28 changed files with 797 additions and 1103 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1 +1 @@
-/libX11-*.tar.bz2
+SOURCES/libX11-1.6.8.tar.bz2
--- a/.libX11.metadata
+++ b/.libX11.metadata
@ -0,0 +1 @@
+f1ea96fe472a981d378b4f2eec90dcd063f9a407 SOURCES/libX11-1.6.8.tar.bz2
--- a/0001-makekeys-handle-the-new-_EVDEVK-xorgproto-symbols.patch
+++ b/0001-makekeys-handle-the-new-_EVDEVK-xorgproto-symbols.patch
@ -1,43 +0,0 @@
-From e92efc63acd7b377faa9e534f4bf52aaa86be2a9 Mon Sep 17 00:00:00 2001
-From: Peter Hutterer <peter.hutterer@who-t.net>
-Date: Tue, 27 Jul 2021 11:46:19 +1000
-Subject: [PATCH libX11] makekeys: handle the new _EVDEVK xorgproto symbols
-
-These keys are all defined through a macro in the form:
-   #define XF86XK_BrightnessAuto		_EVDEVK(0x0F4)
-
-The _EVDEVK macro is simply an offset of 0x10081000.
-Let's parse these lines correctly so those keysyms end up in our
-hashtables.
-
-Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
---
- src/util/makekeys.c | 12 ++++++++++++
- 1 file changed, 12 insertions(+)
-
-diff --git a/src/util/makekeys.c b/src/util/makekeys.c
-index e847ef4c..4896cc53 100644
--- a/src/util/makekeys.c
-+++ b/src/util/makekeys.c
-@@ -78,6 +78,18 @@ parse_line(const char *buf, char *key, KeySym *val, char *prefix)
-         return 1;
-     }
- 
-+    /* See if we can parse one of the _EVDEVK symbols */
-+    i = sscanf(buf, "#define %127s _EVDEVK(0x%lx)", key, val);
-+    if (i == 2 && (tmp = strstr(key, "XK_"))) {
-+        memcpy(prefix, key, (size_t)(tmp - key));
-+        prefix[tmp - key] = '\0';
-+        tmp += 3;
-+        memmove(key, tmp, strlen(tmp) + 1);
-+
-+        *val += 0x10081000;
-+        return 1;
-+    }
-+
-     /* Now try to catch alias (XK_foo XK_bar) definitions, and resolve them
-      * immediately: if the target is in the form XF86XK_foo, we need to
-      * canonicalise this to XF86foo before we do the lookup. */
-- 
-2.31.1
-
--- a/0001-ximcp-Unmark-to-fabricate-key-events-with-XKeyEvent-.patch
+++ b/0001-ximcp-Unmark-to-fabricate-key-events-with-XKeyEvent-.patch
@ -1,200 +0,0 @@
-From a91e5a5e6fca25f23c7dd24c6694ab1b80b6030e Mon Sep 17 00:00:00 2001
-From: Takao Fujiwara <tfujiwar@redhat.com>
-Date: Fri, 12 Apr 2024 10:21:41 +0900
-Subject: [PATCH libX11 1/7] ximcp: Unmark to fabricate key events with
- XKeyEvent serial
-
-_XimProtoKeypressFilter() and _XimProtoKeyreleaseFilter() can
-receive XKeyEvent from both the typing on the keyboard and the
-callback of XIM_FORWARD_EVENT.
-
-If the filter functions unmark to fabricate XKeyEvent from the typing
-on the keyboard during receiving XKeyEvent from the callback of
-XIM_FORWARD_EVENT with typing keys very quickly likes an bar code
-scanner (or evemu-play), XIM server cannot receive some key events and
-it causes the key typing order to get scrambled.
-
-Now XIM client saves the serial in XKeyEvent and the filter functions
-unmark to fabricate XKeyEvent from the callback of XIM_FORWARD_EVENT
-only.
-
-This and 024d229f are same patches but the regression issues will be
-fixed by the later patches.
-
-Closes: #198
-Fixes: 024d229f ("ximcp: Unmark to fabricate key events with XKeyEvent serial")
-Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/246>
-(cherry picked from commit 13e9ac4d458069c81d795f6b4842814d30431b4b)
---
- modules/im/ximcp/imDefFlt.c  |  8 ++---
- modules/im/ximcp/imDefIm.c   |  1 +
- modules/im/ximcp/imDefLkup.c | 58 ++++++++++++++++++++++++++++++++----
- src/xlibi18n/XimintP.h       | 17 +++++++++++
- 4 files changed, 75 insertions(+), 9 deletions(-)
-
-diff --git a/modules/im/ximcp/imDefFlt.c b/modules/im/ximcp/imDefFlt.c
-index f89d2cb0..a7948df8 100644
--- a/modules/im/ximcp/imDefFlt.c
-+++ b/modules/im/ximcp/imDefFlt.c
-@@ -142,9 +142,9 @@ _XimProtoKeypressFilter(
- {
-     Xim		im = (Xim)ic->core.im;
- 
-    if ((ev->keycode == 0) || IS_FABRICATED(im)) {
-+    if ((ev->keycode == 0) || _XimIsFabricatedSerial(im, ev->serial)) {
- 	_XimPendingFilter(ic);
-	UNMARK_FABRICATED(im);
-+	_XimUnfabricateSerial(im, ev->serial);
- 	return NOTFILTERD;
-     }
- 
-@@ -203,9 +203,9 @@ _XimProtoKeyreleaseFilter(
- {
-     Xim		im = (Xim)ic->core.im;
- 
-    if (IS_FABRICATED(im)) {
-+    if (_XimIsFabricatedSerial(im, ev->serial)) {
- 	_XimPendingFilter(ic);
-	UNMARK_FABRICATED(im);
-+	_XimUnfabricateSerial(im, ev->serial);
- 	return NOTFILTERD;
-     }
- 
-diff --git a/modules/im/ximcp/imDefIm.c b/modules/im/ximcp/imDefIm.c
-index ccdf14c1..a231a0ac 100644
--- a/modules/im/ximcp/imDefIm.c
-+++ b/modules/im/ximcp/imDefIm.c
-@@ -430,6 +430,7 @@ _XimPreConnect(
- 	return False;
- 
-     im->private.proto.im_window = im_window;
-+    im->private.proto.fabricated_serial = 0;
-     return True;
- }
- 
-diff --git a/modules/im/ximcp/imDefLkup.c b/modules/im/ximcp/imDefLkup.c
-index 18289a80..a6923d5b 100644
--- a/modules/im/ximcp/imDefLkup.c
-+++ b/modules/im/ximcp/imDefLkup.c
-@@ -351,6 +351,54 @@ _XimForwardEvent(
-     return _XimForwardEventCore(ic, ev, sync);
- }
- 
-+Bool
-+_XimFabricateSerial(
-+    Xim			 im,
-+    unsigned long	 serial)
-+{
-+    if (!serial)
-+	return False;
-+    if (serial == im->private.proto.fabricated_serial) {
-+	fprintf(stderr, "%s,%d: The key event is already fabricated.\n", __FILE__, __LINE__);
-+	return False;
-+    }
-+    if (im->private.proto.fabricated_serial)
-+	fprintf(stderr, "%s,%d: Tried to fabricate a wrong key event.\n", __FILE__, __LINE__);
-+
-+    MARK_FABRICATED(im);
-+    im->private.proto.fabricated_serial = serial;
-+    return True;
-+}
-+
-+Bool
-+_XimUnfabricateSerial(
-+    Xim			 im,
-+    unsigned long	 serial)
-+{
-+    if (!serial)
-+	return False;
-+    if (!im->private.proto.fabricated_serial) {
-+	fprintf(stderr, "%s,%d: The key event is already unfabricated.\n", __FILE__, __LINE__);
-+	return False;
-+    }
-+    if (serial != im->private.proto.fabricated_serial)
-+	fprintf(stderr, "%s,%d: Tried to unfabricate a wrong key event.\n", __FILE__, __LINE__);
-+
-+    im->private.proto.fabricated_serial = 0;
-+    UNMARK_FABRICATED(im);
-+    return True;
-+}
-+
-+Bool
-+_XimIsFabricatedSerial(
-+    Xim			 im,
-+    unsigned long	 serial)
-+{
-+    if (!serial)
-+	return False;
-+    return (serial == im->private.proto.fabricated_serial);
-+}
-+
- static void
- _XimProcEvent(
-     Display		*d,
-@@ -365,7 +413,7 @@ _XimProcEvent(
-     ev->xany.serial |= serial << 16;
-     ev->xany.send_event = False;
-     ev->xany.display = d;
-    MARK_FABRICATED(ic->core.im);
-+    _XimFabricateSerial((Xim)ic->core.im, ev->xany.serial);
-     return;
- }
- 
-@@ -727,10 +775,6 @@ _XimCommitRecv(
- 
-     (void)_XimRespSyncReply(ic, flag);
- 
-    if (ic->private.proto.registed_filter_event
-	& (KEYPRESS_MASK | KEYRELEASE_MASK))
-	    MARK_FABRICATED(im);
-
-     bzero(&ev, sizeof(ev));	/* uninitialized : found when running kterm under valgrind */
- 
-     ev.type = KeyPress;
-@@ -742,6 +786,10 @@ _XimCommitRecv(
- 
-     ev.time = 0L;
-     ev.serial = LastKnownRequestProcessed(im->core.display);
-+
-+    if (ic->private.proto.registed_filter_event
-+	& (KEYPRESS_MASK | KEYRELEASE_MASK))
-+	    _XimFabricateSerial(im, ev.serial);
-     /* FIXME :
-        I wish there were COMMENTs (!) about the data passed around.
-     */
-diff --git a/src/xlibi18n/XimintP.h b/src/xlibi18n/XimintP.h
-index 14a7e6d5..7f5b107a 100644
--- a/src/xlibi18n/XimintP.h
-+++ b/src/xlibi18n/XimintP.h
-@@ -149,6 +149,8 @@ typedef struct _XimProtoPrivateRec {
-     XimTransRegDispatcher	 register_dispatcher;
-     XimTransCallDispatcher	 call_dispatcher;
-     XPointer			 spec;
-+
-+    unsigned long                fabricated_serial;
- } XimProtoPrivateRec;
- 
- /*
-@@ -307,4 +309,19 @@ typedef struct _XicProtoPrivateRec {
- #define XIM_MAXIMNAMELEN 64
- #define XIM_MAXLCNAMELEN 64
- 
-+Bool
-+_XimFabricateSerial(
-+    Xim                  im,
-+    unsigned long        serial);
-+
-+Bool
-+_XimUnfabricateSerial(
-+    Xim                  im,
-+    unsigned long        serial);
-+
-+Bool
-+_XimIsFabricatedSerial(
-+    Xim                  im,
-+    unsigned long        serial);
-+
- #endif /* _XIMINTP_H */
-- 
-2.47.1
-
--- a/0002-imDefLkup-Commit-first-info-in-XimCommitInfo.patch
+++ b/0002-imDefLkup-Commit-first-info-in-XimCommitInfo.patch
@ -1,158 +0,0 @@
-From a1037538b74e4016c3a1c2ebef9b1836811ed687 Mon Sep 17 00:00:00 2001
-From: Takao Fujiwara <tfujiwar@redhat.com>
-Date: Fri, 12 Apr 2024 10:21:43 +0900
-Subject: [PATCH libX11 2/7] imDefLkup: Commit first info in XimCommitInfo
-
-Xic.private.proto.commit_info can receive multiple XimCommitInfo
-when typing keys very quickly like an bar code scanner (or evemu-play)
-and the first info in XimCommitInfo should be committed to keep
-the typing key order.
-
-This and 041b5291 are same patches but the regression issues will be
-fixed by the later patches.
-
-Closes: #198
-Fixes: 041b5291 ("imDefLkup: Commit first info in XimCommitInfo")
-Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/246>
-(cherry picked from commit c7790072657f9fdbe8cda031776617088c5f11db)
---
- modules/im/ximcp/imDefLkup.c | 60 +++++++++++++++++++++++++++++-------
- 1 file changed, 49 insertions(+), 11 deletions(-)
-
-diff --git a/modules/im/ximcp/imDefLkup.c b/modules/im/ximcp/imDefLkup.c
-index a6923d5b..31205e6b 100644
--- a/modules/im/ximcp/imDefLkup.c
-+++ b/modules/im/ximcp/imDefLkup.c
-@@ -650,18 +650,29 @@ _XimRegCommitInfo(
- }
- 
- static void
-_XimUnregCommitInfo(
-    Xic			ic)
-+_XimUnregRealCommitInfo(
-+    Xic			ic,
-+    Bool		reverse)
- {
-     XimCommitInfo	info;
-+    XimCommitInfo	prev_info = NULL;
- 
-    if (!(info = ic->private.proto.commit_info))
-+    info = ic->private.proto.commit_info;
-+    while (reverse && info) {
-+	if (!info->next)
-+	    break;
-+	prev_info = info;
-+	info = info->next;
-+    }
-+    if (!info)
- 	return;
- 
