fReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - GLenum target; - GLint uorder, vorder, k; -@@ -342,13 +342,14 @@ - } - - int --__glXDrawArraysReqSize(const GLbyte * pc, Bool swap) -+__glXDrawArraysReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - __GLXdispatchDrawArraysHeader *hdr = (__GLXdispatchDrawArraysHeader *) pc; - __GLXdispatchDrawArraysComponentHeader *compHeader; - GLint numVertexes = hdr->numVertexes; - GLint numComponents = hdr->numComponents; - GLint arrayElementSize = 0; -+ GLint x, size; - int i; - - if (swap) { -@@ -357,6 +358,13 @@ - } - - pc += sizeof(__GLXdispatchDrawArraysHeader); -+ reqlen -= sizeof(__GLXdispatchDrawArraysHeader); -+ -+ size = safe_mul(sizeof(__GLXdispatchDrawArraysComponentHeader), -+ numComponents); -+ if (size < 0 || reqlen < 0 || reqlen < size) -+ return -1; -+ - compHeader = (__GLXdispatchDrawArraysComponentHeader *) pc; - - for (i = 0; i < numComponents; i++) { -@@ -400,17 +408,18 @@ - return -1; - } - -- arrayElementSize += __GLX_PAD(numVals * __glXTypeSize(datatype)); -+ x = safe_pad(safe_mul(numVals, __glXTypeSize(datatype))); -+ if ((arrayElementSize = safe_add(arrayElementSize, x)) < 0) -+ return -1; - - pc += sizeof(__GLXdispatchDrawArraysComponentHeader); - } - -- return ((numComponents * sizeof(__GLXdispatchDrawArraysComponentHeader)) + -- (numVertexes * arrayElementSize)); -+ return safe_add(size, safe_mul(numVertexes, arrayElementSize)); - } - - int --__glXSeparableFilter2DReqSize(const GLbyte * pc, Bool swap) -+__glXSeparableFilter2DReqSize(const GLbyte * pc, Bool swap, int reqlen) - { - __GLXdispatchConvolutionFilterHeader *hdr = - (__GLXdispatchConvolutionFilterHeader *) pc; diff --git a/x11-servers/xorg-server/files/patch-CVE-2014-8099 b/x11-servers/xorg-server/files/patch-CVE-2014-8099 deleted file mode 100644 index dfc1b68..0000000 --- a/x11-servers/xorg-server/files/patch-CVE-2014-8099 +++ /dev/null @@ -1,179 +0,0 @@ -From 32a95fb7c7dbe22c9441c62762dfa4a8ec54d6c3 Mon Sep 17 00:00:00 2001 -From: Alan Coopersmith <alan.coopersmith@oracle.com> -Date: Sun, 26 Jan 2014 19:23:17 -0800 -Subject: [PATCH 09/40] Xv: unvalidated lengths in XVideo extension swapped - procs [CVE-2014-8099] - -Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> -Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> ---- - Xext/xvdisp.c | 20 ++++++++++++++++++++ - 1 file changed, 20 insertions(+) - -diff --git a/Xext/xvdisp.c b/Xext/xvdisp.c -index 86f982a..c2d0fc9 100644 ---- Xext/xvdisp.c -+++ Xext/xvdisp.c -@@ -1121,6 +1121,7 @@ static int - SProcXvQueryExtension(ClientPtr client) - { - REQUEST(xvQueryExtensionReq); -+ REQUEST_SIZE_MATCH(xvQueryExtensionReq); - swaps(&stuff->length); - return XvProcVector[xv_QueryExtension] (client); - } -@@ -1129,6 +1130,7 @@ static int - SProcXvQueryAdaptors(ClientPtr client) - { - REQUEST(xvQueryAdaptorsReq); -+ REQUEST_SIZE_MATCH(xvQueryAdaptorsReq); - swaps(&stuff->length); - swapl(&stuff->window); - return XvProcVector[xv_QueryAdaptors] (client); -@@ -1138,6 +1140,7 @@ static int - SProcXvQueryEncodings(ClientPtr client) - { - REQUEST(xvQueryEncodingsReq); -+ REQUEST_SIZE_MATCH(xvQueryEncodingsReq); - swaps(&stuff->length); - swapl(&stuff->port); - return XvProcVector[xv_QueryEncodings] (client); -@@ -1147,6 +1150,7 @@ static int - SProcXvGrabPort(ClientPtr client) - { - REQUEST(xvGrabPortReq); -+ REQUEST_SIZE_MATCH(xvGrabPortReq); - swaps(&stuff->length); - swapl(&stuff->port); - swapl(&stuff->time); -@@ -1157,6 +1161,7 @@ static int - SProcXvUngrabPort(ClientPtr client) - { - REQUEST(xvUngrabPortReq); -+ REQUEST_SIZE_MATCH(xvUngrabPortReq); - swaps(&stuff->length); - swapl(&stuff->port); - swapl(&stuff->time); -@@ -1167,6 +1172,7 @@ static int - SProcXvPutVideo(ClientPtr client) - { - REQUEST(xvPutVideoReq); -+ REQUEST_SIZE_MATCH(xvPutVideoReq); - swaps(&stuff->length); - swapl(&stuff->port); - swapl(&stuff->drawable); -@@ -1186,6 +1192,7 @@ static int - SProcXvPutStill(ClientPtr client) - { - REQUEST(xvPutStillReq); -+ REQUEST_SIZE_MATCH(xvPutStillReq); - swaps(&stuff->length); - swapl(&stuff->port); - swapl(&stuff->drawable); -@@ -1205,6 +1212,7 @@ static int - SProcXvGetVideo(ClientPtr client) - { - REQUEST(xvGetVideoReq); -+ REQUEST_SIZE_MATCH(xvGetVideoReq); - swaps(&stuff->length); - swapl(&stuff->port); - swapl(&stuff->drawable); -@@ -1224,6 +1232,7 @@ static int - SProcXvGetStill(ClientPtr client) - { - REQUEST(xvGetStillReq); -+ REQUEST_SIZE_MATCH(xvGetStillReq); - swaps(&stuff->length); - swapl(&stuff->port); - swapl(&stuff->drawable); -@@ -1243,6 +1252,7 @@ static int - SProcXvPutImage(ClientPtr client) - { - REQUEST(xvPutImageReq); -+ REQUEST_AT_LEAST_SIZE(xvPutImageReq); - swaps(&stuff->length); - swapl(&stuff->port); - swapl(&stuff->drawable); -@@ -1266,6 +1276,7 @@ static int - SProcXvShmPutImage(ClientPtr client) - { - REQUEST(xvShmPutImageReq); -+ REQUEST_SIZE_MATCH(xvShmPutImageReq); - swaps(&stuff->length); - swapl(&stuff->port); - swapl(&stuff->drawable); -@@ -1293,6 +1304,7 @@ static int - SProcXvSelectVideoNotify(ClientPtr client) - { - REQUEST(xvSelectVideoNotifyReq); -+ REQUEST_SIZE_MATCH(xvSelectVideoNotifyReq); - swaps(&stuff->length); - swapl(&stuff->drawable); - return XvProcVector[xv_SelectVideoNotify] (client); -@@ -1302,6 +1314,7 @@ static int - SProcXvSelectPortNotify(ClientPtr client) - { - REQUEST(xvSelectPortNotifyReq); -+ REQUEST_SIZE_MATCH(xvSelectPortNotifyReq); - swaps(&stuff->length); - swapl(&stuff->port); - return XvProcVector[xv_SelectPortNotify] (client); -@@ -1311,6 +1324,7 @@ static int - SProcXvStopVideo(ClientPtr client) - { - REQUEST(xvStopVideoReq); -+ REQUEST_SIZE_MATCH(xvStopVideoReq); - swaps(&stuff->length); - swapl(&stuff->port); - swapl(&stuff->drawable); -@@ -1321,6 +1335,7 @@ static int - SProcXvSetPortAttribute(ClientPtr client) - { - REQUEST(xvSetPortAttributeReq); -+ REQUEST_SIZE_MATCH(xvSetPortAttributeReq); - swaps(&stuff->length); - swapl(&stuff->port); - swapl(&stuff->attribute); -@@ -1332,6 +1347,7 @@ static int - SProcXvGetPortAttribute(ClientPtr client) - { - REQUEST(xvGetPortAttributeReq); -+ REQUEST_SIZE_MATCH(xvGetPortAttributeReq); - swaps(&stuff->length); - swapl(&stuff->port); - swapl(&stuff->attribute); -@@ -1342,6 +1358,7 @@ static int - SProcXvQueryBestSize(ClientPtr client) - { - REQUEST(xvQueryBestSizeReq); -+ REQUEST_SIZE_MATCH(xvQueryBestSizeReq); - swaps(&stuff->length); - swapl(&stuff->port); - swaps(&stuff->vid_w); -@@ -1355,6 +1372,7 @@ static int - SProcXvQueryPortAttributes(ClientPtr client) - { - REQUEST(xvQueryPortAttributesReq); -+ REQUEST_SIZE_MATCH(xvQueryPortAttributesReq); - swaps(&stuff->length); - swapl(&stuff->port); - return XvProcVector[xv_QueryPortAttributes] (client); -@@ -1364,6 +1382,7 @@ static int - SProcXvQueryImageAttributes(ClientPtr client) - { - REQUEST(xvQueryImageAttributesReq); -+ REQUEST_SIZE_MATCH(xvQueryImageAttributesReq); - swaps(&stuff->length); - swapl(&stuff->port); - swapl(&stuff->id); -@@ -1376,6 +1395,7 @@ static int - SProcXvListImageFormats(ClientPtr client) - { - REQUEST(xvListImageFormatsReq); -+ REQUEST_SIZE_MATCH(xvListImageFormatsReq); - swaps(&stuff->length); - swapl(&stuff->port); - return XvProcVector[xv_ListImageFormats] (client); --- -2.1.2 - diff --git a/x11-servers/xorg-server/files/patch-CVE-2014-8100-1-2 b/x11-servers/xorg-server/files/patch-CVE-2014-8100-1-2 deleted file mode 100644 index cfb0c4c..0000000 --- a/x11-servers/xorg-server/files/patch-CVE-2014-8100-1-2 +++ /dev/null @@ -1,36 +0,0 @@ -From b5f9ef03df6a650571b29d3d1c1d2b67c6e84336 Mon Sep 17 00:00:00 2001 -From: Julien Cristau <jcristau@debian.org> -Date: Tue, 28 Oct 2014 10:30:04 +0100 -Subject: [PATCH 13/40] render: check request size before reading it - [CVE-2014-8100 1/2] - -Otherwise we may be reading outside of the client request. - -Signed-off-by: Julien Cristau <jcristau@debian.org> -Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com> -Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> ---- - render/render.