diff --git a/.cvsignore b/.cvsignore index cf6ffd6..c2b4ad6 100644 --- a/.cvsignore +++ b/.cvsignore @@ -1 +1 @@ -xorg-server-20080107.tar.bz2 +xorg-server-20080215.tar.bz2 diff --git a/commitid b/commitid index 29018a6..2371c93 100644 --- a/commitid +++ b/commitid @@ -1 +1 @@ -260505e3c5a18044e97d31ea3bcc0955e46335c8 +0ffb6a3ad010e80fe8f973fc228d549f9dd3effd diff --git a/cve-2007-5760.patch b/cve-2007-5760.patch deleted file mode 100644 index 7b62fc7..0000000 --- a/cve-2007-5760.patch +++ /dev/null @@ -1,27 +0,0 @@ -From bbde5b62a137ba726a747b838d81e92d72c1b42b Mon Sep 17 00:00:00 2001 -From: Matthieu Herrb -Date: Thu, 17 Jan 2008 15:26:41 +0100 -Subject: [PATCH] Fix for CVE-2007-5760 - XFree86 Misc extension out of bounds array index - ---- - hw/xfree86/common/xf86MiscExt.c | 4 ++++ - 1 files changed, 4 insertions(+), 0 deletions(-) - -diff --git a/hw/xfree86/common/xf86MiscExt.c b/hw/xfree86/common/xf86MiscExt.c -index c1b9c60..40c196a 100644 ---- a/hw/xfree86/common/xf86MiscExt.c -+++ b/hw/xfree86/common/xf86MiscExt.c -@@ -548,6 +548,10 @@ MiscExtPassMessage(int scrnIndex, const char *msgtype, const char *msgval, - { - ScrnInfoPtr pScr = xf86Screens[scrnIndex]; - -+ /* should check this in the protocol, but xf86NumScreens isn't exported */ -+ if (scrnIndex >= xf86NumScreens) -+ return BadValue; -+ - if (*pScr->HandleMessage == NULL) - return BadImplementation; - return (*pScr->HandleMessage)(scrnIndex, msgtype, msgval, retstr); --- -1.5.3.6 - diff --git a/cve-2007-6427.patch b/cve-2007-6427.patch deleted file mode 100644 index 421130c..0000000 --- a/cve-2007-6427.patch +++ /dev/null @@ -1,263 +0,0 @@ -From dd5e0f5cd5f3a87fee86d99c073ffa7cf89b0a27 Mon Sep 17 00:00:00 2001 -From: Matthieu Herrb -Date: Thu, 17 Jan 2008 15:27:34 +0100 -Subject: [PATCH] Fix for CVE-2007-6427 - Xinput extension memory corruption. - ---- - Xi/chgfctl.c | 7 +------ - Xi/chgkmap.c | 14 +++++++------- - Xi/chgprop.c | 10 +++------- - Xi/grabdev.c | 12 +++++------- - Xi/grabdevb.c | 10 +++------- - Xi/grabdevk.c | 9 ++------- - Xi/selectev.c | 11 ++++------- - Xi/sendexev.c | 14 ++++++++------ - 8 files changed, 33 insertions(+), 54 deletions(-) - -diff --git a/Xi/chgfctl.c b/Xi/chgfctl.c -index 8fc24d5..696b74a 100644 ---- a/Xi/chgfctl.c -+++ b/Xi/chgfctl.c -@@ -302,18 +302,13 @@ ChangeStringFeedback(ClientPtr client, DeviceIntPtr dev, - xStringFeedbackCtl * f) - { - char n; -- long *p; - int i, j; - KeySym *syms, *sup_syms; - - syms = (KeySym *) (f + 1); - if (client->swapped) { - swaps(&f->length, n); /* swapped num_keysyms in calling proc */ -- p = (long *)(syms); -- for (i = 0; i < f->num_keysyms; i++) { -- swapl(p, n); -- p++; -- } -+ SwapLongs((CARD32 *) syms, f->num_keysyms); - } - - if (f->num_keysyms > s->ctrl.max_symbols) -diff --git a/Xi/chgkmap.c b/Xi/chgkmap.c -index 3361e98..df334c1 100644 ---- a/Xi/chgkmap.c -+++ b/Xi/chgkmap.c -@@ -75,18 +75,14 @@ int - SProcXChangeDeviceKeyMapping(ClientPtr client) - { - char n; -- long *p; -- int i, count; -+ unsigned int count; - - REQUEST(xChangeDeviceKeyMappingReq); - swaps(&stuff->length, n); - REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq); -- p = (long *)&stuff[1]; - count = stuff->keyCodes * stuff->keySymsPerKeyCode; -- for (i = 0; i < count; i++) { -- swapl(p, n); -- p++; -- } -+ REQUEST_FIXED_SIZE(xChangeDeviceKeyMappingReq, count * sizeof(CARD32)); -+ SwapLongs((CARD32 *) (&stuff[1]), count); - return (ProcXChangeDeviceKeyMapping(client)); - } - -@@ -102,10 +98,14 @@ ProcXChangeDeviceKeyMapping(ClientPtr client) - int ret; - unsigned len; - DeviceIntPtr dev; -+ unsigned int count; - - REQUEST(xChangeDeviceKeyMappingReq); - REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq); - -+ count = stuff->keyCodes * stuff->keySymsPerKeyCode; -+ REQUEST_FIXED_SIZE(xChangeDeviceKeyMappingReq, count * sizeof(CARD32)); -+ - ret = dixLookupDevice(&dev, stuff->deviceid, client, DixSetAttrAccess); - if (ret != Success) - return ret; -diff --git a/Xi/chgprop.c b/Xi/chgprop.c -index 58db886..3fb33e1 100644 ---- a/Xi/chgprop.c -+++ b/Xi/chgprop.c -@@ -77,19 +77,15 @@ int - SProcXChangeDeviceDontPropagateList(ClientPtr client) - { - char n; -- long *p; -- int i; - - REQUEST(xChangeDeviceDontPropagateListReq); - swaps(&stuff->length, n); - REQUEST_AT_LEAST_SIZE(xChangeDeviceDontPropagateListReq); - swapl(&stuff->window, n); - swaps(&stuff->count, n); -- p = (long *)&stuff[1]; -- for (i = 0; i < stuff->count; i++) { -- swapl(p, n); -- p++; -- } -+ REQUEST_FIXED_SIZE(xChangeDeviceDontPropagateListReq, -+ stuff->count * sizeof(CARD32)); -+ SwapLongs((CARD32 *) (&stuff[1]), stuff->count); - return (ProcXChangeDeviceDontPropagateList(client)); - } - -diff --git a/Xi/grabdev.c b/Xi/grabdev.c -index 110fc6b..0671e0e 100644 ---- a/Xi/grabdev.c -+++ b/Xi/grabdev.c -@@ -78,8 +78,6 @@ int - SProcXGrabDevice(ClientPtr client) - { - char n; -- long *p; -- int i; - - REQUEST(xGrabDeviceReq); - swaps(&stuff->length, n); -@@ -87,11 +85,11 @@ SProcXGrabDevice(ClientPtr client) - swapl(&stuff->grabWindow, n); - swapl(&stuff->time, n); - swaps(&stuff->event_count, n); -- p = (long *)&stuff[1]; -- for (i = 0; i < stuff->event_count; i++) { -- swapl(p, n); -- p++; -- } -+ -+ if (stuff->length != (sizeof(xGrabDeviceReq) >> 2) + stuff->event_count) -+ return BadLength; -+ -+ SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count); - - return (ProcXGrabDevice(client)); - } -diff --git a/Xi/grabdevb.c b/Xi/grabdevb.c -index c2661e8..ce0dcc5 100644 ---- a/Xi/grabdevb.c -+++ b/Xi/grabdevb.c -@@ -77,8 +77,6 @@ int - SProcXGrabDeviceButton(ClientPtr client) - { - char n; -- long *p; -- int i; - - REQUEST(xGrabDeviceButtonReq); - swaps(&stuff->length, n); -@@ -86,11 +84,9 @@ SProcXGrabDeviceButton(ClientPtr