-
-     Xfree(info->string);
-     Xfree(info->keysym);
-    ic->private.proto.commit_info = info->next;
-+    if (prev_info)
-+	prev_info->next = info->next;
-+    else
-+	ic->private.proto.commit_info = info->next;
-     Xfree(info);
- 
-     /*
-@@ -679,6 +690,20 @@ _XimUnregCommitInfo(
-     return;
- }
- 
-+static void
-+_XimUnregCommitInfo(
-+    Xic			ic)
-+{
-+    _XimUnregRealCommitInfo(ic, False);
-+}
-+
-+static void
-+_XimUnregFirstCommitInfo(
-+    Xic			ic)
-+{
-+    _XimUnregRealCommitInfo(ic, True);
-+}
-+
- void
- _XimFreeCommitInfo(
-     Xic			ic)
-@@ -688,6 +713,19 @@ _XimFreeCommitInfo(
-     return;
- }
- 
-+static XimCommitInfo
-+_XimFirstCommitInfo(
-+    Xic			ic)
-+{
-+    XimCommitInfo info = ic->private.proto.commit_info;
-+    while (info) {
-+	if (!info->next)
-+	    break;
-+	info = info->next;
-+    }
-+    return info;
-+}
-+
- static Bool
- _XimProcKeySym(
-     Xic			  ic,
-@@ -1082,7 +1120,7 @@ _XimProtoMbLookupString(
- 	state = &tmp_state;
- 
-     if ((ev->type == KeyPress) && (ev->keycode == 0)) { /* Filter function */
-	if (!(info = ic->private.proto.commit_info)) {
-+	if (!(info = _XimFirstCommitInfo(ic))) {
- 	    *state = XLookupNone;
- 	    return 0;
- 	}
-@@ -1098,7 +1136,7 @@ _XimProtoMbLookupString(
- 	    else
- 		*state = XLookupKeySym;
- 	}
-	_XimUnregCommitInfo(ic);
-+	_XimUnregFirstCommitInfo(ic);
- 
-     } else  if (ev->type == KeyPress) {
- 	ret = _XimLookupMBText(ic, ev, buffer, bytes, keysym, NULL);
-@@ -1145,7 +1183,7 @@ _XimProtoWcLookupString(
- 	state = &tmp_state;
- 
-     if (ev->type == KeyPress && ev->keycode == 0) { /* Filter function */
-	if (!(info = ic->private.proto.commit_info)) {
-+	if (!(info = _XimFirstCommitInfo(ic))) {
-            *state = XLookupNone;
- 	    return 0;
- 	}
-@@ -1161,7 +1199,7 @@ _XimProtoWcLookupString(
- 	    else
- 		*state = XLookupKeySym;
- 	}
-	_XimUnregCommitInfo(ic);
-+	_XimUnregFirstCommitInfo(ic);
- 
-     } else if (ev->type == KeyPress) {
- 	ret = _XimLookupWCText(ic, ev, buffer, bytes, keysym, NULL);
-@@ -1208,7 +1246,7 @@ _XimProtoUtf8LookupString(
- 	state = &tmp_state;
- 
-     if (ev->type == KeyPress && ev->keycode == 0) { /* Filter function */
-	if (!(info = ic->private.proto.commit_info)) {
-+	if (!(info = _XimFirstCommitInfo(ic))) {
-            *state = XLookupNone;
- 	    return 0;
- 	}
-@@ -1224,7 +1262,7 @@ _XimProtoUtf8LookupString(
- 	    else
- 		*state = XLookupKeySym;
- 	}
-	_XimUnregCommitInfo(ic);
-+	_XimUnregFirstCommitInfo(ic);
- 
-     } else if (ev->type == KeyPress) {
- 	ret = _XimLookupUTF8Text(ic, ev, buffer, bytes, keysym, NULL);
-- 
-2.47.1
-
--- a/0003-imDefLkup-Mark-and-unmark-fabricated-with-serial-0.patch
+++ b/0003-imDefLkup-Mark-and-unmark-fabricated-with-serial-0.patch
@ -1,65 +0,0 @@
-From ed53956985d37c57fcd3587c642ee7ebf653d1af Mon Sep 17 00:00:00 2001
-From: Takao Fujiwara <tfujiwar@redhat.com>
-Date: Fri, 12 Apr 2024 10:50:33 +0900
-Subject: [PATCH libX11 3/7] imDefLkup: Mark and unmark fabricated with serial
- 0
-
-GTK2 applications with GTK_IM_MODULE=xim sets the serial number 0
-to the XKeyEvent and the previous _XimFabricateSerial() logic did
-not work for the applications.
-Now the API marks to fabricate with the serial 0.
-
-Closes: #205
-Fixes: 024d229f ("ximcp: Unmark to fabricate key events with XKeyEvent serial")
-Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/246>
-(cherry picked from commit 1181abd6ffede3ac5663a3a3d4ee66aef1fa553b)
---
- modules/im/ximcp/imDefLkup.c | 17 ++++++++++++-----
- 1 file changed, 12 insertions(+), 5 deletions(-)
-
-diff --git a/modules/im/ximcp/imDefLkup.c b/modules/im/ximcp/imDefLkup.c
-index 31205e6b..53cf1f87 100644
--- a/modules/im/ximcp/imDefLkup.c
-+++ b/modules/im/ximcp/imDefLkup.c
-@@ -356,8 +356,11 @@ _XimFabricateSerial(
-     Xim			 im,
-     unsigned long	 serial)
- {
-    if (!serial)
-	return False;
-+    /* GTK2 XIM module sets serial=0. */
-+    if (!serial) {
-+	MARK_FABRICATED(im);
-+	return True;
-+    }
-     if (serial == im->private.proto.fabricated_serial) {
- 	fprintf(stderr, "%s,%d: The key event is already fabricated.\n", __FILE__, __LINE__);
- 	return False;
-@@ -375,8 +378,11 @@ _XimUnfabricateSerial(
-     Xim			 im,
-     unsigned long	 serial)
- {
-    if (!serial)
-	return False;
-+    /* GTK2 XIM module sets serial=0. */
-+    if (!serial) {
-+	UNMARK_FABRICATED(im);
-+	return True;
-+    }
-     if (!im->private.proto.fabricated_serial) {
- 	fprintf(stderr, "%s,%d: The key event is already unfabricated.\n", __FILE__, __LINE__);
- 	return False;
-@@ -394,8 +400,9 @@ _XimIsFabricatedSerial(
-     Xim			 im,
-     unsigned long	 serial)
- {
-+    /* GTK2 XIM module sets serial=0. */
-     if (!serial)
-	return False;
-+	return IS_FABRICATED(im);
-     return (serial == im->private.proto.fabricated_serial);
- }
- 
-- 
-2.47.1
-
--- a/0004-ximcp-Add-fabricated_time-in-XimProtoPrivate-for-tim.patch
+++ b/0004-ximcp-Add-fabricated_time-in-XimProtoPrivate-for-tim.patch
@ -1,216 +0,0 @@
-From 24f2fdba4e5162ebcb011ce41104fb195b163169 Mon Sep 17 00:00:00 2001
-From: Takao Fujiwara <tfujiwar@redhat.com>
-Date: Fri, 26 Apr 2024 00:49:14 +0900
-Subject: [PATCH libX11 4/7] ximcp: Add fabricated_time in XimProtoPrivate for
- timeout
-
-When users type keys quickly, some applications using Steam or Java
-do not call XNextEvent() for a key event but _XimFilterKeypress()
-and _XimFilterKeyrelease() expect to receive the key events
-forwarded by input methods.
-
-Now fabricated_time Time value is added to XimProtoPrivate to check
-the timeout value.
-
-Closes: #205
-Fixes: 024d229f ("ximcp: Unmark to fabricate key events with XKeyEvent serial")
-Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/246>
-(cherry picked from commit 5a14178c7cc408f425fe298aeade3dee749b1ca1)
---
- modules/im/ximcp/imDefFlt.c  |  8 +++---
- modules/im/ximcp/imDefIm.c   |  2 ++
- modules/im/ximcp/imDefLkup.c | 48 ++++++++++++++++++++++++++----------
- src/xlibi18n/XimintP.h       | 10 +++++---
- 4 files changed, 47 insertions(+), 21 deletions(-)
-
-diff --git a/modules/im/ximcp/imDefFlt.c b/modules/im/ximcp/imDefFlt.c
-index a7948df8..ad8a272b 100644
--- a/modules/im/ximcp/imDefFlt.c
-+++ b/modules/im/ximcp/imDefFlt.c
-@@ -142,9 +142,9 @@ _XimProtoKeypressFilter(
- {
-     Xim		im = (Xim)ic->core.im;
- 
-    if ((ev->keycode == 0) || _XimIsFabricatedSerial(im, ev->serial)) {
-+    if ((ev->keycode == 0) || _XimIsFabricatedSerial(im, ev)) {
- 	_XimPendingFilter(ic);
-	_XimUnfabricateSerial(im, ev->serial);
-+	_XimUnfabricateSerial(im, ev);
- 	return NOTFILTERD;
-     }
- 
-@@ -203,9 +203,9 @@ _XimProtoKeyreleaseFilter(
- {
-     Xim		im = (Xim)ic->core.im;
- 
-    if (_XimIsFabricatedSerial(im, ev->serial)) {
-+    if (_XimIsFabricatedSerial(im, ev)) {
- 	_XimPendingFilter(ic);
-	_XimUnfabricateSerial(im, ev->serial);
-+	_XimUnfabricateSerial(im, ev);
- 	return NOTFILTERD;
-     }
- 
-diff --git a/modules/im/ximcp/imDefIm.c b/modules/im/ximcp/imDefIm.c
-index a231a0ac..7eba0b34 100644
--- a/modules/im/ximcp/imDefIm.c
-+++ b/modules/im/ximcp/imDefIm.c
-@@ -431,6 +431,8 @@ _XimPreConnect(
- 
-     im->private.proto.im_window = im_window;
-     im->private.proto.fabricated_serial = 0;
-+    im->private.proto.fabricated_time = 0;
-+    im->private.proto.enable_fabricated_order = True;
-     return True;
- }
- 
-diff --git a/modules/im/ximcp/imDefLkup.c b/modules/im/ximcp/imDefLkup.c
-index 53cf1f87..6b2d27dc 100644
--- a/modules/im/ximcp/imDefLkup.c
-+++ b/modules/im/ximcp/imDefLkup.c
-@@ -354,14 +354,14 @@ _XimForwardEvent(
- Bool
- _XimFabricateSerial(
-     Xim			 im,
-    unsigned long	 serial)
-+    XKeyEvent		*event)
- {
-     /* GTK2 XIM module sets serial=0. */
-    if (!serial) {
-+    if (!event->serial || !im->private.proto.enable_fabricated_order) {
- 	MARK_FABRICATED(im);
- 	return True;
-     }
-    if (serial == im->private.proto.fabricated_serial) {
-+    if (event->serial == im->private.proto.fabricated_serial) {
- 	fprintf(stderr, "%s,%d: The key event is already fabricated.\n", __FILE__, __LINE__);
- 	return False;
-     }
-@@ -369,17 +369,18 @@ _XimFabricateSerial(
- 	fprintf(stderr, "%s,%d: Tried to fabricate a wrong key event.\n", __FILE__, __LINE__);
- 
-     MARK_FABRICATED(im);
-    im->private.proto.fabricated_serial = serial;
-+    im->private.proto.fabricated_serial = event->serial;
-+    im->private.proto.fabricated_time = event->time;
-     return True;
- }
- 
- Bool
- _XimUnfabricateSerial(
-     Xim			 im,
-    unsigned long	 serial)
-+    XKeyEvent		*event)
- {
-     /* GTK2 XIM module sets serial=0. */
-    if (!serial) {
-+    if (!event->serial || !im->private.proto.enable_fabricated_order) {
- 	UNMARK_FABRICATED(im);
- 	return True;
-     }
-@@ -387,10 +388,11 @@ _XimUnfabricateSerial(
- 	fprintf(stderr, "%s,%d: The key event is already unfabricated.\n", __FILE__, __LINE__);
- 	return False;
-     }
-    if (serial != im->private.proto.fabricated_serial)
-+    if (event->serial != im->private.proto.fabricated_serial)
- 	fprintf(stderr, "%s,%d: Tried to unfabricate a wrong key event.\n", __FILE__, __LINE__);
- 
-     im->private.proto.fabricated_serial = 0;
-+    im->private.proto.fabricated_time = 0;
-     UNMARK_FABRICATED(im);
-     return True;
- }
-@@ -398,12 +400,32 @@ _XimUnfabricateSerial(
- Bool
- _XimIsFabricatedSerial(
-     Xim			 im,
-    unsigned long	 serial)
-+    XKeyEvent		*event)
- {
-     /* GTK2 XIM module sets serial=0. */
-    if (!serial)
-	return IS_FABRICATED(im);
-    return (serial == im->private.proto.fabricated_serial);
-+    if (!event->serial || !im->private.proto.enable_fabricated_order)
-+	return IS_FABRICATED(im) ? True : False;
-+    if (event->serial == im->private.proto.fabricated_serial)
-+	return True;
-+    if (!im->private.proto.fabricated_serial)
-+	return False;
-+    /* Rotate time */