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/render/render.c b/render/render.c -index e3031da..200e0c8 100644 ---- render/render.c -+++ render/render.c -@@ -276,11 +276,11 @@ ProcRenderQueryVersion(ClientPtr client) - - REQUEST(xRenderQueryVersionReq); - -+ REQUEST_SIZE_MATCH(xRenderQueryVersionReq); -+ - pRenderClient->major_version = stuff->majorVersion; - pRenderClient->minor_version = stuff->minorVersion; - -- REQUEST_SIZE_MATCH(xRenderQueryVersionReq); -- - if ((stuff->majorVersion * 1000 + stuff->minorVersion) < - (SERVER_RENDER_MAJOR_VERSION * 1000 + SERVER_RENDER_MINOR_VERSION)) { - rep.majorVersion = stuff->majorVersion; --- -2.1.2 - diff --git a/x11-servers/xorg-server/files/patch-CVE-2014-8100-2-2 b/x11-servers/xorg-server/files/patch-CVE-2014-8100-2-2 deleted file mode 100644 index e4d6503..0000000 --- a/x11-servers/xorg-server/files/patch-CVE-2014-8100-2-2 +++ /dev/null @@ -1,140 +0,0 @@ -From 5d3a788aeb2fbd3ca2812747dc18c94a8b981c63 Mon Sep 17 00:00:00 2001 -From: Alan Coopersmith <alan.coopersmith@oracle.com> -Date: Sun, 26 Jan 2014 19:51:29 -0800 -Subject: [PATCH 14/40] render: unvalidated lengths in Render extn. swapped - procs [CVE-2014-8100 2/2] - -Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> -Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> ---- - render/render.c | 16 +++++++++++++++- - 1 file changed, 15 insertions(+), 1 deletion(-) - -diff --git a/render/render.c b/render/render.c -index 200e0c8..723f380 100644 ---- render/render.c -+++ render/render.c -@@ -1995,7 +1995,7 @@ static int - SProcRenderQueryVersion(ClientPtr client) - { - REQUEST(xRenderQueryVersionReq); -- -+ REQUEST_SIZE_MATCH(xRenderQueryVersionReq); - swaps(&stuff->length); - swapl(&stuff->majorVersion); - swapl(&stuff->minorVersion); -@@ -2006,6 +2006,7 @@ static int - SProcRenderQueryPictFormats(ClientPtr client) - { - REQUEST(xRenderQueryPictFormatsReq); -+ REQUEST_SIZE_MATCH(xRenderQueryPictFormatsReq); - swaps(&stuff->length); - return (*ProcRenderVector[stuff->renderReqType]) (client); - } -@@ -2014,6 +2015,7 @@ static int - SProcRenderQueryPictIndexValues(ClientPtr client) - { - REQUEST(xRenderQueryPictIndexValuesReq); -+ REQUEST_AT_LEAST_SIZE(xRenderQueryPictIndexValuesReq); - swaps(&stuff->length); - swapl(&stuff->format); - return (*ProcRenderVector[stuff->renderReqType]) (client); -@@ -2029,6 +2031,7 @@ static int - SProcRenderCreatePicture(ClientPtr client) - { - REQUEST(xRenderCreatePictureReq); -+ REQUEST_AT_LEAST_SIZE(xRenderCreatePictureReq); - swaps(&stuff->length); - swapl(&stuff->pid); - swapl(&stuff->drawable); -@@ -2042,6 +2045,7 @@ static int - SProcRenderChangePicture(ClientPtr client) - { - REQUEST(xRenderChangePictureReq); -+ REQUEST_AT_LEAST_SIZE(xRenderChangePictureReq); - swaps(&stuff->length); - swapl(&stuff->picture); - swapl(&stuff->mask); -@@ -2053,6 +2057,7 @@ static int - SProcRenderSetPictureClipRectangles(ClientPtr client) - { - REQUEST(xRenderSetPictureClipRectanglesReq); -+ REQUEST_AT_LEAST_SIZE(xRenderSetPictureClipRectanglesReq); - swaps(&stuff->length); - swapl(&stuff->picture); - swaps(&stuff->xOrigin); -@@ -2065,6 +2070,7 @@ static int - SProcRenderFreePicture(ClientPtr client) - { - REQUEST(xRenderFreePictureReq); -+ REQUEST_SIZE_MATCH(xRenderFreePictureReq); - swaps(&stuff->length); - swapl(&stuff->picture); - return (*ProcRenderVector[stuff->renderReqType]) (client); -@@ -2074,6 +2080,7 @@ static int - SProcRenderComposite(ClientPtr client) - { - REQUEST(xRenderCompositeReq); -+ REQUEST_SIZE_MATCH(xRenderCompositeReq); - swaps(&stuff->length); - swapl(&stuff->src); - swapl(&stuff->mask); -@@ -2093,6 +2100,7 @@ static int - SProcRenderScale(ClientPtr client) - { - REQUEST(xRenderScaleReq); -+ REQUEST_SIZE_MATCH(xRenderScaleReq); - swaps(&stuff->length); - swapl(&stuff->src); - swapl(&stuff->dst); -@@ -2193,6 +2201,7 @@ static int - SProcRenderCreateGlyphSet(ClientPtr client) - { - REQUEST(xRenderCreateGlyphSetReq); -+ REQUEST_SIZE_MATCH(xRenderCreateGlyphSetReq); - swaps(&stuff->length); - swapl(&stuff->gsid); - swapl(&stuff->format); -@@ -2203,6 +2212,7 @@ static int - SProcRenderReferenceGlyphSet(ClientPtr client) - { - REQUEST(xRenderReferenceGlyphSetReq); -+ REQUEST_SIZE_MATCH(xRenderReferenceGlyphSetReq); - swaps(&stuff->length); - swapl(&stuff->gsid); - swapl(&stuff->existing); -@@ -2213,6 +2223,7 @@ static int - SProcRenderFreeGlyphSet(ClientPtr client) - { - REQUEST(xRenderFreeGlyphSetReq); -+ REQUEST_SIZE_MATCH(xRenderFreeGlyphSetReq); - swaps(&stuff->length); - swapl(&stuff->glyphset); - return (*ProcRenderVector[stuff->renderReqType]) (client); -@@ -2227,6 +2238,7 @@ SProcRenderAddGlyphs(ClientPtr client) - xGlyphInfo *gi; - - REQUEST(xRenderAddGlyphsReq); -+ REQUEST_AT_LEAST_SIZE(xRenderAddGlyphsReq); - swaps(&stuff->length); - swapl(&stuff->glyphset); - swapl(&stuff->nglyphs); -@@ -2261,6 +2273,7 @@ static int - SProcRenderFreeGlyphs(ClientPtr client) - { - REQUEST(xRenderFreeGlyphsReq); -+ REQUEST_AT_LEAST_SIZE(xRenderFreeGlyphsReq); - swaps(&stuff->length); - swapl(&stuff->glyphset); - SwapRestL(stuff); -@@ -2278,6 +2291,7 @@ SProcRenderCompositeGlyphs(ClientPtr client) - int size; - - REQUEST(xRenderCompositeGlyphsReq); -+ REQUEST_AT_LEAST_SIZE(xRenderCompositeGlyphsReq); - - switch (stuff->renderReqType) { - default: --- -2.1.2 - diff --git a/x11-servers/xorg-server/files/patch-CVE-2014-8101 b/x11-servers/xorg-server/files/patch-CVE-2014-8101 deleted file mode 100644 index d7fcb8d..0000000 --- a/x11-servers/xorg-server/files/patch-CVE-2014-8101 +++ /dev/null @@ -1,51 +0,0 @@ -From 3df2fcf12499ebdb26b9b67419ea485a42041f33 Mon Sep 17 00:00:00 2001 -From: Alan Coopersmith <alan.coopersmith@oracle.com> -Date: Sun, 26 Jan 2014 19:38:09 -0800 -Subject: [PATCH 12/40] randr: unvalidated lengths in RandR extension swapped - procs [CVE-2014-8101] - -Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> -Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> ---- - randr/rrsdispatch.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/randr/rrsdispatch.c b/randr/rrsdispatch.c -index 08c3b6a..47558cf 100644 ---- randr/rrsdispatch.c -+++ randr/rrsdispatch.c -@@ -27,6 +27,7 @@ SProcRRQueryVersion(ClientPtr client) - { - REQUEST(xRRQueryVersionReq); - -+ REQUEST_SIZE_MATCH(xRRQueryVersionReq); - swaps(&stuff->length); - swapl(&stuff->majorVersion); - swapl(&stuff->minorVersion); -@@ -38,6 +39,7 @@ SProcRRGetScreenInfo(ClientPtr client) - { - REQUEST(xRRGetScreenInfoReq); - -+ REQUEST_SIZE_MATCH(xRRGetScreenInfoReq); - swaps(&stuff->length); - swapl(&stuff->window); - return (*ProcRandrVector[stuff->randrReqType]) (client); -@@ -69,6 +71,7 @@ SProcRRSelectInput(ClientPtr client) - { - REQUEST(xRRSelectInputReq); - -+ REQUEST_SIZE_MATCH(xRRSelectInputReq); - swaps(&stuff->length); - swapl(&stuff->window); - swaps(&stuff->enable); -@@ -152,6 +155,7 @@ SProcRRConfigureOutputProperty(ClientPtr client) - { - REQUEST(xRRConfigureOutputPropertyReq); - -+ REQUEST_AT_LEAST_SIZE(xRRConfigureOutputPropertyReq); - swaps(&stuff->length); - swapl(&stuff->output); - swapl(&stuff->property); --- -2.1.2 - diff --git a/x11-servers/xorg-server/files/patch-CVE-2014-8102 b/x11-servers/xorg-server/files/patch-CVE-2014-8102 deleted file mode 100644 index 46f4ead..0000000 --- a/x11-servers/xorg-server/files/patch-CVE-2014-8102 +++ /dev/null @@ -1,27 +0,0 @@ -From a0ece23a8bd300c8be10812d368dc8058c97c63e Mon Sep 17 00:00:00 2001 -From: Alan Coopersmith <alan.coopersmith@oracle.com> -Date: Sun, 26 Jan 2014 20:02:20 -0800 -Subject: [PATCH 15/40] xfixes: unvalidated length in - SProcXFixesSelectSelectionInput [CVE-2014-8102] - -Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> -Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> ---- - xfixes/select.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/xfixes/select.c b/xfixes/select.c -index c088ed3..e964d58 100644 ---- xfixes/select.c -+++ xfixes/select.c -@@ -201,6 +201,7 @@ SProcXFixesSelectSelectionInput(ClientPtr client) - { - REQUEST(xXFixesSelectSelectionInputReq); - -+ REQUEST_SIZE_MATCH(xXFixesSelectSelectionInputReq); - swaps(&stuff->length); - swapl(&stuff->window); - swapl(&stuff->selection); --- -2.1.2 - diff --git a/x11-servers/xorg-server/files/patch-CVE-2015-0255 b/x11-servers/xorg-server/files/patch-CVE-2015-0255 deleted file mode 100644 index 88f587c..0000000 --- a/x11-servers/xorg-server/files/patch-CVE-2015-0255 +++ /dev/null @@ -1,175 +0,0 @@ -This patch has two commits. One is needed to