rpms/xorg-x11-server
5
0
Fork 0
Code Issues Pull Requests Releases Activity

today's git snapshot. features DRI2 and input hotplug.

Browse Source 
note this will throw one avc every ten seconds until selinux policy is
fixed.
This commit is contained in:
Adam Jackson 2008-02-16 00:11:03 +00:00
parent 70fbb3a98f
commit becf1b4797
10 changed files with 10 additions and 595 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.cvsignore
View File

@ -1 +1 @@
xorg-server-20080107.tar.bz2
xorg-server-20080215.tar.bz2

2
commitid
View File

@ -1 +1 @@
260505e3c5a18044e97d31ea3bcc0955e46335c8
0ffb6a3ad010e80fe8f973fc228d549f9dd3effd

27
cve-2007-5760.patch
View File

@ -1,27 +0,0 @@
From bbde5b62a137ba726a747b838d81e92d72c1b42b Mon Sep 17 00:00:00 2001
From: Matthieu Herrb <matthieu@bluenote.herrb.com>
Date: Thu, 17 Jan 2008 15:26:41 +0100
Subject: [PATCH] Fix for CVE-2007-5760 - XFree86 Misc extension out of bounds array index
---
hw/xfree86/common/xf86MiscExt.c | 4 ++++
1 files changed, 4 insertions(+), 0 deletions(-)
diff --git a/hw/xfree86/common/xf86MiscExt.c b/hw/xfree86/common/xf86MiscExt.c
index c1b9c60..40c196a 100644
--- a/hw/xfree86/common/xf86MiscExt.c
+++ b/hw/xfree86/common/xf86MiscExt.c
@@ -548,6 +548,10 @@ MiscExtPassMessage(int scrnIndex, const char *msgtype, const char *msgval,
{
ScrnInfoPtr pScr = xf86Screens[scrnIndex];
+ /* should check this in the protocol, but xf86NumScreens isn't exported */
+ if (scrnIndex >= xf86NumScreens)
+ return BadValue;
+
if (*pScr->HandleMessage == NULL)
return BadImplementation;
return (*pScr->HandleMessage)(scrnIndex, msgtype, msgval, retstr);
--
1.5.3.6