-+    if (event->time < im->private.proto.fabricated_time) {
-+	if (event->time >= 1000)
-+	    im->private.proto.fabricated_time = 0;
-+    } else if (event->time - im->private.proto.fabricated_time > 1000) {
-+	fprintf(stderr,
-+	        "%s,%d: The application disposed a key event with %ld serial.\n",
-+	        __FILE__, __LINE__,
-+	        im->private.proto.fabricated_serial);
-+	im->private.proto.enable_fabricated_order = False;
-+	if (IS_FABRICATED(im)) {
-+	    if (event->serial)
-+		im->private.proto.fabricated_serial = event->serial;
-+	    return True;
-+	}
-+    }
-+    return False;
- }
- 
- static void
-@@ -420,7 +442,7 @@ _XimProcEvent(
-     ev->xany.serial |= serial << 16;
-     ev->xany.send_event = False;
-     ev->xany.display = d;
-    _XimFabricateSerial((Xim)ic->core.im, ev->xany.serial);
-+    _XimFabricateSerial((Xim)ic->core.im, &ev->xkey);
-     return;
- }
- 
-@@ -834,7 +856,7 @@ _XimCommitRecv(
- 
-     if (ic->private.proto.registed_filter_event
- 	& (KEYPRESS_MASK | KEYRELEASE_MASK))
-	    _XimFabricateSerial(im, ev.serial);
-+	    _XimFabricateSerial(im, &ev);
-     /* FIXME :
-        I wish there were COMMENTs (!) about the data passed around.
-     */
-diff --git a/src/xlibi18n/XimintP.h b/src/xlibi18n/XimintP.h
-index 7f5b107a..715800c7 100644
--- a/src/xlibi18n/XimintP.h
-+++ b/src/xlibi18n/XimintP.h
-@@ -150,7 +150,9 @@ typedef struct _XimProtoPrivateRec {
-     XimTransCallDispatcher	 call_dispatcher;
-     XPointer			 spec;
- 
-    unsigned long                fabricated_serial;
-+    unsigned long		 fabricated_serial;
-+    Time			 fabricated_time;
-+    Bool			 enable_fabricated_order;
- } XimProtoPrivateRec;
- 
- /*
-@@ -312,16 +314,16 @@ typedef struct _XicProtoPrivateRec {
- Bool
- _XimFabricateSerial(
-     Xim                  im,
-    unsigned long        serial);
-+    XKeyEvent           *event);
- 
- Bool
- _XimUnfabricateSerial(
-     Xim                  im,
-    unsigned long        serial);
-+    XKeyEvent           *event);
- 
- Bool
- _XimIsFabricatedSerial(
-     Xim                  im,
-    unsigned long        serial);
-+    XKeyEvent           *event);
- 
- #endif /* _XIMINTP_H */
-- 
-2.47.1
-
--- a/0005-Accept-anon-windows-in-XFilterEvent-to-update-XIM-st.patch
+++ b/0005-Accept-anon-windows-in-XFilterEvent-to-update-XIM-st.patch
@ -1,168 +0,0 @@
-From b3157722535db692d54b8fe7d26d07f94d49daf3 Mon Sep 17 00:00:00 2001
-From: Takao Fujiwara <tfujiwar@redhat.com>
-Date: Fri, 26 Apr 2024 01:29:26 +0900
-Subject: [PATCH libX11 5/7] Accept anon windows in XFilterEvent to update XIM
- state
-
-When input focuses are switched quickly with shortcut keys in a Java
-window, the focus is sometimes lost and the Window=0 is assigned in
-XFilterEvent() but the XKeyEvent was forwarded by a XIM serer(IBus)
-with XIM_FORWARD_EVENT -> XNextEvent() -> XFilterEvent() and the event
-needs to be forwarded to the XIM XKeyEvent press and release filters
-to update the XIM state with Window=0 likes _XimPendingFilter() and
-_XimUnfabricateSerial().
-
-Closes: #205, #206
-Fixes: 024d229f ("ximcp: Unmark to fabricate key events with XKeyEvent serial")
-Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/246>
-(cherry picked from commit 5a1e62d77b65ba148b1c6d1d22a81dc2b07e7d9e)
---
- modules/im/ximcp/imDefFlt.c | 34 ++++++++++++++++++++++++++++++----
- src/FilterEv.c              | 25 +++++++++++++++++++++++++
- 2 files changed, 55 insertions(+), 4 deletions(-)
-
-diff --git a/modules/im/ximcp/imDefFlt.c b/modules/im/ximcp/imDefFlt.c
-index ad8a272b..76d63e88 100644
--- a/modules/im/ximcp/imDefFlt.c
-+++ b/modules/im/ximcp/imDefFlt.c
-@@ -138,7 +138,8 @@ _XimPendingFilter(
- static Bool
- _XimProtoKeypressFilter(
-     Xic		 ic,
-    XKeyEvent	*ev)
-+    XKeyEvent	*ev,
-+    Window	 w)
- {
-     Xim		im = (Xim)ic->core.im;
- 
-@@ -147,6 +148,9 @@ _XimProtoKeypressFilter(
- 	_XimUnfabricateSerial(im, ev);
- 	return NOTFILTERD;
-     }
-+    /* w=0 is used for _XimIsFabricatedSerial() only */
-+    if (!w)
-+	return NOTFILTERD;
- 
-     if (IS_NEGLECT_EVENT(ic, KeyPressMask))
- 	return FILTERD;
-@@ -193,13 +197,14 @@ _XimFilterKeypress(
-     XEvent		*ev,
-     XPointer		 client_data)
- {
-    return _XimProtoKeypressFilter((Xic)client_data, (XKeyEvent *)ev );
-+    return _XimProtoKeypressFilter((Xic)client_data, (XKeyEvent *)ev, w);
- }
- 
- static Bool
- _XimProtoKeyreleaseFilter(
-     Xic		 ic,
-    XKeyEvent	*ev)
-+    XKeyEvent	*ev,
-+    Window	 w)
- {
-     Xim		im = (Xim)ic->core.im;
- 
-@@ -208,6 +213,9 @@ _XimProtoKeyreleaseFilter(
- 	_XimUnfabricateSerial(im, ev);
- 	return NOTFILTERD;
-     }
-+    /* w=0 is used for _XimIsFabricatedSerial() only */
-+    if (!w)
-+	return NOTFILTERD;
- 
-     if (IS_NEGLECT_EVENT(ic, KeyReleaseMask))
- 	return FILTERD;
-@@ -254,7 +262,7 @@ _XimFilterKeyrelease(
-     XEvent		*ev,
-     XPointer		 client_data)
- {
-    return _XimProtoKeyreleaseFilter((Xic)client_data, (XKeyEvent *)ev);
-+    return _XimProtoKeyreleaseFilter((Xic)client_data, (XKeyEvent *)ev, w);
- }
- 
- static void
-@@ -263,6 +271,11 @@ _XimRegisterKeyPressFilter(
- {
-     if (ic->core.focus_window) {
- 	if (!(ic->private.proto.registed_filter_event & KEYPRESS_MASK)) {
-+	    _XRegisterFilterByType (ic->core.im->core.display,
-+				    0,
-+				    KeyPress, KeyPress,
-+				    _XimFilterKeypress,
-+				    (XPointer)ic);
- 	    _XRegisterFilterByType (ic->core.im->core.display,
- 				    ic->core.focus_window,
- 				    KeyPress, KeyPress,
-@@ -280,6 +293,11 @@ _XimRegisterKeyReleaseFilter(
- {
-     if (ic->core.focus_window) {
- 	if (!(ic->private.proto.registed_filter_event & KEYRELEASE_MASK)) {
-+	    _XRegisterFilterByType (ic->core.im->core.display,
-+				    0,
-+				    KeyRelease, KeyRelease,
-+				    _XimFilterKeyrelease,
-+				    (XPointer)ic);
- 	    _XRegisterFilterByType (ic->core.im->core.display,
- 				    ic->core.focus_window,
- 				    KeyRelease, KeyRelease,
-@@ -301,6 +319,10 @@ _XimUnregisterKeyPressFilter(
- 				ic->core.focus_window,
- 				_XimFilterKeypress,
- 				(XPointer)ic);
-+	    _XUnregisterFilter (ic->core.im->core.display,
-+				0,
-+				_XimFilterKeypress,
-+				(XPointer)ic);
- 	    ic->private.proto.registed_filter_event &= ~KEYPRESS_MASK;
- 	}
-     }
-@@ -317,6 +339,10 @@ _XimUnregisterKeyReleaseFilter(
- 				ic->core.focus_window,
- 				_XimFilterKeyrelease,
- 				(XPointer)ic);
-+	    _XUnregisterFilter (ic->core.im->core.display,
-+				0,
-+				_XimFilterKeyrelease,
-+				(XPointer)ic);
- 	    ic->private.proto.registed_filter_event &= ~KEYRELEASE_MASK;
- 	}
-     }
-diff --git a/src/FilterEv.c b/src/FilterEv.c
-index 0a48e548..07845bcc 100644
--- a/src/FilterEv.c
-+++ b/src/FilterEv.c
-@@ -100,6 +100,31 @@ XFilterEvent(
- 	    }
- 	}
-     }
-+    for (p = ev->xany.display->im_filters; p != NULL; p = p->next) {
-+	/* Java sometimes calls XFilterEvent() with window=0 and ev come from
-+	 * XNextEvent() when users type some keys quickly and switch multiple
-+	 * input focuses in a Java window with the keys.
-+	 * But XKeyEvent filters need to receive the event with window=0 for
-+	 * _XimPendingFilter() and _XimUnfabricateSerial() to clear the
-+	 * fowarded XKeyEvent with XIM_FORWARD_EVENT.
-+	 *
-+	 * The case of p->window == 0 is checkekd after all cases of p->window
-+	 * != 0 are checked because all input contexts share
-+	 * Display->im_filters but each input context has
-+	 * Xic->private.proto.registed_filter_event for the filters
-+	 * and same p->filter could be registerd to Display->im_filters twice
-+	 * with different p->window.
-+	 */
-+	if (p->window == 0 && window == 0) {
-+	    if ((mask & p->event_mask) ||
-+		(ev->type >= p->start_type && ev->type <= p->end_type)) {
-+		UnlockDisplay(ev->xany.display);
-+		ret = (*(p->filter))(ev->xany.display, p->window, ev,
-+				      p->client_data);
-+		return(ret);
-+	    }
-+	}
-+    }
-     UnlockDisplay(ev->xany.display);
- #endif
-     return(False);
-- 
-2.47.1
-
--- a/0006-ximcp-Unmark-fabricated-with-serial-0-and-Xic-commit.patch
+++ b/0006-ximcp-Unmark-fabricated-with-serial-0-and-Xic-commit.patch
@ -1,82 +0,0 @@
-From 546a51348322d83a57fd9b8c1e42b44fbe970368 Mon Sep 17 00:00:00 2001
-From: Takao Fujiwara <tfujiwar@redhat.com>
-Date: Fri, 26 Apr 2024 01:29:34 +0900
-Subject: [PATCH libX11 6/7] ximcp: Unmark fabricated with serial 0 and Xic
- commit_info
-
-GTK2 XIM resets the XKeyEvent serial to 0 even if _XimCommitRecv()
-sets the serial so now checks if the events are sent with
-Xic->private.proto.commit_info.
-
-Closes: !246
-Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/246>
-(cherry picked from commit 898746f9b1fb384d6d24ed827c836ec8a0b3da3b)
---
- modules/im/ximcp/imDefFlt.c  |  4 ++--
- modules/im/ximcp/imDefLkup.c | 12 +++++++++++-
- src/xlibi18n/XimintP.h       |  1 +
- 3 files changed, 14 insertions(+), 3 deletions(-)
-
-diff --git a/modules/im/ximcp/imDefFlt.c b/modules/im/ximcp/imDefFlt.c
-index 76d63e88..3dfbf8cd 100644
--- a/modules/im/ximcp/imDefFlt.c
-+++ b/modules/im/ximcp/imDefFlt.c
-@@ -145,7 +145,7 @@ _XimProtoKeypressFilter(
- 
-     if ((ev->keycode == 0) || _XimIsFabricatedSerial(im, ev)) {
- 	_XimPendingFilter(ic);
-	_XimUnfabricateSerial(im, ev);
-+	_XimUnfabricateSerial(im, ic, ev);
- 	return NOTFILTERD;
-     }
-     /* w=0 is used for _XimIsFabricatedSerial() only */
-@@ -210,7 +210,7 @@ _XimProtoKeyreleaseFilter(
- 
-     if (_XimIsFabricatedSerial(im, ev)) {
- 	_XimPendingFilter(ic);
-	_XimUnfabricateSerial(im, ev);
-+	_XimUnfabricateSerial(im, ic, ev);
- 	return NOTFILTERD;
-     }
-     /* w=0 is used for _XimIsFabricatedSerial() only */
-diff --git a/modules/im/ximcp/imDefLkup.c b/modules/im/ximcp/imDefLkup.c
-index 6b2d27dc..326339fe 100644
--- a/modules/im/ximcp/imDefLkup.c
-+++ b/modules/im/ximcp/imDefLkup.c
-@@ -377,10 +377,20 @@ _XimFabricateSerial(