client) - swapl(&stuff->grabWindow, n); - swaps(&stuff->modifiers, n); - swaps(&stuff->event_count, n); -- p = (long *)&stuff[1]; -- for (i = 0; i < stuff->event_count; i++) { -- swapl(p, n); -- p++; -- } -+ REQUEST_FIXED_SIZE(xGrabDeviceButtonReq, -+ stuff->event_count * sizeof(CARD32)); -+ SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count); - - return (ProcXGrabDeviceButton(client)); - } -diff --git a/Xi/grabdevk.c b/Xi/grabdevk.c -index 43b1928..d4b7fe8 100644 ---- a/Xi/grabdevk.c -+++ b/Xi/grabdevk.c -@@ -77,8 +77,6 @@ int - SProcXGrabDeviceKey(ClientPtr client) - { - char n; -- long *p; -- int i; - - REQUEST(xGrabDeviceKeyReq); - swaps(&stuff->length, n); -@@ -86,11 +84,8 @@ SProcXGrabDeviceKey(ClientPtr client) - swapl(&stuff->grabWindow, n); - swaps(&stuff->modifiers, n); - swaps(&stuff->event_count, n); -- p = (long *)&stuff[1]; -- for (i = 0; i < stuff->event_count; i++) { -- swapl(p, n); -- p++; -- } -+ REQUEST_FIXED_SIZE(xGrabDeviceKeyReq, stuff->event_count * sizeof(CARD32)); -+ SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count); - return (ProcXGrabDeviceKey(client)); - } - -diff --git a/Xi/selectev.c b/Xi/selectev.c -index b93618a..d3670ab 100644 ---- a/Xi/selectev.c -+++ b/Xi/selectev.c -@@ -127,19 +127,16 @@ int - SProcXSelectExtensionEvent(ClientPtr client) - { - char n; -- long *p; -- int i; - - REQUEST(xSelectExtensionEventReq); - swaps(&stuff->length, n); - REQUEST_AT_LEAST_SIZE(xSelectExtensionEventReq); - swapl(&stuff->window, n); - swaps(&stuff->count, n); -- p = (long *)&stuff[1]; -- for (i = 0; i < stuff->count; i++) { -- swapl(p, n); -- p++; -- } -+ REQUEST_FIXED_SIZE(xSelectExtensionEventReq, -+ stuff->count * sizeof(CARD32)); -+ SwapLongs((CARD32 *) (&stuff[1]), stuff->count); -+ - return (ProcXSelectExtensionEvent(client)); - } - -diff --git a/Xi/sendexev.c b/Xi/sendexev.c -index e4e38d7..588c910 100644 ---- a/Xi/sendexev.c -+++ b/Xi/sendexev.c -@@ -80,7 +80,7 @@ int - SProcXSendExtensionEvent(ClientPtr client) - { - char n; -- long *p; -+ CARD32 *p; - int i; - xEvent eventT; - xEvent *eventP; -@@ -91,6 +91,11 @@ SProcXSendExtensionEvent(ClientPtr client) - REQUEST_AT_LEAST_SIZE(xSendExtensionEventReq); - swapl(&stuff->destination, n); - swaps(&stuff->count, n); -+ -+ if (stuff->length != (sizeof(xSendExtensionEventReq) >> 2) + stuff->count + -+ (stuff->num_events * (sizeof(xEvent) >> 2))) -+ return BadLength; -+ - eventP = (xEvent *) & stuff[1]; - for (i = 0; i < stuff->num_events; i++, eventP++) { - proc = EventSwapVector[eventP->u.u.type & 0177]; -@@ -100,11 +105,8 @@ SProcXSendExtensionEvent(ClientPtr client) - *eventP = eventT; - } - -- p = (long *)(((xEvent *) & stuff[1]) + stuff->num_events); -- for (i = 0; i < stuff->count; i++) { -- swapl(p, n); -- p++; -- } -+ p = (CARD32 *)(((xEvent *) & stuff[1]) + stuff->num_events); -+ SwapLongs(p, stuff->count); - return (ProcXSendExtensionEvent(client)); - } - --- -1.5.3.6 - diff --git a/cve-2007-6428.patch b/cve-2007-6428.patch deleted file mode 100644 index c7728fe..0000000 --- a/cve-2007-6428.patch +++ /dev/null @@ -1,26 +0,0 @@ -From 7dc1717ff0f96b99271a912b8948dfce5164d5ad Mon Sep 17 00:00:00 2001 -From: Matthieu Herrb -Date: Thu, 17 Jan 2008 15:28:03 +0100 -Subject: [PATCH] Fix for CVE-2007-6428 - TOG-cup extension memory corruption. - ---- - Xext/cup.c | 3 +++ - 1 files changed, 3 insertions(+), 0 deletions(-) - -diff --git a/Xext/cup.c b/Xext/cup.c -index d0e820c..fd1409e 100644 ---- a/Xext/cup.c -+++ b/Xext/cup.c -@@ -176,6 +176,9 @@ int ProcGetReservedColormapEntries( - - REQUEST_SIZE_MATCH (xXcupGetReservedColormapEntriesReq); - -+ if (stuff->screen >= screenInfo.numScreens) -+ return BadValue; -+ - #ifndef HAVE_SPECIAL_DESKTOP_COLORS - citems[CUP_BLACK_PIXEL].pixel = - screenInfo.screens[stuff->screen]->blackPixel; --- -1.5.3.6 - diff --git a/cve-2007-6429.patch b/cve-2007-6429.patch deleted file mode 100644 index 80b6d7c..0000000 --- a/cve-2007-6429.patch +++ /dev/null @@ -1,218 +0,0 @@ -From 6970d8c3c8b96b294159b4029c1428813568e20b Mon Sep 17 00:00:00 2001 -From: Dave Airlie -Date: Sat, 19 Jan 2008 06:37:58 +1000 -Subject: [PATCH] CVE-2007-6429: EVI and MIT-SHM Vunerability updated patch - ---- - Xext/EVI.c | 15 ++++++++++++++- - Xext/sampleEVI.c | 29 ++++++++++++++++++++++++----- - Xext/shm.c | 52 ++++++++++++++++++++++++++++++++++++++++++++-------- - 3 files changed, 82 insertions(+), 14 deletions(-) - -diff --git a/Xext/EVI.c b/Xext/EVI.c -index 4bd050c..a637bae 100644 ---- a/Xext/EVI.c -+++ b/Xext/EVI.c -@@ -34,6 +34,7 @@ THE USE OR PERFORMANCE OF THIS SOFTWARE. - #include - #include "EVIstruct.h" - #include "modinit.h" -+#include "scrnintstr.h" - - static EviPrivPtr eviPriv; - -@@ -84,10 +85,22 @@ ProcEVIGetVisualInfo(ClientPtr client) - { - REQUEST(xEVIGetVisualInfoReq); - xEVIGetVisualInfoReply rep; -- int n, n_conflict, n_info, sz_info, sz_conflict; -+ int i, n, n_conflict, n_info, sz_info, sz_conflict; - VisualID32 *conflict; -+ unsigned int total_visuals = 0; - xExtendedVisualInfo *eviInfo; - int status; -+ -+ /* -+ * do this first, otherwise REQUEST_FIXED_SIZE can overflow. we assume -+ * here that you don't have more than 2^32 visuals over all your screens; -+ * this seems like a safe assumption. -+ */ -+ for (i = 0; i < screenInfo.numScreens; i++) -+ total_visuals += screenInfo.screens[i]->numVisuals; -+ if (stuff->n_visual > total_visuals) -+ return BadValue; -+ - REQUEST_FIXED_SIZE(xEVIGetVisualInfoReq, stuff->n_visual * sz_VisualID32); - status = eviPriv->getVisualInfo((VisualID32 *)&stuff[1], (int)stuff->n_visual, - &eviInfo, &n_info, &conflict, &n_conflict); -diff --git a/Xext/sampleEVI.c b/Xext/sampleEVI.c -index 7508aa7..b8f39c7 100644 ---- a/Xext/sampleEVI.c -+++ b/Xext/sampleEVI.c -@@ -34,6 +34,13 @@ THE USE OR