263
cve-2007-6427.patch
View File

@ -1,263 +0,0 @@
From dd5e0f5cd5f3a87fee86d99c073ffa7cf89b0a27 Mon Sep 17 00:00:00 2001
From: Matthieu Herrb <matthieu@bluenote.herrb.com>
Date: Thu, 17 Jan 2008 15:27:34 +0100
Subject: [PATCH] Fix for CVE-2007-6427 - Xinput extension memory corruption.
---
Xi/chgfctl.c | 7 +------
Xi/chgkmap.c | 14 +++++++-------
Xi/chgprop.c | 10 +++-------
Xi/grabdev.c | 12 +++++-------
Xi/grabdevb.c | 10 +++-------
Xi/grabdevk.c | 9 ++-------
Xi/selectev.c | 11 ++++-------
Xi/sendexev.c | 14 ++++++++------
8 files changed, 33 insertions(+), 54 deletions(-)
diff --git a/Xi/chgfctl.c b/Xi/chgfctl.c
index 8fc24d5..696b74a 100644
--- a/Xi/chgfctl.c
+++ b/Xi/chgfctl.c
@@ -302,18 +302,13 @@ ChangeStringFeedback(ClientPtr client, DeviceIntPtr dev,
xStringFeedbackCtl * f)
{
char n;
- long *p;
int i, j;
KeySym *syms, *sup_syms;
syms = (KeySym *) (f + 1);
if (client->swapped) {
swaps(&f->length, n); /* swapped num_keysyms in calling proc */
- p = (long *)(syms);
- for (i = 0; i < f->num_keysyms; i++) {
- swapl(p, n);
- p++;
- }
+ SwapLongs((CARD32 *) syms, f->num_keysyms);
}
if (f->num_keysyms > s->ctrl.max_symbols)
diff --git a/Xi/chgkmap.c b/Xi/chgkmap.c
index 3361e98..df334c1 100644
--- a/Xi/chgkmap.c
+++ b/Xi/chgkmap.c
@@ -75,18 +75,14 @@ int
SProcXChangeDeviceKeyMapping(ClientPtr client)
{
char n;
- long *p;
- int i, count;
+ unsigned int count;
REQUEST(xChangeDeviceKeyMappingReq);
swaps(&stuff->length, n);
REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq);
- p = (long *)&stuff[1];
count = stuff->keyCodes * stuff->keySymsPerKeyCode;
- for (i = 0; i < count; i++) {
- swapl(p, n);
- p++;
- }
+ REQUEST_FIXED_SIZE(xChangeDeviceKeyMappingReq, count * sizeof(CARD32));
+ SwapLongs((CARD32 *) (&stuff[1]), count);
return (ProcXChangeDeviceKeyMapping(client));
}
@@ -102,10 +98,14 @@ ProcXChangeDeviceKeyMapping(ClientPtr client)
int ret;
unsigned len;
DeviceIntPtr dev;
+ unsigned int count;
REQUEST(xChangeDeviceKeyMappingReq);
REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq);
+ count = stuff->keyCodes * stuff->keySymsPerKeyCode;
+ REQUEST_FIXED_SIZE(xChangeDeviceKeyMappingReq, count * sizeof(CARD32));
+
ret = dixLookupDevice(&dev, stuff->deviceid, client, DixSetAttrAccess);
if (ret != Success)
return ret;
diff --git a/Xi/chgprop.c b/Xi/chgprop.c
index 58db886..3fb33e1 100644
--- a/Xi/chgprop.c
+++ b/Xi/chgprop.c
@@ -77,19 +77,15 @@ int
SProcXChangeDeviceDontPropagateList(ClientPtr client)
{
char n;
- long *p;
- int i;
REQUEST(xChangeDeviceDontPropagateListReq);
swaps(&stuff->length, n);
REQUEST_AT_LEAST_SIZE(xChangeDeviceDontPropagateListReq);
swapl(&stuff->window, n);
swaps(&stuff->count, n);
- p = (long *)&stuff[1];
- for (i = 0; i < stuff->count; i++) {
- swapl(p, n);
- p++;
- }
+ REQUEST_FIXED_SIZE(xChangeDeviceDontPropagateListReq,
+ stuff->count * sizeof(CARD32));
+ SwapLongs((CARD32 *) (&stuff[1]), stuff->count);
return (ProcXChangeDeviceDontPropagateList(client));
}
diff --git a/Xi/grabdev.c b/Xi/grabdev.c
index 110fc6b..0671e0e 100644
--- a/Xi/grabdev.c
+++ b/Xi/grabdev.c
@@ -78,8 +78,6 @@ int
SProcXGrabDevice(ClientPtr client)
{
char n;
- long *p;
- int i;
REQUEST(xGrabDeviceReq);
swaps(&stuff->length, n);
@@ -87,11 +85,11 @@ SProcXGrabDevice(ClientPtr client)
swapl(&stuff->grabWindow, n);
swapl(&stuff->time, n);
swaps(&stuff->event_count, n);