- Bool
- _XimUnfabricateSerial(
-     Xim			 im,
-+    Xic			 ic,
-     XKeyEvent		*event)
- {
-+    if (!im->private.proto.enable_fabricated_order) {
-+	UNMARK_FABRICATED(im);
-+	return True;
-+    }
-     /* GTK2 XIM module sets serial=0. */
-    if (!event->serial || !im->private.proto.enable_fabricated_order) {
-+    if (!event->serial) {
-+	/* _XimCommitRecv() sets event->serial and call _XimFabricateSerial()
-+	 * but GTK2 XIM always reset event->serial=0 with XFilterEvent().
-+	 */
-+	if (ic && ic->private.proto.commit_info)
-+	    im->private.proto.fabricated_serial = 0;
- 	UNMARK_FABRICATED(im);
- 	return True;
-     }
-diff --git a/src/xlibi18n/XimintP.h b/src/xlibi18n/XimintP.h
-index 715800c7..fe52231e 100644
--- a/src/xlibi18n/XimintP.h
-+++ b/src/xlibi18n/XimintP.h
-@@ -319,6 +319,7 @@ _XimFabricateSerial(
- Bool
- _XimUnfabricateSerial(
-     Xim                  im,
-+    Xic                  ic,
-     XKeyEvent           *event);
- 
- Bool
-- 
-2.47.1
-
--- a/0007-imDefIm-Add-LIBX11_ENABLE_FABRICATED_ORDER-env.patch
+++ b/0007-imDefIm-Add-LIBX11_ENABLE_FABRICATED_ORDER-env.patch
@ -1,58 +0,0 @@
-From 9abd669f8826909a715e9b19531fd687800ce44c Mon Sep 17 00:00:00 2001
-From: Takao Fujiwara <tfujiwar@redhat.com>
-Date: Fri, 26 Apr 2024 01:29:39 +0900
-Subject: [PATCH libX11 7/7] imDefIm: Add LIBX11_ENABLE_FABRICATED_ORDER env
-
-If an XIM application does not return the XKeyEvent from XNextEvent()
-to XFilterEvent(), a timeout is reached and the behavior is fallen
-back to the previous one with a warning messsage and we can ask
-the application to send the XKeyEvent to XFilterEvent() but also
-libX11 provides LIBX11_ENABLE_FABRICATED_ORDER environment variable.
-If the application runs with LIBX11_ENABLE_FABRICATED_ORDER=0, the
-previous behavior is available until the application is fixed.
-
-Closes: !246
-Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/246>
-(cherry picked from commit 90b8fc65da1e773b0091a50be46b23609591e8b7)
---
- modules/im/ximcp/imDefIm.c | 10 ++++++++++
- 1 file changed, 10 insertions(+)
-
-diff --git a/modules/im/ximcp/imDefIm.c b/modules/im/ximcp/imDefIm.c
-index 7eba0b34..f42aa92c 100644
--- a/modules/im/ximcp/imDefIm.c
-+++ b/modules/im/ximcp/imDefIm.c
-@@ -63,6 +63,8 @@ PERFORMANCE OF THIS SOFTWARE.
- #include "Ximint.h"
- 
- #include <limits.h>
-+#include <stdlib.h>
-+#include <strings.h>
- 
- int
- _XimCheckDataSize(
-@@ -400,6 +402,7 @@ _XimPreConnect(
-     Atom	   *atoms;
-     Window	    im_window = 0;
-     register int    i;
-+    const char	   *env_enable_fabricated_order;
- 
-     if((imserver = XInternAtom(display, XIM_SERVERS, True)) == (Atom)None)
- 	return False;
-@@ -433,6 +436,13 @@ _XimPreConnect(
-     im->private.proto.fabricated_serial = 0;
-     im->private.proto.fabricated_time = 0;
-     im->private.proto.enable_fabricated_order = True;
-+    env_enable_fabricated_order = getenv("LIBX11_ENABLE_FABRICATED_ORDER");
-+    if (env_enable_fabricated_order && *env_enable_fabricated_order) {
-+	if (!strncasecmp(env_enable_fabricated_order, "0", 2) ||
-+	    !strncasecmp(env_enable_fabricated_order, "false", 6)) {
-+	    im->private.proto.enable_fabricated_order = False;
-+	}
-+    }
-     return True;
- }
- 
-- 
-2.47.1
-
--- a/SOURCES/0001-Avoid-recursing-through-_XError-due-to-sequence-adju.patch
+++ b/SOURCES/0001-Avoid-recursing-through-_XError-due-to-sequence-adju.patch
@ -0,0 +1,166 @@
+From 8c92ef59890c6d6e2be456658d3b9c145eda8629 Mon Sep 17 00:00:00 2001
+From: Keith Packard <keithp@keithp.com>
+Date: Sat, 7 Nov 2020 22:22:47 -0800
+Subject: [PATCH libX11] Avoid recursing through _XError due to sequence
+ adjustment
+
+This patch is based on research done by Dmitry Osipenko to uncover the
+cause of a large class of Xlib lockups.
+
+_XError must unlock and re-lock the display around the call to the
+user error handler function. When re-locking the display, two
+functions are called to ensure that the display is ready to generate a request:
+
+    _XIDHandler(dpy);
+    _XSeqSyncFunction(dpy);
+
+The first ensures that there is at least one XID available to use
+(possibly calling _xcb_generate_id to do so). The second makes sure a
+reply is received at least every 65535 requests to keep sequence
+numbers in sync (possibly generating a GetInputFocus request and
+synchronously awaiting the reply).
+
+If the second of these does generate a GetInputFocus request and wait
+for the reply, then a pending error will cause recursion into _XError,
+which deadlocks the display.
+
+One seemingly easy fix is to have _XError avoid those calls by
+invoking InternalLockDisplay instead of LockDisplay. That function
+does everything that LockDisplay does *except* call those final two
+functions which may end up receiving an error.
+
+However, that doesn't protect the system from applications which call
+some legal Xlib function from within their error handler. Any Xlib
+function which cannot generate protocol or wait for events is valid,
+including many which invoke LockDisplay.
+
+What we need to do is make LockDisplay skip these two function calls
+precisely when it is called from within the _XError context for the
+same display.
+
+This patch accomplishes this by creating a list of threads in the
+display which are in _XError, and then having LockDisplay check the
+current thread against those list elements.
+
+Inspired-by: Dmitry Osipenko <digetx@gmail.com>
+Signed-off-by: Keith Packard <keithp@keithp.com>
+Tested-by: Dmitry Osipenko <digetx@gmail.com>
+Reviewed-by: Dmitry Osipenko <digetx@gmail.com>
+(cherry picked from commit 30ccef3a48029bf4fc31d4abda2d2778d0ad6277)
+---
+ include/X11/Xlibint.h |  2 ++
+ src/OpenDis.c         |  1 +
+ src/XlibInt.c         | 10 ++++++++++
+ src/locking.c         | 12 ++++++++++++
+ src/locking.h         | 12 ++++++++++++
+ 5 files changed, 37 insertions(+)
+
+diff --git a/include/X11/Xlibint.h b/include/X11/Xlibint.h
+index 6b95bcf7..09078e3f 100644
+--- a/include/X11/Xlibint.h
+++ b/include/X11/Xlibint.h
+@@ -202,6 +202,8 @@ struct _XDisplay
+ 	unsigned long last_request_read_upper32bit;
+ 	unsigned long request_upper32bit;
+ #endif
+
+	struct _XErrorThreadInfo *error_threads;
+ };
+ 
+ #define XAllocIDs(dpy,ids,n) (*(dpy)->idlist_alloc)(dpy,ids,n)
+diff --git a/src/OpenDis.c b/src/OpenDis.c
+index 82723578..85901168 100644
+--- a/src/OpenDis.c
+++ b/src/OpenDis.c
+@@ -201,6 +201,7 @@ XOpenDisplay (
+ 	X_DPY_SET_LAST_REQUEST_READ(dpy, 0);
+ 	dpy->default_screen = iscreen;  /* Value returned by ConnectDisplay */
+ 	dpy->last_req = (char *)&_dummy_request;
+	dpy->error_threads = NULL;
+ 
+ 	/* Initialize the display lock */
+ 	if (InitDisplayLock(dpy) != 0) {
+diff --git a/src/XlibInt.c b/src/XlibInt.c
+index 4e45e62b..8771b791 100644
+--- a/src/XlibInt.c
+++ b/src/XlibInt.c
+@@ -1482,6 +1482,11 @@ int _XError (
+     if (_XErrorFunction != NULL) {
+ 	int rtn_val;
+ #ifdef XTHREADS
+	struct _XErrorThreadInfo thread_info = {
+		.error_thread = xthread_self(),
+		.next = dpy->error_threads
+	}, **prev;
+	dpy->error_threads = &thread_info;
+ 	if (dpy->lock)
+ 	    (*dpy->lock->user_lock_display)(dpy);
+ 	UnlockDisplay(dpy);
+@@ -1491,6 +1496,11 @@ int _XError (
+ 	LockDisplay(dpy);
+ 	if (dpy->lock)
+ 	    (*dpy->lock->user_unlock_display)(dpy);
+
+	/* unlink thread_info from the list */
+	for (prev = &dpy->error_threads; *prev != &thread_info; prev = &(*prev)->next)
+		;
+	*prev = thread_info.next;
+ #endif
+ 	return rtn_val;
+     } else {
+diff --git a/src/locking.c b/src/locking.c
+index 9f4fe067..bcadc857 100644
+--- a/src/locking.c
+++ b/src/locking.c
+@@ -453,6 +453,9 @@ static void _XLockDisplay(
+     XTHREADS_FILE_LINE_ARGS
+     )
+ {
+#ifdef XTHREADS
+    struct _XErrorThreadInfo *ti;
+#endif
+ #ifdef XTHREADS_WARN
+     _XLockDisplayWarn(dpy, file, line);
+ #else
+@@ -460,6 +463,15 @@ static void _XLockDisplay(
+ #endif
+     if (dpy->lock->locking_level > 0)
+ 	_XDisplayLockWait(dpy);
+#ifdef XTHREADS
+    /*
+     * Skip the two function calls below which may generate requests
+     * when LockDisplay is called from within _XError.
+     */
+    for (ti = dpy->error_threads; ti; ti = ti->next)
+	    if (ti->error_thread == xthread_self())
+		    return;
+#endif
+     _XIDHandler(dpy);
+     _XSeqSyncFunction(dpy);
+ }
+diff --git a/src/locking.h b/src/locking.h
+index 5251a60c..59fc866e 100644
+--- a/src/locking.h
+++ b/src/locking.h
+@@ -149,6 +149,18 @@ typedef struct _LockInfoRec {
+ 	xmutex_t	lock;
+ } LockInfoRec;
+ 
+/* A list of threads currently invoking error handlers on this display
+ * LockDisplay operates differently for these threads, avoiding
+ * generating any requests or reading any events as that can cause
+ * recursion into the error handling code, which will deadlock the
+ * thread.
+ */
+struct _XErrorThreadInfo
+{
+    struct _XErrorThreadInfo *next;
+    xthread_t error_thread;
+};
+
+ /* XOpenDis.c */
+ extern int (*_XInitDisplayLock_fn)(Display *dpy);
+ extern void (*_XFreeDisplayLock_fn)(Display *dpy);
+-- 
+2.43.0
+
--- a/SOURCES/0001-CVE-2023-43785-out-of-bounds-memory-access-in-_XkbRe.patch
+++ b/SOURCES/0001-CVE-2023-43785-out-of-bounds-memory-access-in-_XkbRe.patch
--- a/SOURCES/0001-CVE-2023-43786-stack-exhaustion-from-infinite-recurs.patch
+++ b/SOURCES/0001-CVE-2023-43786-stack-exhaustion-from-infinite-recurs.patch
--- a/SOURCES/0001-CVE-2023-43787-Integer-overflow-in-XCreateImage-lead.patch
+++ b/SOURCES/0001-CVE-2023-43787-Integer-overflow-in-XCreateImage-lead.patch
--- a/SOURCES/0001-Fix-XTS-regression-in-XCopyColormapAndFree.patch
+++ b/SOURCES/0001-Fix-XTS-regression-in-XCopyColormapAndFree.patch
@ -0,0 +1,64 @@
+From a515545065ce6e1924de4bc50aaae7ec9b48cfad Mon Sep 17 00:00:00 2001
+From: Adam Jackson <ajax@redhat.com>
+Date: Wed, 11 Dec 2019 11:53:11 -0500