address the CVE the other -is allow the patch to apply. - -http://lists.freedesktop.org/archives/xorg/2015-February/057158.html - -http://cgit.freedesktop.org/xorg/xserver/patch/?id=20079c36cf7d377938ca5478447d8b9045cb7d43 -http://cgit.freedesktop.org/xorg/xserver/patch/?id=81c90dc8f0aae3b65730409b1b615b5fa7280ebd - ---- xkb/xkb.c.orig 2015-02-12 20:30:54.131767000 +0100 -+++ xkb/xkb.c 2015-02-12 20:31:01.849633000 +0100 -@@ -4958,26 +4958,29 @@ ProcXkbGetGeometry(ClientPtr client) - - /***====================================================================***/ - --static char * --_GetCountedString(char **wire_inout, Bool swap) -+static Status -+_GetCountedString(char **wire_inout, ClientPtr client, char **str) - { -- char *wire, *str; -- CARD16 len, *plen; -+ char *wire, *next; -+ CARD16 len; - - wire = *wire_inout; -- plen = (CARD16 *) wire; -- if (swap) { -- swaps(plen); -- } -- len = *plen; -- str = malloc(len + 1); -- if (str) { -- memcpy(str, &wire[2], len); -- str[len] = '\0'; -+ len = *(CARD16 *) wire; -+ if (client->swapped) { -+ swaps(&len); - } -- wire += XkbPaddedSize(len + 2); -- *wire_inout = wire; -- return str; -+ next = wire + XkbPaddedSize(len + 2); -+ /* Check we're still within the size of the request */ -+ if (client->req_len < -+ bytes_to_int32(next - (char *) client->requestBuffer)) -+ return BadValue; -+ *str = malloc(len + 1); -+ if (!*str) -+ return BadAlloc; -+ memcpy(*str, &wire[2], len); -+ *(*str + len) = '\0'; -+ *wire_inout = next; -+ return Success; - } - - static Status -@@ -4986,25 +4989,29 @@ _CheckSetDoodad(char **wire_inout, - { - char *wire; - xkbDoodadWireDesc *dWire; -+ xkbAnyDoodadWireDesc any; -+ xkbTextDoodadWireDesc text; - XkbDoodadPtr doodad; -+ Status status; - - dWire = (xkbDoodadWireDesc *) (*wire_inout); -+ any = dWire->any; - wire = (char *) &dWire[1]; - if (client->swapped) { -- swapl(&dWire->any.name); -- swaps(&dWire->any.top); -- swaps(&dWire->any.left); -- swaps(&dWire->any.angle); -+ swapl(&any.name); -+ swaps(&any.top); -+ swaps(&any.left); -+ swaps(&any.angle); - } - CHK_ATOM_ONLY(dWire->any.name); -- doodad = XkbAddGeomDoodad(geom, section, dWire->any.name); -+ doodad = XkbAddGeomDoodad(geom, section, any.name); - if (!doodad) - return BadAlloc; - doodad->any.type = dWire->any.type; - doodad->any.priority = dWire->any.priority; -- doodad->any.top = dWire->any.top; -- doodad->any.left = dWire->any.left; -- doodad->any.angle = dWire->any.angle; -+ doodad->any.top = any.top; -+ doodad->any.left = any.left; -+ doodad->any.angle = any.angle; - switch (doodad->any.type) { - case XkbOutlineDoodad: - case XkbSolidDoodad: -@@ -5027,15 +5034,22 @@ _CheckSetDoodad(char **wire_inout, - dWire->text.colorNdx); - return BadMatch; - } -+ text = dWire->text; - if (client->swapped) { -- swaps(&dWire->text.width); -- swaps(&dWire->text.height); -+ swaps(&text.width); -+ swaps(&text.height); - } -- doodad->text.width = dWire->text.width; -- doodad->text.height = dWire->text.height; -+ doodad->text.width = text.width; -+ doodad->text.height = text.height; - doodad->text.color_ndx = dWire->text.colorNdx; -- doodad->text.text = _GetCountedString(&wire, client->swapped); -- doodad->text.font = _GetCountedString(&wire, client->swapped); -+ status = _GetCountedString(&wire, client, &doodad->text.text); -+ if (status != Success) -+ return status; -+ status = _GetCountedString(&wire, client, &doodad->text.font); -+ if (status != Success) { -+ free (doodad->text.text); -+ return status; -+ } - break; - case XkbIndicatorDoodad: - if (dWire->indicator.onColorNdx >= geom->num_colors) { -@@ -5070,7 +5084,9 @@ _CheckSetDoodad(char **wire_inout, - } - doodad->logo.color_ndx = dWire->logo.colorNdx; - doodad->logo.shape_ndx = dWire->logo.shapeNdx; -- doodad->logo.logo_name = _GetCountedString(&wire, client->swapped); -+ status = _GetCountedString(&wire, client, &doodad->logo.logo_name); -+ if (status != Success) -+ return status; - break; - default: - client->errorValue = _XkbErrCode2(0x4F, dWire->any.type); -@@ -5302,18 +5318,20 @@ _CheckSetGeom(XkbGeometryPtr geom, xkbSe - char *wire; - - wire = (char *) &req[1]; -- geom->label_font = _GetCountedString(&wire, client->swapped); -+ status = _GetCountedString(&wire, client, &geom->label_font); -+ if (status != Success) -+ return status; - - for (i = 0; i < req->nProperties; i++) { - char *name, *val; - -- name = _GetCountedString(&wire, client->swapped); -- if (!name) -- return BadAlloc; -- val = _GetCountedString(&wire, client->swapped); -- if (!val) { -+ status = _GetCountedString(&wire, client, &name); -+ if (status != Success) -+ return status; -+ status = _GetCountedString(&wire, client, &val); -+ if (status != Success) { - free(name); -- return BadAlloc; -+ return status; - } - if (XkbAddGeomProperty(geom, name, val) == NULL) { - free(name); -@@ -5347,9 +5365,9 @@ _CheckSetGeom(XkbGeometryPtr geom, xkbSe - for (i = 0; i < req->nColors; i++) { - char *name; - -- name = _GetCountedString(&wire, client->swapped); -- if (!name) -- return BadAlloc; -+ status = _GetCountedString(&wire, client, &name); -+ if (status != Success) -+ return status; - if (!XkbAddGeomColor(geom, name, geom->num_colors)) { - free(name); - return BadAlloc; diff --git a/x11-servers/xorg-server/files/patch-Xserver-hw-xfree86-os-support-bsd-i386_video.c b/x11-servers/xorg-server/files/patch-Xserver-hw-xfree86-os-support-bsd-i386_video.c index d0bbe3d..933742b 100644 --- a/x11-servers/xorg-server/files/patch-Xserver-hw-xfree86-os-support-bsd-i386_video.c +++ b/x11-servers/xorg-server/files/patch-Xserver-hw-xfree86-os-support-bsd-i386_video.c @@ -1,5 +1,8 @@ -Index: hw/xfree86/os-support/bsd/i386_video.c -@@ -32,6 +32,7 @@ +Index: programs/Xserver/hw/xfree86/os-support/bsd/i386_video.c +diff -u -p programs/Xserver/hw/xfree86/os-support/bsd/i386_video.c.orig programs/Xserver/hw/xfree86/os-support/bsd/i386_video.c +--- hw/xfree86/os-support/bsd/i386_video.c.orig Tue Oct 4 01:46:14 2005 ++++ hw/xfree86/os-support/bsd/i386_video.c Thu Jan 26 14:57:56 2006 +@@ -35,6 +35,7 @@ #include "xf86Priv.h" #include <errno.h> diff --git a/x11-servers/xorg-server/files/patch-Xserver-hw-xfree86-os-support-misc-Makefile.in b/x11-servers/xorg-server/files/patch-Xserver-hw-xfree86-os-support-misc-Makefile.in index c125955..8a05ae6 100644 --- a/x11-servers/xorg-server/files/patch-Xserver-hw-xfree86-os-support-misc-Makefile.in +++ b/x11-servers/xorg-server/files/patch-Xserver-hw-xfree86-os-support-misc-Makefile.in @@ -1,9 +1,9 @@ ---- hw/xfree86/os-support/misc/Makefile.in.orig 2015-09-03 22:36:34.000000000 +0000 -+++ hw/xfree86/os-support/misc/Makefile.in 2015-09-03 22:33:10.000000000 +0000 -@@ -445,7 +445,8 @@ libmisc_la_SOURCES = SlowBcopy.c +--- hw/xfree86/os-support/misc/Makefile.in.orig 2015-09-23 10:21:18.470900000 +0200 ++++ hw/xfree86/os-support/misc/Makefile.in 2015-09-23 10:22:34.979974000 +0200 +@@ -530,7 +530,8 @@ #AM_LDFLAGS = -r - INCLUDES = $(XORG_INCS) + AM_CPPFLAGS = $(XORG_INCS) -AM_CFLAGS = $(XORG_CFLAGS) $(DIX_CFLAGS) +@I386_VIDEO_TRUE@I386_VIDEO_CFLAGS = -mno-sse +AM_CFLAGS = $(I386_VIDEO_CFLAGS) $(XORG_CFLAGS) $(DIX_CFLAGS) diff --git a/x11-servers/xorg-server/files/patch-config_config-backends.h b/x11-servers/xorg-server/files/patch-config_config-backends.h index 89d3c65..9b696c7 100644 --- a/x11-servers/xorg-server/files/patch-config_config-backends.h +++ b/x11-servers/xorg-server/files/patch-config_config-backends.h @@ -1,6 +1,6 @@ ---- config/config-backends.h.orig 2014-04-12 15:29:14 UTC -+++ config/config-backends.h -@@ -75,3 +75,8 @@ void config_hal_fini(void); +--- config/config-backends.h.orig 2014-12-09 22:02:34.000000000 +0100 ++++ config/config-backends.h 2014-12-21 23:08:34.268311262 +0100 +@@ -44,3 +44,8 @@ int config_wscons_init(void); void config_wscons_fini(void); #endif diff --git a/x11-servers/xorg-server/files/patch-config_devd.c b/x11-servers/xorg-server/files/patch-config_devd.c index edf0b83..f2178fb 100644 --- a/x11-servers/xorg-server/files/patch-config_devd.c +++ b/x11-servers/xorg-server/files/patch-config_devd.c @@ -377,7 +377,7 @@ +} + +static CARD32 -+reconnect_handler(OsTimerPtr timer, CARD32 time, pointer arg) ++reconnect_handler(OsTimerPtr timer, CARD32 time, void *arg) +{ + int