- p = (long *)&stuff[1];
- for (i = 0; i < stuff->event_count; i++) {
- swapl(p, n);
- p++;
- }
+
+ if (stuff->length != (sizeof(xGrabDeviceReq) >> 2) + stuff->event_count)
+ return BadLength;
+
+ SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);
return (ProcXGrabDevice(client));
}
diff --git a/Xi/grabdevb.c b/Xi/grabdevb.c
index c2661e8..ce0dcc5 100644
--- a/Xi/grabdevb.c
+++ b/Xi/grabdevb.c
@@ -77,8 +77,6 @@ int
SProcXGrabDeviceButton(ClientPtr client)
{
char n;
- long *p;
- int i;
REQUEST(xGrabDeviceButtonReq);
swaps(&stuff->length, n);
@@ -86,11 +84,9 @@ SProcXGrabDeviceButton(ClientPtr client)
swapl(&stuff->grabWindow, n);
swaps(&stuff->modifiers, n);
swaps(&stuff->event_count, n);
- p = (long *)&stuff[1];
- for (i = 0; i < stuff->event_count; i++) {
- swapl(p, n);
- p++;
- }
+ REQUEST_FIXED_SIZE(xGrabDeviceButtonReq,
+ stuff->event_count * sizeof(CARD32));
+ SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);
return (ProcXGrabDeviceButton(client));
}
diff --git a/Xi/grabdevk.c b/Xi/grabdevk.c
index 43b1928..d4b7fe8 100644
--- a/Xi/grabdevk.c
+++ b/Xi/grabdevk.c
@@ -77,8 +77,6 @@ int
SProcXGrabDeviceKey(ClientPtr client)
{
char n;
- long *p;
- int i;
REQUEST(xGrabDeviceKeyReq);
swaps(&stuff->length, n);
@@ -86,11 +84,8 @@ SProcXGrabDeviceKey(ClientPtr client)
swapl(&stuff->grabWindow, n);
swaps(&stuff->modifiers, n);
swaps(&stuff->event_count, n);
- p = (long *)&stuff[1];
- for (i = 0; i < stuff->event_count; i++) {
- swapl(p, n);
- p++;
- }
+ REQUEST_FIXED_SIZE(xGrabDeviceKeyReq, stuff->event_count * sizeof(CARD32));
+ SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);
return (ProcXGrabDeviceKey(client));
}
diff --git a/Xi/selectev.c b/Xi/selectev.c
index b93618a..d3670ab 100644
--- a/Xi/selectev.c
+++ b/Xi/selectev.c
@@ -127,19 +127,16 @@ int
SProcXSelectExtensionEvent(ClientPtr client)
{
char n;
- long *p;
- int i;
REQUEST(xSelectExtensionEventReq);
swaps(&stuff->length, n);
REQUEST_AT_LEAST_SIZE(xSelectExtensionEventReq);
swapl(&stuff->window, n);
swaps(&stuff->count, n);
- p = (long *)&stuff[1];
- for (i = 0; i < stuff->count; i++) {
- swapl(p, n);
- p++;
- }
+ REQUEST_FIXED_SIZE(xSelectExtensionEventReq,
+ stuff->count * sizeof(CARD32));
+ SwapLongs((CARD32 *) (&stuff[1]), stuff->count);
+
return (ProcXSelectExtensionEvent(client));
}
diff --git a/Xi/sendexev.c b/Xi/sendexev.c
index e4e38d7..588c910 100644
--- a/Xi/sendexev.c
+++ b/Xi/sendexev.c
@@ -80,7 +80,7 @@ int
SProcXSendExtensionEvent(ClientPtr client)
{
char n;
- long *p;
+ CARD32 *p;
int i;
xEvent eventT;
xEvent *eventP;
@@ -91,6 +91,11 @@ SProcXSendExtensionEvent(ClientPtr client)
REQUEST_AT_LEAST_SIZE(xSendExtensionEventReq);
swapl(&stuff->destination, n);
swaps(&stuff->count, n);
+
+ if (stuff->length != (sizeof(xSendExtensionEventReq) >> 2) + stuff->count +
+ (stuff->num_events * (sizeof(xEvent) >> 2)))
+ return BadLength;
+
eventP = (xEvent *) & stuff[1];
for (i = 0; i < stuff->num_events; i++, eventP++) {
proc = EventSwapVector[eventP->u.u.type & 0177];
@@ -100,11 +105,8 @@ SProcXSendExtensionEvent(ClientPtr client)
*eventP = eventT;
}
- p = (long *)(((xEvent *) & stuff[1]) + stuff->num_events);
- for (i = 0; i < stuff->count; i++) {
- swapl(p, n);
- p++;
- }
+ p = (CARD32 *)(((xEvent *) & stuff[1]) + stuff->num_events);
+ SwapLongs(p, stuff->count);
return (ProcXSendExtensionEvent(client));
}
--
1.5.3.6