+Subject: [PATCH libX11] Fix XTS regression in XCopyColormapAndFree
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+XCopyColormapAndFree/5 threw an assertion:
+
+    520|4 5 00014017 1 2|Assertion XCopyColormapAndFree-5.(A)
+    520|4 5 00014017 1 3|When a colourmap argument does not name a valid colourmap,
+    520|4 5 00014017 1 4|then a BadColor error occurs.
+    520|4 5 00014017 1 5|METH: Create a bad colourmap by creating and freeing a colourmap.
+    520|4 5 00014017 1 6|METH: Call test function using bad colourmap as the colourmap argument.
+    520|4 5 00014017 1 7|METH: Verify that a BadColor error occurs.
+    520|4 5 00014017 1 8|unexpected signal 6 (SIGABRT) received
+    220|4 5 2 15:05:53|UNRESOLVED
+    410|4 5 1 15:05:53|IC End
+    510|4|system 0: Abandoning testset: caught unexpected signal 11 (SIGSEGV)
+
+More specifically:
+
+    lt-XCopyColormapAndFree: xcb_io.c:533: _XAllocID: Assertion `ret != inval_id' failed.
+
+This bug was introduced (by following my advice, d'oh) in:
+
+    commit 99a2cf1aa0b58391078d5d3edf0a7dab18c7745d
+    Author: Tapani Pälli <tapani.palli@intel.com>
+    Date:   Mon May 13 08:29:49 2019 +0300
+
+        Protect colormap add/removal with display lock
+
+In that patch we moved the call to _XcmsCopyCmapRecAndFree inside the
+display lock. The problem is said routine has side effects, including
+trying to implicitly create a colormap in some cases. Since we don't run
+the XID handler until SyncHandle() we would see inconsistent internal
+xlib state, triggering the above assert.
+
+Fix this by dropping and re-taking the display lock before calling into
+XCMS.
+---
+ src/CopyCmap.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/src/CopyCmap.c b/src/CopyCmap.c
+index b4954b01..b37aba73 100644
+--- a/src/CopyCmap.c
+++ b/src/CopyCmap.c
+@@ -53,6 +53,11 @@ Colormap XCopyColormapAndFree(
+     mid = req->mid = XAllocID(dpy);
+     req->srcCmap = src_cmap;
+ 
+    /* re-lock the display to keep XID handling in sync */
+    UnlockDisplay(dpy);
+    SyncHandle();
+    LockDisplay(dpy);
+
+ #if XCMS
+     _XcmsCopyCmapRecAndFree(dpy, src_cmap, mid);
+ #endif
+-- 
+2.23.0
+
--- a/SOURCES/0001-Fix-an-integer-overflow-in-init_om.patch
+++ b/SOURCES/0001-Fix-an-integer-overflow-in-init_om.patch
@ -0,0 +1,37 @@
+From 2c67fab8415a1d32395de87f056bc5f3b37fedb0 Mon Sep 17 00:00:00 2001
+From: Matthieu Herrb <matthieu@herrb.eu>
+Date: Thu, 13 Aug 2020 18:02:58 +0200
+Subject: [PATCH] Fix an integer overflow in init_om()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+CVE-2020-14363
+
+This can lead to a double free later, as reported by Jayden Rivers.
+
+Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
+
+(cherry picked from commit acdaaadcb3d85c61fd43669fc5dddf0f8c3f911d)
+Signed-off-by: Michel Dänzer <mdaenzer@redhat.com>
+---
+ modules/om/generic/omGeneric.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/modules/om/generic/omGeneric.c b/modules/om/generic/omGeneric.c
+index 22f826ec..bcfb9ab8 100644
+--- a/modules/om/generic/omGeneric.c
+++ b/modules/om/generic/omGeneric.c
+@@ -1908,7 +1908,8 @@ init_om(
+     char **required_list;
+     XOrientation *orientation;
+     char **value, buf[BUFSIZ], *bufptr;
+-    int count = 0, num = 0, length = 0;
+    int count = 0, num = 0;
+    unsigned int length = 0;
+ 
+     _XlcGetResource(lcd, "XLC_FONTSET", "on_demand_loading", &value, &count);
+     if (count > 0 && _XlcCompareISOLatin1(*value, "True") == 0)
+-- 
+2.28.0
+
--- a/SOURCES/0001-Fix-poll_for_response-race-condition.patch
+++ b/SOURCES/0001-Fix-poll_for_response-race-condition.patch
@ -0,0 +1,63 @@
+From 77f8517710a724fa1f29de8ad806692782f962bd Mon Sep 17 00:00:00 2001
+From: Frediano Ziglio <fziglio@redhat.com>
+Date: Wed, 29 Jan 2020 09:06:54 +0000
+Subject: [PATCH libX11] Fix poll_for_response race condition
+
+In poll_for_response is it possible that event replies are skipped
+and a more up to date message reply is returned.
+This will cause next poll_for_event call to fail aborting the program.
+
+This was proved using some slow ssh tunnel or using some program
+to slow down server replies (I used a combination of xtrace and strace).
+
+How the race happens:
+- program enters into poll_for_response;
+- poll_for_event is called but the server didn't still send the reply;
+- pending_requests is not NULL because we send a request (see call
+  to  append_pending_request in _XSend);
+- xcb_poll_for_reply64 is called from poll_for_response;
+- xcb_poll_for_reply64 will read from server, at this point
+  server reply with an event (say sequence N) and the reply to our
+  last request (say sequence N+1);
+- xcb_poll_for_reply64 returns the reply for the request we asked;
+- last_request_read is set to N+1 sequence in poll_for_response;
+- poll_for_response returns the response to the request;
+- poll_for_event is called (for instance from another poll_for_response);
+- event with sequence N is retrieved;
+- the N sequence is widen, however, as the "new" number computed from
+  last_request_read is less than N the number is widened to N + 2^32
+  (assuming last_request_read is still contained in 32 bit);
+- poll_for_event enters the nested if statement as req is NULL;
+- we compare the widen N (which now does not fit into 32 bit) with
+  request (which fits into 32 bit) hitting the throw_thread_fail_assert.
+
+I propose to change the widen to not go too far from the wide number
+instead of supposing the result is always bigger than the wide number
+passed.
+
+Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
+---
+ src/xcb_io.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/src/xcb_io.c b/src/xcb_io.c
+index 6a12d150..2aacbda3 100644
+--- a/src/xcb_io.c
+++ b/src/xcb_io.c
+@@ -201,12 +201,10 @@ static int handle_error(Display *dpy, xError *err, Bool in_XReply)
+ }
+ 
+ /* Widen a 32-bit sequence number into a 64bit (uint64_t) sequence number.
+- * Treating the comparison as a 1 and shifting it avoids a conditional branch.
+  */
+ static void widen(uint64_t *wide, unsigned int narrow)
+ {
+-	uint64_t new = (*wide & ~((uint64_t)0xFFFFFFFFUL)) | narrow;
+-	*wide = new + (((uint64_t)(new < *wide)) << 32);
+	*wide += (int32_t) (narrow - *wide);
+ }
+ 
+ /* Thread-safety rules:
+-- 
+2.23.0
+
--- a/SOURCES/0001-InitExt.c-Add-bounds-checks-for-extension-request-ev.patch
+++ b/SOURCES/0001-InitExt.c-Add-bounds-checks-for-extension-request-ev.patch
--- a/SOURCES/0001-imDefLkup-verify-that-a-pointer-isn-t-NULL-before-us.patch
+++ b/SOURCES/0001-imDefLkup-verify-that-a-pointer-isn-t-NULL-before-us.patch
--- a/SOURCES/0002-XPutImage-clip-images-to-maximum-height-width-allowe.patch
+++ b/SOURCES/0002-XPutImage-clip-images-to-maximum-height-width-allowe.patch
--- a/SOURCES/0003-XCreatePixmap-trigger-BadValue-error-for-out-of-rang.patch
+++ b/SOURCES/0003-XCreatePixmap-trigger-BadValue-error-for-out-of-rang.patch
--- a/SOURCES/CVE-2021-31535.patch
+++ b/SOURCES/CVE-2021-31535.patch
@ -0,0 +1,411 @@
+From 2714e4478c1262c94de6295cce605c14572968d3 Mon Sep 17 00:00:00 2001
+From: Matthieu Herrb <matthieu@herrb.eu>
+Date: Fri, 19 Feb 2021 15:30:39 +0100
+Subject: [PATCH libX11] Reject string longer than USHRT_MAX before sending
+ them on the wire
+
+The X protocol uses CARD16 values to represent the length so
+this would overflow.
+
+CVE-2021-31535
+
+Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
+
+[mustard: backported 10 1.6.8 by merging the warning fixes from
+upstream commimt 84427130 first - ajax]
+---
+ src/Font.c      | 10 ++++++----
+ src/FontInfo.c  |  5 ++++-
+ src/FontNames.c |  5 ++++-
+ src/GetColor.c  |  6 +++++-
+ src/LoadFont.c  |  6 +++++-
+ src/LookupCol.c |  6 ++++--
+ src/ParseCol.c  |  7 +++++--
+ src/QuExt.c     |  7 ++++++-
+ src/SetFPath.c  | 12 +++++++++---
+ src/SetHints.c  |  9 ++++++++-
+ src/StNColor.c  |  5 ++++-
+ src/StName.c    | 11 ++++++++---
+ 12 files changed, 68 insertions(+), 21 deletions(-)
+
+diff --git a/src/Font.c b/src/Font.c
+index 09d2ae91..1cd89cca 100644
+--- a/src/Font.c
+++ b/src/Font.c
+@@ -102,12 +102,14 @@ XFontStruct *XLoadQueryFont(
+     XF86BigfontCodes *extcodes = _XF86BigfontCodes(dpy);
+ #endif
+ 
+    if (strlen(name) >= USHRT_MAX)
+        return NULL;
+     if (_XF86LoadQueryLocaleFont(dpy, name, &font_result, (Font *)0))
+       return font_result;
+     LockDisplay(dpy);
+     GetReq(OpenFont, req);
+     seq = dpy->request; /* Can't use extended sequence number here */
+-    nbytes = req->nbytes  = name ? strlen(name) : 0;
+    nbytes = req->nbytes = (CARD16) (name ? strlen(name) : 0);
+     req->fid = fid = XAllocID(dpy);
+     req->length += (nbytes+3)>>2;
+     Data (dpy, name, nbytes);
+@@ -662,8 +664,8 @@ int _XF86LoadQueryLocaleFont(
+ 
+     if (!name)
+ 	return 0;
+-    l = strlen(name);
+-    if (l < 2 || name[l - 1] != '*' || name[l - 2] != '-')
+    l = (int) strlen(name);
+    if (l < 2 || name[l - 1] != '*' || name[l - 2] != '-' || l >= USHRT_MAX)
+ 	return 0;
+     charset = NULL;
+     /* next three lines stolen from _XkbGetCharset() */
+@@ -679,7 +681,7 @@ int _XF86LoadQueryLocaleFont(
+ 	return 0;
+     if (_XlcNCompareISOLatin1(name + l - 2 - (p - charset), charset, p - charset))
+ 	return 0;
+-    if (strlen(p + 1) + l - 1 >= sizeof(buf) - 1)
+    if (strlen(p + 1) + (size_t) l - 1 >= sizeof(buf) - 1)
+ 	return 0;
+     strcpy(buf, name);
+     strcpy(buf + l - 1, p + 1);
+diff --git a/src/FontInfo.c b/src/FontInfo.c
+index f870e431..6644b3fa 100644
+--- a/src/FontInfo.c
+++ b/src/FontInfo.c
+@@ -58,10 +58,13 @@ XFontStruct **info)	/* RETURN */
+     register xListFontsReq *req;
+     int j;
+ 
+    if (strlen(pattern) >= USHRT_MAX)
+        return NULL;
+
+     LockDisplay(dpy);
+     GetReq(ListFontsWithInfo, req);
+     req->maxNames = maxNames;
+-    nbytes = req->nbytes = pattern ? strlen (pattern) : 0;