newsock; + diff --git a/x11-servers/xorg-server/files/patch-configure b/x11-servers/xorg-server/files/patch-configure new file mode 100644 index 0000000..c2284b9 --- /dev/null +++ b/x11-servers/xorg-server/files/patch-configure @@ -0,0 +1,11 @@ +--- configure.orig 2015-03-05 13:53:47.431303000 +0100 ++++ configure 2015-03-05 13:54:06.598309000 +0100 +@@ -25560,7 +25560,7 @@ + case "x$XTRANS_SEND_FDS" in + xauto) + case "$host_os" in +- linux*|solaris*) ++ linux*|solaris*|freebsd*|dragonfly*) + XTRANS_SEND_FDS=yes + ;; + *) diff --git a/x11-servers/xorg-server/files/patch-hw_xfree86_loader_loadmod.c b/x11-servers/xorg-server/files/patch-hw_xfree86_loader_loadmod.c deleted file mode 100644 index 3af4e16..0000000 --- a/x11-servers/xorg-server/files/patch-hw_xfree86_loader_loadmod.c +++ /dev/null @@ -1,11 +0,0 @@ ---- hw/xfree86/loader/loadmod.c.orig 2014-04-12 15:29:14 UTC -+++ hw/xfree86/loader/loadmod.c -@@ -490,7 +490,7 @@ LoaderListDirs(const char **subdirlist, - char **elem; - const char **subdirs; - const char **s; -- PatternPtr patterns; -+ PatternPtr patterns = NULL; - PatternPtr p; - DIR *d; - struct dirent *dp; diff --git a/x11-servers/xorg-server/files/patch-hw_xfree86_modes_xf86Crtc.c b/x11-servers/xorg-server/files/patch-hw_xfree86_modes_xf86Crtc.c deleted file mode 100644 index 8e89fbc..0000000 --- a/x11-servers/xorg-server/files/patch-hw_xfree86_modes_xf86Crtc.c +++ /dev/null @@ -1,12 +0,0 @@ ---- hw/xfree86/modes/xf86Crtc.c.orig 2014-04-15 01:01:57 UTC -+++ hw/xfree86/modes/xf86Crtc.c -@@ -1774,6 +1774,9 @@ SetCompatOutput(xf86CrtcConfigPtr config - DisplayModePtr maxmode = NULL, testmode, mode; - int o, compat = -1, count, mincount = 0; - -+ if (config->num_output == 0) -+ return NULL; -+ - /* Look for one that's definitely connected */ - for (o = 0; o < config->num_output; o++) { - test = config->output[o]; diff --git a/x11-servers/xorg-server/files/patch-xkb_Makefile.in b/x11-servers/xorg-server/files/patch-xkb_Makefile.in index 48f821c..934bef0 100644 --- a/x11-servers/xorg-server/files/patch-xkb_Makefile.in +++ b/x11-servers/xorg-server/files/patch-xkb_Makefile.in @@ -1,6 +1,6 @@ ---- xkb/Makefile.in.orig 2014-12-12 22:12:45 UTC -+++ xkb/Makefile.in -@@ -790,7 +790,7 @@ info: info-am +--- xkb/Makefile.in.orig 2013-06-16 11:16:48.000000000 +0000 ++++ xkb/Makefile.in 2013-06-16 11:17:08.000000000 +0000 +@@ -816,7 +816,7 @@ info-am: diff --git a/x11-servers/xorg-server/pkg-plist b/x11-servers/xorg-server/pkg-plist index 62612ed..3b99a43 100644 --- a/x11-servers/xorg-server/pkg-plist +++ b/x11-servers/xorg-server/pkg-plist @@ -1,11 +1,6 @@ bin/X -%%SUID%%@owner root -%%SUID%%@group wheel -%%SUID%%@mode 4555 -bin/Xorg -%%SUID%%@owner root -%%SUID%%@group wheel -%%SUID%%@mode +%%SUID%%@(,,4555) bin/Xorg +%%NO_SUID%%bin/Xorg bin/cvt bin/gtf include/xorg/BT.h @@ -13,7 +8,6 @@ include/xorg/IBM.h include/xorg/TI.h include/xorg/XIstubs.h include/xorg/Xprintf.h -include/xorg/bt829.h include/xorg/callback.h include/xorg/client.h include/xorg/closestr.h @@ -39,8 +33,8 @@ include/xorg/dri.h include/xorg/dri2.h include/xorg/dristruct.h include/xorg/edid.h -include/xorg/exa.h include/xorg/events.h +include/xorg/exa.h include/xorg/exevents.h include/xorg/extension.h include/xorg/extinit.h @@ -48,17 +42,17 @@ include/xorg/extnsionst.h include/xorg/fb.h include/xorg/fbdevhw.h include/xorg/fboverlay.h -include/xorg/fbrop.h -include/xorg/fi1236.h include/xorg/fbpict.h +include/xorg/fbrop.h include/xorg/fourcc.h include/xorg/gc.h include/xorg/gcstruct.h include/xorg/geext.h include/xorg/geint.h +include/xorg/glamor.h include/xorg/globals.h -include/xorg/glyphstr.h include/xorg/glx_extinit.h +include/xorg/glyphstr.h include/xorg/hotplug.h include/xorg/i2c_def.h include/xorg/input.h @@ -67,32 +61,31 @@ include/xorg/list.h include/xorg/mi.h include/xorg/micmap.h include/xorg/micoord.h -include/xorg/mifillarc.h -include/xorg/mifpoly.h include/xorg/migc.h include/xorg/miline.h +include/xorg/mioverlay.h include/xorg/mipict.h include/xorg/mipointer.h include/xorg/mipointrst.h include/xorg/misc.h include/xorg/miscstruct.h -include/xorg/mispans.h