26
cve-2007-6428.patch
View File

@ -1,26 +0,0 @@
From 7dc1717ff0f96b99271a912b8948dfce5164d5ad Mon Sep 17 00:00:00 2001
From: Matthieu Herrb <matthieu@bluenote.herrb.com>
Date: Thu, 17 Jan 2008 15:28:03 +0100
Subject: [PATCH] Fix for CVE-2007-6428 - TOG-cup extension memory corruption.
---
Xext/cup.c | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/Xext/cup.c b/Xext/cup.c
index d0e820c..fd1409e 100644
--- a/Xext/cup.c
+++ b/Xext/cup.c
@@ -176,6 +176,9 @@ int ProcGetReservedColormapEntries(
REQUEST_SIZE_MATCH (xXcupGetReservedColormapEntriesReq);
+ if (stuff->screen >= screenInfo.numScreens)
+ return BadValue;
+
#ifndef HAVE_SPECIAL_DESKTOP_COLORS
citems[CUP_BLACK_PIXEL].pixel =
screenInfo.screens[stuff->screen]->blackPixel;
--
1.5.3.6

218
cve-2007-6429.patch
View File

@ -1,218 +0,0 @@
From 6970d8c3c8b96b294159b4029c1428813568e20b Mon Sep 17 00:00:00 2001
From: Dave Airlie <airlied@redhat.com>
Date: Sat, 19 Jan 2008 06:37:58 +1000
Subject: [PATCH] CVE-2007-6429: EVI and MIT-SHM Vunerability updated patch
---
Xext/EVI.c | 15 ++++++++++++++-
Xext/sampleEVI.c | 29 ++++++++++++++++++++++++-----
Xext/shm.c | 52 ++++++++++++++++++++++++++++++++++++++++++++--------
3 files changed, 82 insertions(+), 14 deletions(-)
diff --git a/Xext/EVI.c b/Xext/EVI.c
index 4bd050c..a637bae 100644
--- a/Xext/EVI.c
+++ b/Xext/EVI.c
@@ -34,6 +34,7 @@ THE USE OR PERFORMANCE OF THIS SOFTWARE.
#include <X11/extensions/XEVIstr.h>
#include "EVIstruct.h"
#include "modinit.h"
+#include "scrnintstr.h"
static EviPrivPtr eviPriv;
@@ -84,10 +85,22 @@ ProcEVIGetVisualInfo(ClientPtr client)
{
REQUEST(xEVIGetVisualInfoReq);
xEVIGetVisualInfoReply rep;
- int n, n_conflict, n_info, sz_info, sz_conflict;
+ int i, n, n_conflict, n_info, sz_info, sz_conflict;
VisualID32 *conflict;
+ unsigned int total_visuals = 0;
xExtendedVisualInfo *eviInfo;
int status;
+
+ /*
+ * do this first, otherwise REQUEST_FIXED_SIZE can overflow. we assume
+ * here that you don't have more than 2^32 visuals over all your screens;
+ * this seems like a safe assumption.
+ */
+ for (i = 0; i < screenInfo.numScreens; i++)
+ total_visuals += screenInfo.screens[i]->numVisuals;
+ if (stuff->n_visual > total_visuals)
+ return BadValue;
+
REQUEST_FIXED_SIZE(xEVIGetVisualInfoReq, stuff->n_visual * sz_VisualID32);
status = eviPriv->getVisualInfo((VisualID32 *)&stuff[1], (int)stuff->n_visual,
&eviInfo, &n_info, &conflict, &n_conflict);
diff --git a/Xext/sampleEVI.c b/Xext/sampleEVI.c
index 7508aa7..b8f39c7 100644
--- a/Xext/sampleEVI.c
+++ b/Xext/sampleEVI.c
@@ -34,6 +34,13 @@ THE USE OR PERFORMANCE OF THIS SOFTWARE.
#include <X11/extensions/XEVIstr.h>
#include "EVIstruct.h"
#include "scrnintstr.h"
+
+#if HAVE_STDINT_H
+#include <stdint.h>
+#elif !defined(INT_MAX)
+#define INT_MAX 0x7fffffff
+#endif
+
static int sampleGetVisualInfo(
VisualID32 *visual,
int n_visual,
@@ -42,24 +49,36 @@ static int sampleGetVisualInfo(
VisualID32 **conflict_rn,
int *n_conflict_rn)
{
- int max_sz_evi = n_visual * sz_xExtendedVisualInfo * screenInfo.numScreens;
+ unsigned int max_sz_evi;
VisualID32 *temp_conflict;
xExtendedVisualInfo *evi;
- int max_visuals = 0, max_sz_conflict, sz_conflict = 0;
+ unsigned int max_visuals = 0, max_sz_conflict, sz_conflict = 0;
register int visualI, scrI, sz_evi = 0, conflictI, n_conflict;
- *evi_rn = evi = (xExtendedVisualInfo *)xalloc(max_sz_evi);
- if (!*evi_rn)
- return BadAlloc;
+
+ if (n_visual > UINT32_MAX/(sz_xExtendedVisualInfo * screenInfo.numScreens))
+ return BadAlloc;
+ max_sz_evi = n_visual * sz_xExtendedVisualInfo * screenInfo.numScreens;
+
for (scrI = 0; scrI < screenInfo.numScreens; scrI++) {