+    nbytes = req->nbytes = pattern ? (CARD16) strlen (pattern) : 0;
+     req->length += (nbytes + 3) >> 2;
+     _XSend (dpy, pattern, nbytes);
+     /* use _XSend instead of Data, since subsequent _XReply will flush buffer */
+diff --git a/src/FontNames.c b/src/FontNames.c
+index b78792d6..458d80c9 100644
+--- a/src/FontNames.c
+++ b/src/FontNames.c
+@@ -51,10 +51,13 @@ int *actualCount)	/* RETURN */
+     register xListFontsReq *req;
+     unsigned long rlen = 0;
+ 
+    if (strlen(pattern) >= USHRT_MAX)
+        return NULL;
+
+     LockDisplay(dpy);
+     GetReq(ListFonts, req);
+     req->maxNames = maxNames;
+-    nbytes = req->nbytes = pattern ? strlen (pattern) : 0;
+    nbytes = req->nbytes = pattern ? (CARD16) strlen (pattern) : 0;
+     req->length += (nbytes + 3) >> 2;
+     _XSend (dpy, pattern, nbytes);
+     /* use _XSend instead of Data, since following _XReply will flush buffer */
+diff --git a/src/GetColor.c b/src/GetColor.c
+index cd0eb9f6..c8178067 100644
+--- a/src/GetColor.c
+++ b/src/GetColor.c
+@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
+ #ifdef HAVE_CONFIG_H
+ #include <config.h>
+ #endif
+#include <limits.h>
+ #include <stdio.h>
+ #include "Xlibint.h"
+ #include "Xcmsint.h"
+@@ -48,6 +49,9 @@ XColor *exact_def) /* RETURN */
+     XcmsColor cmsColor_exact;
+     Status ret;
+ 
+    if (strlen(colorname) >= USHRT_MAX)
+        return (0);
+
+ #ifdef XCMS
+     /*
+      * Let's Attempt to use Xcms and i18n approach to Parse Color
+@@ -83,7 +87,7 @@ XColor *exact_def) /* RETURN */
+     GetReq(AllocNamedColor, req);
+ 
+     req->cmap = cmap;
+-    nbytes = req->nbytes = strlen(colorname);
+    nbytes = req->nbytes = (CARD16) strlen(colorname);
+     req->length += (nbytes + 3) >> 2; /* round up to mult of 4 */
+ 
+     _XSend(dpy, colorname, nbytes);
+diff --git a/src/LoadFont.c b/src/LoadFont.c
+index f547976b..3996436f 100644
+--- a/src/LoadFont.c
+++ b/src/LoadFont.c
+@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
+ #ifdef HAVE_CONFIG_H
+ #include <config.h>
+ #endif
+#include <limits.h>
+ #include "Xlibint.h"
+ 
+ Font
+@@ -38,12 +39,15 @@ XLoadFont (
+     Font fid;
+     register xOpenFontReq *req;
+ 
+    if (strlen(name) >= USHRT_MAX)
+        return (0);
+
+     if (_XF86LoadQueryLocaleFont(dpy, name, (XFontStruct **)0, &fid))
+       return fid;
+ 
+     LockDisplay(dpy);
+     GetReq(OpenFont, req);
+-    nbytes = req->nbytes = name ? strlen(name) : 0;
+    nbytes = req->nbytes = name ? (CARD16) strlen(name) : 0;
+     req->fid = fid = XAllocID(dpy);
+     req->length += (nbytes+3)>>2;
+     Data (dpy, name, nbytes);
+diff --git a/src/LookupCol.c b/src/LookupCol.c
+index f7f969f5..cd9b1368 100644
+--- a/src/LookupCol.c
+++ b/src/LookupCol.c
+@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
+ #ifdef HAVE_CONFIG_H
+ #include <config.h>
+ #endif
+#include <limits.h>
+ #include <stdio.h>
+ #include "Xlibint.h"
+ #include "Xcmsint.h"
+@@ -46,6 +47,9 @@ XLookupColor (
+ 	XcmsCCC ccc;
+ 	XcmsColor cmsColor_exact;
+ 
+	n = (int) strlen (spec);
+	if (n >= USHRT_MAX)
+            return 0;
+ #ifdef XCMS
+ 	/*
+ 	 * Let's Attempt to use Xcms and i18n approach to Parse Color
+@@ -77,8 +81,6 @@ XLookupColor (
+ 	 * Xcms and i18n methods failed, so lets pass it to the server
+ 	 * for parsing.
+ 	 */
+-
+-	n = strlen (spec);
+ 	LockDisplay(dpy);
+ 	GetReq (LookupColor, req);
+ 	req->cmap = cmap;
+diff --git a/src/ParseCol.c b/src/ParseCol.c
+index e997b1b8..7a84a17b 100644
+--- a/src/ParseCol.c
+++ b/src/ParseCol.c
+@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
+ #ifdef HAVE_CONFIG_H
+ #include <config.h>
+ #endif
+#include <limits.h>
+ #include <stdio.h>
+ #include "Xlibint.h"
+ #include "Xcmsint.h"
+@@ -46,7 +47,9 @@ XParseColor (
+ 	XcmsColor cmsColor;
+ 
+         if (!spec) return(0);
+-	n = strlen (spec);
+	n = (int) strlen (spec);
+	if (n >= USHRT_MAX)
+            return(0);
+ 	if (*spec == '#') {
+ 	    /*
+ 	     * RGB
+@@ -119,7 +122,7 @@ XParseColor (
+ 	    LockDisplay(dpy);
+ 	    GetReq (LookupColor, req);
+ 	    req->cmap = cmap;
+-	    req->nbytes = n = strlen(spec);
+	    req->nbytes = (CARD16) (n = (int) strlen(spec));
+ 	    req->length += (n + 3) >> 2;
+ 	    Data (dpy, spec, (long)n);
+ 	    if (!_XReply (dpy, (xReply *) &reply, 0, xTrue)) {
+diff --git a/src/QuExt.c b/src/QuExt.c
+index 4e230e77..4cb99fcf 100644
+--- a/src/QuExt.c
+++ b/src/QuExt.c
+@@ -27,6 +27,8 @@ in this Software without prior written authorization from The Open Group.
+ #ifdef HAVE_CONFIG_H
+ #include <config.h>
+ #endif
+#include <limits.h>
+#include <stdbool.h>
+ #include "Xlibint.h"
+ 
+ Bool
+@@ -40,9 +42,12 @@ XQueryExtension(
+     xQueryExtensionReply rep;
+     register xQueryExtensionReq *req;
+ 
+    if (strlen(name) >= USHRT_MAX)
+        return false;
+
+     LockDisplay(dpy);
+     GetReq(QueryExtension, req);
+-    req->nbytes = name ? strlen(name) : 0;
+    req->nbytes = name ? (CARD16) strlen(name) : 0;
+     req->length += (req->nbytes+(unsigned)3)>>2;
+     _XSend(dpy, name, (long)req->nbytes);
+     (void) _XReply (dpy, (xReply *)&rep, 0, xTrue);
+diff --git a/src/SetFPath.c b/src/SetFPath.c
+index 60aaef01..13fce49e 100644
+--- a/src/SetFPath.c
+++ b/src/SetFPath.c
+@@ -26,6 +26,7 @@ in this Software without prior written authorization from The Open Group.
+ 
+ #ifdef HAVE_CONFIG_H
+ #include <config.h>
+#include <limits.h>
+ #endif
+ #include "Xlibint.h"
+ 
+@@ -48,7 +49,12 @@ XSetFontPath (
+ 	GetReq (SetFontPath, req);
+ 	req->nFonts = ndirs;
+ 	for (i = 0; i < ndirs; i++) {
+-		n += safestrlen (directories[i]) + 1;
+		n = (int) ((size_t) n + (safestrlen (directories[i]) + 1));
+		if (n >= USHRT_MAX) {
+			UnlockDisplay(dpy);
+			SyncHandle();
+			return 0;
+		}
+ 	}
+ 	nbytes = (n + 3) & ~3;
+ 	req->length += nbytes >> 2;
+@@ -59,9 +65,9 @@ XSetFontPath (
+ 		char	*tmp = p;
+ 
+ 		for (i = 0; i < ndirs; i++) {
+-			register int length = safestrlen (directories[i]);
+			register int length = (int) safestrlen (directories[i]);
+ 			*p = length;
+-			memcpy (p + 1, directories[i], length);
+			memcpy (p + 1, directories[i], (size_t)length);
+ 			p += length + 1;
+ 		}
+ 		Data (dpy, tmp, nbytes);
+diff --git a/src/SetHints.c b/src/SetHints.c
+index bc46498a..61cb0684 100644
+--- a/src/SetHints.c
+++ b/src/SetHints.c
+@@ -49,6 +49,7 @@ SOFTWARE.
+ #ifdef HAVE_CONFIG_H
+ #include <config.h>
+ #endif
+#include <limits.h>
+ #include <X11/Xlibint.h>
+ #include <X11/Xutil.h>
+ #include "Xatomtype.h"
+@@ -214,6 +215,8 @@ XSetCommand (
+ 	register char *buf, *bp;
+ 	for (i = 0, nbytes = 0; i < argc; i++) {
+ 		nbytes += safestrlen(argv[i]) + 1;
+		if (nbytes >= USHRT_MAX)
+                    return 1;
+ 	}
+ 	if ((bp = buf = Xmalloc(nbytes))) {
+ 	    /* copy arguments into single buffer */
+@@ -256,11 +259,13 @@ XSetStandardProperties (
+ 
+ 	if (name != NULL) XStoreName (dpy, w, name);
+ 
+        if (safestrlen(icon_string) >= USHRT_MAX)
+            return 1;
+ 	if (icon_string != NULL) {
+ 	    XChangeProperty (dpy, w, XA_WM_ICON_NAME, XA_STRING, 8,
+                              PropModeReplace,
+                              (_Xconst unsigned char *)icon_string,
+-                             safestrlen(icon_string));
+                             (int)safestrlen(icon_string));
+ 		}
+ 
+ 	if (icon_pixmap != None) {
+@@ -298,6 +303,8 @@ XSetClassHint(
+ 
+ 	len_nm = safestrlen(classhint->res_name);
+ 	len_cl = safestrlen(classhint->res_class);
+        if (len_nm + len_cl >= USHRT_MAX)
+            return 1;
+ 	if ((class_string = s = Xmalloc(len_nm + len_cl + 2))) {
+ 	    if (len_nm) {
+ 		strcpy(s, classhint->res_name);
+diff --git a/src/StNColor.c b/src/StNColor.c
+index 8b821c3e..16dc9cbc 100644
+--- a/src/StNColor.c
+++ b/src/StNColor.c
+@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
+ #ifdef HAVE_CONFIG_H
+ #include <config.h>
+ #endif
+#include <limits.h>
+ #include <stdio.h>
+ #include "Xlibint.h"
+ #include "Xcmsint.h"
+@@ -46,6 +47,8 @@ int flags)  /* DoRed, DoGreen, DoBlue */
+     XcmsColor cmsColor_exact;
+     XColor scr_def;
+ 
+    if (strlen(name) >= USHRT_MAX)
+        return 0;
+ #ifdef XCMS
+     /*
+      * Let's Attempt to use Xcms approach to Parse Color
+@@ -76,7 +79,7 @@ int flags)  /* DoRed, DoGreen, DoBlue */
+     req->cmap = cmap;
+     req->flags = flags;
+     req->pixel = pixel;
+-    req->nbytes = nbytes = strlen(name);
+    req->nbytes = (CARD16) (nbytes = (unsigned) strlen(name));
+     req->length += (nbytes + 3) >> 2; /* round up to multiple of 4 */
+     Data(dpy, name, (long)nbytes);
+     UnlockDisplay(dpy);
+diff --git a/src/StName.c b/src/StName.c
+index b4048bff..04bb3aa6 100644
+--- a/src/StName.c
+++ b/src/StName.c
+@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
+ #ifdef HAVE_CONFIG_H
+ #include <config.h>
+ #endif
+#include <limits.h>
+ #include <X11/Xlibint.h>
+ #include <X11/Xatom.h>
+ 
+@@ -36,9 +37,11 @@ XStoreName (
+     Window w,
+     _Xconst char *name)
+ {
+-    return XChangeProperty(dpy, w, XA_WM_NAME, XA_STRING,
+    if (strlen(name) >= USHRT_MAX)
+        return 0;
+    return XChangeProperty(dpy, w, XA_WM_NAME, XA_STRING, /*  */
+ 			   8, PropModeReplace, (_Xconst unsigned char *)name,
+-			   name ? strlen(name) : 0);
+			   name ? (int) strlen(name) : 0);
+ }
+ 
+ int
+@@ -47,7 +50,9 @@ XSetIconName (
+     Window w,
+     _Xconst char *icon_name)
+ {
+    if (strlen(icon_name) >= USHRT_MAX)
+        return 0;
+     return XChangeProperty(dpy, w, XA_WM_ICON_NAME, XA_STRING, 8,
+                            PropModeReplace, (_Xconst unsigned char *)icon_name,
+-			   icon_name ? strlen(icon_name) : 0);
+			   icon_name ? (int) strlen(icon_name) : 0);
+ }
+-- 
+2.30.1
+
--- a/SOURCES/dont-forward-keycode-0.patch
+++ b/SOURCES/dont-forward-keycode-0.patch
--- a/SPECS/libX11.spec
+++ b/SPECS/libX11.spec
@ -4,9 +4,10 @@