include/xorg/mistruct.h include/xorg/misync.h +include/xorg/misyncfd.h +include/xorg/misyncshm.h include/xorg/misyncstr.h -include/xorg/miwideline.h include/xorg/mizerarc.h -include/xorg/mioverlay.h -include/xorg/msp3430.h include/xorg/opaque.h -include/xorg/os.h include/xorg/optionstr.h -include/xorg/panoramiXsrv.h +include/xorg/os.h include/xorg/panoramiX.h +include/xorg/panoramiXsrv.h include/xorg/picture.h include/xorg/picturestr.h include/xorg/pixmap.h include/xorg/pixmapstr.h +include/xorg/present.h +include/xorg/presentext.h include/xorg/privates.h include/xorg/property.h include/xorg/propertyst.h @@ -116,10 +109,6 @@ include/xorg/site.h include/xorg/swaprep.h include/xorg/swapreq.h include/xorg/syncsdk.h -include/xorg/tda8425.h -include/xorg/tda9850.h -include/xorg/tda9885.h -include/xorg/uda1380.h include/xorg/validate.h include/xorg/vbe.h include/xorg/vbeModes.h @@ -145,14 +134,13 @@ include/xorg/xf86Pci.h include/xorg/xf86PciInfo.h include/xorg/xf86Priv.h include/xorg/xf86Privstr.h -include/xorg/xf86RandR12.h include/xorg/xf86RamDac.h -include/xorg/xf86Rename.h +include/xorg/xf86RandR12.h %%SPARC64%%include/xorg/xf86Sbus.h +include/xorg/xf86VGAarbiter.h include/xorg/xf86Xinput.h include/xorg/xf86_OSlib.h include/xorg/xf86_OSproc.h -include/xorg/xf86VGAarbiter.h include/xorg/xf86cmap.h include/xorg/xf86fbman.h include/xorg/xf86i2c.h @@ -174,23 +162,18 @@ include/xorg/xorgVersion.h include/xorg/xserver-properties.h include/xorg/xvdix.h include/xorg/xvmcext.h +lib/xorg/modules/drivers/modesetting_drv.so lib/xorg/modules/extensions/.xorg/libglx.so lib/xorg/modules/libexa.so lib/xorg/modules/libfb.so lib/xorg/modules/libfbdevhw.so +lib/xorg/modules/libglamoregl.so lib/xorg/modules/libint10.so lib/xorg/modules/libshadow.so lib/xorg/modules/libshadowfb.so lib/xorg/modules/libvbe.so lib/xorg/modules/libvgahw.so lib/xorg/modules/libwfb.so -lib/xorg/modules/multimedia/bt829_drv.so -lib/xorg/modules/multimedia/fi1236_drv.so -lib/xorg/modules/multimedia/msp3430_drv.so -lib/xorg/modules/multimedia/tda8425_drv.so -lib/xorg/modules/multimedia/tda9850_drv.so -lib/xorg/modules/multimedia/tda9885_drv.so -lib/xorg/modules/multimedia/uda1380_drv.so lib/xorg/protocol.txt libdata/pkgconfig/xorg-server.pc man/man1/Xorg.1.gz @@ -199,6 +182,7 @@ man/man1/cvt.1.gz man/man1/gtf.1.gz man/man4/exa.4.gz man/man4/fbdevhw.4.gz +man/man4/modesetting.4.gz man/man5/xorg.conf.5.gz man/man5/xorg.conf.d.5.gz share/aclocal/xorg-server.m4 diff --git a/x11-servers/xorg-vfbserver/Makefile b/x11-servers/xorg-vfbserver/Makefile index b7cb917..f7e7021 100644 --- a/x11-servers/xorg-vfbserver/Makefile +++ b/x11-servers/xorg-vfbserver/Makefile @@ -2,8 +2,7 @@ # $FreeBSD$ PORTNAME= xorg-vfbserver -PORTVERSION= 1.14.7 -PORTREVISION= 1 +PORTVERSION= 1.17.2 PORTEPOCH= 1 CATEGORIES= x11-servers MASTER_SITES= XORG/individual/xserver @@ -31,7 +30,6 @@ CONFIGURE_ARGS= --disable-dmx \ --localstatedir=/var \ --without-dtrace \ --without-doxygen \ - --disable-libpciaccess \ --disable-glx \ --disable-dri \ --disable-config-hal \ @@ -51,14 +49,7 @@ USE_XORG= pixman x11 fixesproto damageproto xcmiscproto xtrans \ PLIST_FILES= bin/Xvfb \ man/man1/Xvfb.1.gz -.include <bsd.port.pre.mk> - -.if ${ARCH} == armv6 -EXTRA_PATCHES+= ${.CURDIR}/../xorg-server/files/extra-arm-patch-hw__xfree86__os-support__bsd__Makefile.in -EXTRA_PATCHES+= ${.CURDIR}/../xorg-server/files/extra-arm-patch-include__servermd.h -.endif - do-install: cd ${WRKSRC}/hw/vfb; DESTDIR=${STAGEDIR} ${MAKE} install -.include <bsd.port.post.mk> +.include <bsd.port.mk> diff --git a/x11-servers/xorg-vfbserver/distinfo b/x11-servers/xorg-vfbserver/distinfo index 7574aaa..878bc1b 100644 --- a/x11-servers/xorg-vfbserver/distinfo +++ b/x11-servers/xorg-vfbserver/distinfo @@ -1,2 +1,2 @@ -SHA256 (xorg/xserver/xorg-server-1.14.7.tar.bz2) = fcf66fa6ad86227613d2d3e8ae13ded297e2a1e947e9060a083eaf80d323451f -SIZE (xorg/xserver/xorg-server-1.14.7.tar.bz2) = 5520884 +SHA256 (xorg/xserver/xorg-server-1.17.2.tar.bz2) = f61120612728f2c5034671d0ca3e2273438c60aba93b3dda4a8aa40e6a257993 +SIZE (xorg/xserver/xorg-server-1.17.2.tar.bz2) = 5767983 |