if (screenInfo.screens[scrI]->numVisuals > max_visuals)
max_visuals = screenInfo.screens[scrI]->numVisuals;
}
+
+ if (n_visual > UINT32_MAX/(sz_VisualID32 * screenInfo.numScreens
+ * max_visuals))
+ return BadAlloc;
max_sz_conflict = n_visual * sz_VisualID32 * screenInfo.numScreens * max_visuals;
+
+ *evi_rn = evi = (xExtendedVisualInfo *)xalloc(max_sz_evi);
+ if (!*evi_rn)
+ return BadAlloc;
+
temp_conflict = (VisualID32 *)xalloc(max_sz_conflict);
if (!temp_conflict) {
xfree(*evi_rn);
return BadAlloc;
}
+
for (scrI = 0; scrI < screenInfo.numScreens; scrI++) {
for (visualI = 0; visualI < n_visual; visualI++) {
evi[sz_evi].core_visual_id = visual[visualI];
diff --git a/Xext/shm.c b/Xext/shm.c
index e3d7a23..0f7a7eb 100644
--- a/Xext/shm.c
+++ b/Xext/shm.c
@@ -757,6 +757,8 @@ ProcPanoramiXShmCreatePixmap(
int i, j, result, rc;
ShmDescPtr shmdesc;
REQUEST(xShmCreatePixmapReq);
+ unsigned int width, height, depth;
+ unsigned long size;
PanoramiXRes *newPix;
REQUEST_SIZE_MATCH(xShmCreatePixmapReq);
@@ -770,11 +772,18 @@ ProcPanoramiXShmCreatePixmap(
return rc;
VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client);
- if (!stuff->width || !stuff->height)
+
+ width = stuff->width;
+ height = stuff->height;
+ depth = stuff->depth;
+ if (!width || !height || !depth)
{
client->errorValue = 0;
return BadValue;
}
+ if (width > 32767 || height > 32767)
+ return BadAlloc;
+
if (stuff->depth != 1)
{
pDepth = pDraw->pScreen->allowedDepths;
@@ -784,10 +793,19 @@ ProcPanoramiXShmCreatePixmap(
client->errorValue = stuff->depth;
return BadValue;
}
+
CreatePmap:
- VERIFY_SHMSIZE(shmdesc, stuff->offset,
- PixmapBytePad(stuff->width, stuff->depth) * stuff->height,
- client);
+ /* now w/h/d are valid; but will they overflow a 32-bit pointer? */
+ size = PixmapBytePad(width, depth) * height;
+ if (sizeof(void *) == 4 && BitsPerPixel(depth) > 8) {
+ if (size < width * height)
+ return BadAlloc;
+ /* thankfully, offset is unsigned */
+ if (stuff->offset + size < size)
+ return BadAlloc;
+ }
+
+ VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
if(!(newPix = (PanoramiXRes *) xalloc(sizeof(PanoramiXRes))))
return BadAlloc;
@@ -1086,6 +1104,8 @@ ProcShmCreatePixmap(client)
register int i, rc;
ShmDescPtr shmdesc;
REQUEST(xShmCreatePixmapReq);
+ unsigned int width, height, depth;
+ unsigned long size;
REQUEST_SIZE_MATCH(xShmCreatePixmapReq);
client->errorValue = stuff->pid;
@@ -1098,11 +1118,18 @@ ProcShmCreatePixmap(client)
return rc;
VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client);
- if (!stuff->width || !stuff->height)
+
+ width = stuff->width;
+ height = stuff->height;
+ depth = stuff->depth;
+ if (!width || !height || !depth)
{
client->errorValue = 0;
return BadValue;
}
+ if (width > 32767 || height > 32767)
+ return BadAlloc;
+
if (stuff->depth != 1)
{
pDepth = pDraw->pScreen->allowedDepths;
@@ -1112,10 +1139,19 @@ ProcShmCreatePixmap(client)
client->errorValue = stuff->depth;
return BadValue;
}
+
CreatePmap:
- VERIFY_SHMSIZE(shmdesc, stuff->offset,
- PixmapBytePad(stuff->width, stuff->depth) * stuff->height,
- client);
+ /* now w/h/d are valid; but will they overflow a 32-bit pointer? */
+ size = PixmapBytePad(width, depth) * height;
+ if (sizeof(void *) == 4 && BitsPerPixel(depth) > 8) {
+ if (size < width * height)
+ return BadAlloc;
+ /* thankfully, offset is unsigned */
+ if (stuff->offset + size < size)
+ return BadAlloc;
+ }
+
+ VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
pMap = (*shmFuncs[pDraw->pScreen->myNum]->CreatePixmap)(
pDraw->pScreen, stuff->width,
stuff->height, stuff->depth,
--
1.5.3.6