 Summary: Core X11 protocol client library
 Name: libX11
-Version: 1.7.0
-Release: 11%{?gitdate:.%{gitdate}git%{gitversion}}%{?dist}
+Version: 1.6.8
+Release: 9%{?gitdate:.%{gitdate}git%{gitversion}}%{?dist}
 License: MIT
+Group: System Environment/Libraries
 URL: http://www.x.org

 %if 0%{?gitdate}
@ -18,34 +19,32 @@ Source0: https://xorg.freedesktop.org/archive/individual/lib/%{name}-%{version}.
 %endif

 Patch2: dont-forward-keycode-0.patch
-Patch3: 0001-makekeys-handle-the-new-_EVDEVK-xorgproto-symbols.patch
+Patch3: 0001-Fix-XTS-regression-in-XCopyColormapAndFree.patch
+Patch4: 0001-Fix-poll_for_response-race-condition.patch
+
+# CVE-2020-14363
+Patch5: 0001-Fix-an-integer-overflow-in-init_om.patch
+Patch6: CVE-2021-31535.patch
 # CVE-2023-3138
-Patch4: 0001-InitExt.c-Add-bounds-checks-for-extension-request-ev.patch
+Patch7: 0001-InitExt.c-Add-bounds-checks-for-extension-request-ev.patch