22
cve-2008-0006-server-fixup.patch
View File

@ -1,22 +0,0 @@
From bbde5b62a137ba726a747b838d81e92d72c1b42b Mon Sep 17 00:00:00 2001
From: Matthieu Herrb <matthieu@bluenote.herrb.com>
Date: Thu, 17 Jan 2008 15:26:41 +0100
Subject: [PATCH] Fix for CVE-2008-0006 - server side part of fix
diff -up xorg-x11-6.8.2/xc/programs/Xserver/dix/dixfonts.c.jx xorg-x11-6.8.2/xc/programs/Xserver/dix/dixfonts.c
--- xorg-x11-6.8.2/xc/programs/Xserver/dix/dixfonts.c.jx 2004-04-23 15:04:44.000000000 -0400
+++ xorg-x11-server/dix/dixfonts.c 2008-01-14 11:15:00.000000000 -0500
@@ -339,6 +339,13 @@ doOpenFont(ClientPtr client, OFclosurePt
err = BadFontName;
goto bail;
}
+ /* check values for firstCol, lastCol, firstRow, and lastRow */
+ if (pfont->info.firstCol > pfont->info.lastCol ||
+ pfont->info.firstRow > pfont->info.lastRow ||
+ pfont->info.lastCol - pfont->info.firstCol > 255) {
+ err = AllocError;
+ goto bail;
+ }
if (!pfont->fpe)
pfont->fpe = fpe;
pfont->refcnt++;

2
sources
View File

@ -1 +1 @@
42ce248a3546e26c5f4a0a1e71d949e8 xorg-server-20080107.tar.bz2
562c750bd294847e2829e8e2913cfbe4 xorg-server-20080215.tar.bz2