 # CVE-2023-43785
-Patch5: 0001-CVE-2023-43785-out-of-bounds-memory-access-in-_XkbRe.patch
+Patch8: 0001-CVE-2023-43785-out-of-bounds-memory-access-in-_XkbRe.patch

 # CVE-2023-43786
-Patch6: 0001-CVE-2023-43786-stack-exhaustion-from-infinite-recurs.patch
-Patch7: 0002-XPutImage-clip-images-to-maximum-height-width-allowe.patch
-Patch8: 0003-XCreatePixmap-trigger-BadValue-error-for-out-of-rang.patch
+Patch9: 0001-CVE-2023-43786-stack-exhaustion-from-infinite-recurs.patch
+Patch10: 0002-XPutImage-clip-images-to-maximum-height-width-allowe.patch
+Patch11: 0003-XCreatePixmap-trigger-BadValue-error-for-out-of-rang.patch

 # CVE-2023-43787
-Patch9: 0001-CVE-2023-43787-Integer-overflow-in-XCreateImage-lead.patch
+Patch12: 0001-CVE-2023-43787-Integer-overflow-in-XCreateImage-lead.patch

-# https://issues.redhat.com/browse/RHEL-58298
-Patch10: 0001-imDefLkup-verify-that-a-pointer-isn-t-NULL-before-us.patch
+# RHEL-23452
+Patch13: 0001-Avoid-recursing-through-_XError-due-to-sequence-adju.patch

-# https://issues.redhat.com/browse/RHEL-69791
-Patch11: 0001-ximcp-Unmark-to-fabricate-key-events-with-XKeyEvent-.patch
-Patch12: 0002-imDefLkup-Commit-first-info-in-XimCommitInfo.patch
-Patch13: 0003-imDefLkup-Mark-and-unmark-fabricated-with-serial-0.patch
-Patch14: 0004-ximcp-Add-fabricated_time-in-XimProtoPrivate-for-tim.patch
-Patch15: 0005-Accept-anon-windows-in-XFilterEvent-to-update-XIM-st.patch
-Patch16: 0006-ximcp-Unmark-fabricated-with-serial-0-and-Xic-commit.patch
-Patch17: 0007-imDefIm-Add-LIBX11_ENABLE_FABRICATED_ORDER-env.patch
+# https://issues.redhat.com/browse/RHEL-58444
+Patch14: 0001-imDefLkup-verify-that-a-pointer-isn-t-NULL-before-us.patch

-BuildRequires: make
 BuildRequires: xorg-x11-util-macros >= 1.11
 BuildRequires: pkgconfig(xproto) >= 7.0.15
 BuildRequires: xorg-x11-xtrans-devel >= 1.0.3-4
@ -60,6 +59,7 @@ Core X11 protocol client library.

 %package common
 Summary: Common data for libX11
+Group: System Environment/Libraries
 BuildArch: noarch

 %description common
@ -67,6 +67,7 @@ libX11 common data

 %package devel
 Summary: Development files for %{name}
+Group: Development/Libraries
 Requires: %{name} = %{version}-%{release}
 Requires: %{name}-xcb = %{version}-%{release}

@ -75,13 +76,27 @@ X.Org X11 libX11 development package

 %package xcb
 Summary: XCB interop for libX11
+Group: System Environment/Libraries
 Conflicts: %{name} < %{version}-%{release}

 %description xcb
 libX11/libxcb interoperability library

 %prep
-%autosetup -p1 -n %{tarball}-%{?gitdate:%{gitdate}}%{!?gitdate:%{version}}
+%setup -q -n %{tarball}-%{?gitdate:%{gitdate}}%{!?gitdate:%{version}}
+%patch2 -p1 -b .dont-forward-keycode-0
+%patch3 -p1 -b .copycolormapandfree
+%patch4 -p1 -b .race
+%patch5 -p1 -b .fix-an-integer-overflow-in-init_om
+%patch6 -p1 -b .cve-2021-31535
+%patch7 -p1 -b .cve-2023-3138
+%patch8 -p1 -b .cve-2023-43785
+%patch9 -p1 -b .cve-2023-43786
+%patch10 -p1 -b .xputimage-clip-images-to-maximum-height-width-allowe
+%patch11 -p1 -b .xcreatepixmap-trigger-badvalue-error-for-out-of-rang
+%patch12 -p1 -b .cve-2023-43787
+%patch13 -p1 -b .rhel-23452
+%patch14 -p1 -b .rhel-58444

 %build
 autoreconf -v --install --force
@ -112,7 +127,7 @@ make %{?_smp_mflags} check

 %files
 %{_libdir}/libX11.so.6
-%{_libdir}/libX11.so.6.4.0
+%{_libdir}/libX11.so.6.3.0

 %files xcb
 %{_libdir}/libX11-xcb.so.1
@ -138,7 +153,6 @@ make %{?_smp_mflags} check
 %{_includedir}/X11/Xresource.h
 %{_includedir}/X11/Xutil.h
 %{_includedir}/X11/cursorfont.h
-%{_includedir}/X11/extensions/XKBgeom.h
 %{_libdir}/libX11.so
 %{_libdir}/libX11-xcb.so
 %{_libdir}/pkgconfig/x11.pc
@ -147,86 +161,39 @@ make %{?_smp_mflags} check
 %{_mandir}/man5/*.5*

 %changelog
-* Fri Dec 13 2024 Olivier Fourdan <ofourdan@redhat.com> - 1.7.0-11
- Backport fixes for XIM input sometimes jumbled (RHEL-69791)
-
-* Fri Sep 13 2024 José Expósito <jexposit@redhat.com> - 1.7.0-10
+* Fri Sep 13 2024 José Expósito <jexposit@redhat.com> - 1.6.8-9
 - Backport NULL check to avoid a crash
-  Resolves: https://issues.redhat.com/browse/RHEL-58298
+  Resolves: https://issues.redhat.com/browse/RHEL-58444

-* Wed Oct 11 2023 José Expósito <jexposit@redhat.com> - 1.7.0-9
+* Tue Jan 30 2024 Olivier Fourdan <ofourdan@redhat.com> - 1.6.8-8
+- Backport fix for Xlib lockups due to recursive XError (RHEL-23452)
+
+* Wed Oct 11 2023 José Expósito <jexposit@redhat.com> - 1.6.8-7
 - Fix CVE-2023-43785: out-of-bounds memory access in _XkbReadKeySyms()
 - Fix CVE-2023-43786: stack exhaustion from infinite recursion in
  PutSubImage()
 - Fix CVE-2023-43787: integer overflow in XCreateImage() leading to
  a heap overflow

-* Wed Jul 05 2023 Olivier Fourdan <ofourdan@redhat.com> - 1.7.0-8
+* Wed Jul 05 2023 Olivier Fourdan <ofourdan@redhat.com> - 1.6.8-6
 - CVE fix for: CVE-2023-3138
-  Resolve: rhbz#2213763
+  Resolve: rhbz#2213762

-* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 1.7.0-7
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
-  Related: rhbz#1991688
+* Thu Aug 12 2021 Adam Jackson <ajax@redhat.com> - 1.6.8-5
+- Fix CVE-2021-31535 (#1962439)

-* Tue Aug 03 2021 Peter Hutterer <peter.hutterer@redhat.com> - 1.7.0-6
- Parse the EVDEVK keysyms (#1988944)
+* Tue Nov  3 2020 Michel Dänzer <mdaenzer@redhat.com> - 1.6.8-4
+- Fix CVE-2020-14363 (#1873923)

-* Tue May 04 2021 Peter Hutterer <peter.hutterer@redhat.com> 1.7.0-5
- Rebuild to pick up the new xorgproto keysyms (#1954345)
+* Mon Feb 24 2020 Adam Jackson <ajax@redhat.com> - 1.6.8-3
+- Fix race condition in poll_for_reponse

-* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 1.7.0-4
- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
+* Fri Dec 13 2019 Adam Jackson <ajax@redhat.com> - 1.6.8-2
+- Fix assertion on error in XCopyColormapAndFree

-* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.7.0-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
-
-* Tue Dec 01 2020 Peter Hutterer <peter.hutterer@redhat.com> 1.7.0-2
- libX11 1.7.0 (with the tarball this time)
-
-* Tue Dec 01 2020 Peter Hutterer <peter.hutterer@redhat.com> 1.7.0-1
- libX11 1.7.0
- switch to using the autosetup rpm macro
-
-* Mon Nov 09 2020 Peter Hutterer <peter.hutterer@redhat.com> 1.6.12-3
- Fix a race-condition in poll_for_response (#1758384)
-
-* Thu Nov  5 11:12:56 AEST 2020 Peter Hutterer <peter.hutterer@redhat.com> - 1.6.12-2
- Add BuildRequires for make
-
-* Wed Aug 26 2020 Peter Hutterer <peter.hutterer@redhat.com> 1.6.12-1
- libX11 1.6.12 (CVE-2020-14363, CVE 2020-14344)
-
-* Fri Jul 31 2020 Adam Jackson <ajax@redhat.com> - 1.6.9-5
- Fix server reply validation issue in XIM (CVE 2020-14344)
-
-* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.6.9-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-
-* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.6.9-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
-
-* Wed Dec 11 2019 Peter Hutterer <peter.hutterer@redhat.com> 1.6.9-2
- handle ssharp in XConvertCase
-
-* Wed Oct 09 2019 Adam Jackson <ajax@redhat.com> - 1.6.9-1
- libX11 1.6.9
-
-* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.6.8-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
-
-* Thu Jun 20 2019 Peter Hutterer <peter.hutterer@redhat.com> 1.6.8-2
- rebuild to pick up the new xorgproto keysyms
-
-* Thu Jun 20 2019 Peter Hutterer <peter.hutterer@redhat.com> 1.6.8-1
+* Tue Nov 19 2019 Adam Jackson <ajax@redhat.com> - 1.6.8-1
 - libX11 1.6.8

-* Thu Mar 21 2019 Adam Jackson <ajax@redhat.com> - 1.6.7-3
- Rebuild for xtrans 1.4.0
-
-* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.6.7-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
-
 * Tue Oct 09 2018 Adam Jackson <ajax@redhat.com> - 1.6.7-1
 - libX11 1.6.7

--- a/1
+++ b/1
@ -1 +0,0 @@
-a3bdd2b090915fe0163b062f0e6576fe05dd332e
--- a/gating.yaml
+++ b/gating.yaml
@ -1,6 +0,0 @@
--- !Policy
-product_versions:
-  - rhel-9
-decision_context: osci_compose_gate
-rules:
-  - !PassingTestCaseRule {test_case_name: desktop-qe.desktop-ci.tier1-gating.functional}
--- a/make-git-snapshot.sh
+++ b/make-git-snapshot.sh
@ -1,17 +0,0 @@
-#!/bin/sh
-
-DIRNAME=libX11-$( date +%Y%m%d )
-
-rm -rf $DIRNAME
-git clone git://git.freedesktop.org/git/xorg/lib/libX11 $DIRNAME
-cd $DIRNAME
-if [ -z "$1" ]; then
-    git log | head -1
-else
-    git checkout $1
-fi
-git log | head -1 | awk '{ print $2 }' > ../commitid
-git repack -a -d
-cd ..
-tar jcf $DIRNAME.tar.bz2 $DIRNAME
-rm -rf $DIRNAME
--- a/1
+++ b/1
@ -1 +0,0 @@
-SHA512 (libX11-1.7.0.tar.bz2) = f661ca90350fd8a94f054b00f12f5122cea068ebff706acfd399462236c189a296a2358d17d16166635101cf56cc19303dd407873a159932d093c9f33556f9fb
				`@ -0,0 +1 @@`
				`f1ea96fe472a981d378b4f2eec90dcd063f9a407 SOURCES/libX11-1.6.8.tar.bz2`
				`@ -1 +0,0 @@`
				`SHA512 (libX11-1.7.0.tar.bz2) = f661ca90350fd8a94f054b00f12f5122cea068ebff706acfd399462236c189a296a2358d17d16166635101cf56cc19303dd407873a159932d093c9f33556f9fb`