17
xorg-x11-server.spec
View File

@ -15,12 +15,12 @@
# RHEL5 bugfix sync
%define pkgname xorg-server
%define gitdate 20080107
%define gitdate 20080215
Summary: X.Org X11 X server
Name: xorg-x11-server
Version: 1.4.99.1
Release: 0.20.%{?gitdate}%{?dist}
Release: 0.21.%{?gitdate}%{?dist}
URL: http://www.x.org
License: MIT
Group: User Interface/X
@ -42,7 +42,6 @@ Patch19: xserver-1.3.0-xnest-exposures.patch
# OpenGL compositing manager feature/optimization patches.
Patch100: xorg-x11-server-1.1.0-no-move-damage.patch
Patch101: xserver-1.4.99-dont-backfill-bg-none.patch
Patch102: xserver-1.4.99-engage-composite-crack-mode.patch
# Red Hat specific tweaking, not intended for upstream
# XXX move these to the end of the list
@ -57,13 +56,6 @@ Patch2004: xserver-1.3.0-honor-displaysize.patch
Patch2007: xserver-1.3.0-randr12-config-hack.patch
Patch2013: xserver-1.4.99-document-fontpath-correctly.patch
# Trivial things, already merged - cves already upstream
Patch3000: cve-2007-5760.patch
Patch3001: cve-2007-6427.patch
Patch3002: cve-2007-6428.patch
Patch3003: cve-2007-6429.patch
Patch3004: cve-2008-0006-server-fixup.patch
# Trivial things to maybe merge upstream at next rebase
#Patch4003: argh-pixman.patch #fixme
Patch4004: xserver-1.4.99-xephyr-dri.patch
@ -134,6 +126,7 @@ Requires: libdrm >= 2.4.0
%endif
BuildRequires: libselinux-devel audit-libs-devel
BuildRequires: hal-devel dbus-devel
# Make sure libXfont has the catalogue FPE
Conflicts: libXfont < 1.2.9
@ -427,6 +420,7 @@ rm -rf $RPM_BUILD_ROOT
%{_libdir}/xorg/modules/extensions/libGLcore.so
%{_libdir}/xorg/modules/extensions/libglx.so
%{_libdir}/xorg/modules/extensions/libdri.so
%{_libdir}/xorg/modules/extensions/libdri2.so
%{_libdir}/xorg/modules/extensions/libdbe.so
%{_libdir}/xorg/modules/extensions/libextmod.so
%{_libdir}/xorg/modules/extensions/librecord.so
@ -517,6 +511,9 @@ rm -rf $RPM_BUILD_ROOT
%changelog
* Fri Feb 15 2008 Adam Jackson <ajax@redhat.com> 1.4.99.1-0.21
- Today's git snapshot. Features DRI2 and input hotplugging. Tasty.
* Mon Feb 11 2008 Adam Jackson <ajax@redhat.com> 1.4.99.1-0.20
- Conflict against insufficiently new libpciaccess. (#390751)

26
xserver-1.4.99-engage-composite-crack-mode.patch
View File

@ -1,26 +0,0 @@
From f5be9cb93c3a85572d741d56acb891bb56faf6a0 Mon Sep 17 00:00:00 2001
From: =?utf-8?q?Kristian=20H=C3=B8gsberg?= <krh@redhat.com>
Date: Wed, 16 Jan 2008 20:24:11 -0500
Subject: [PATCH] Don't break grab and focus state for a window when redirecting it.
---
dix/window.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/dix/window.c b/dix/window.c
index f65fb84..ccfec2b 100644
--- a/dix/window.c
+++ b/dix/window.c
@@ -3022,7 +3022,8 @@ UnrealizeTree(
}
#endif
(* Unrealize)(pChild);
- DeleteWindowFromAnyEvents(pChild, FALSE);
+ if (MapUnmapEventsEnabled(pWin))
+ DeleteWindowFromAnyEvents(pChild, FALSE);
if (pChild->viewable)
{
#ifdef DO_SAVE_UNDERS
--
1.5.3.7