PERFORMANCE OF THIS SOFTWARE. - #include - #include "EVIstruct.h" - #include "scrnintstr.h" -+ -+#if HAVE_STDINT_H -+#include -+#elif !defined(INT_MAX) -+#define INT_MAX 0x7fffffff -+#endif -+ - static int sampleGetVisualInfo( - VisualID32 *visual, - int n_visual, -@@ -42,24 +49,36 @@ static int sampleGetVisualInfo( - VisualID32 **conflict_rn, - int *n_conflict_rn) - { -- int max_sz_evi = n_visual * sz_xExtendedVisualInfo * screenInfo.numScreens; -+ unsigned int max_sz_evi; - VisualID32 *temp_conflict; - xExtendedVisualInfo *evi; -- int max_visuals = 0, max_sz_conflict, sz_conflict = 0; -+ unsigned int max_visuals = 0, max_sz_conflict, sz_conflict = 0; - register int visualI, scrI, sz_evi = 0, conflictI, n_conflict; -- *evi_rn = evi = (xExtendedVisualInfo *)xalloc(max_sz_evi); -- if (!*evi_rn) -- return BadAlloc; -+ -+ if (n_visual > UINT32_MAX/(sz_xExtendedVisualInfo * screenInfo.numScreens)) -+ return BadAlloc; -+ max_sz_evi = n_visual * sz_xExtendedVisualInfo * screenInfo.numScreens; -+ - for (scrI = 0; scrI < screenInfo.numScreens; scrI++) { - if (screenInfo.screens[scrI]->numVisuals > max_visuals) - max_visuals = screenInfo.screens[scrI]->numVisuals; - } -+ -+ if (n_visual > UINT32_MAX/(sz_VisualID32 * screenInfo.numScreens -+ * max_visuals)) -+ return BadAlloc; - max_sz_conflict = n_visual * sz_VisualID32 * screenInfo.numScreens * max_visuals; -+ -+ *evi_rn = evi = (xExtendedVisualInfo *)xalloc(max_sz_evi); -+ if (!*evi_rn) -+ return BadAlloc; -+ - temp_conflict = (VisualID32 *)xalloc(max_sz_conflict); - if (!temp_conflict) { - xfree(*evi_rn); - return BadAlloc; - } -+ - for (scrI = 0; scrI < screenInfo.numScreens; scrI++) { - for (visualI = 0; visualI < n_visual; visualI++) { - evi[sz_evi].core_visual_id = visual[visualI]; -diff --git a/Xext/shm.c b/Xext/shm.c -index e3d7a23..0f7a7eb 100644 ---- a/Xext/shm.c -+++ b/Xext/shm.c -@@ -757,6 +757,8 @@ ProcPanoramiXShmCreatePixmap( - int i, j, result, rc; - ShmDescPtr shmdesc; - REQUEST(xShmCreatePixmapReq); -+ unsigned int width, height, depth; -+ unsigned long size; - PanoramiXRes *newPix; - - REQUEST_SIZE_MATCH(xShmCreatePixmapReq); -@@ -770,11 +772,18 @@ ProcPanoramiXShmCreatePixmap( - return rc; - - VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client); -- if (!stuff->width || !stuff->height) -+ -+ width = stuff->width; -+ height = stuff->height; -+ depth = stuff->depth; -+ if (!width || !height || !depth) - { - client->errorValue = 0; - return BadValue; - } -+ if (width > 32767 || height > 32767) -+ return BadAlloc; -+ - if (stuff->depth != 1) - { - pDepth = pDraw->pScreen->allowedDepths; -@@ -784,10 +793,19 @@ ProcPanoramiXShmCreatePixmap( - client->errorValue = stuff->depth; - return BadValue; - } -+ - CreatePmap: -- VERIFY_SHMSIZE(shmdesc, stuff->offset, -- PixmapBytePad(stuff->width, stuff->depth) * stuff->height, -- client); -+ /* now w/h/d are valid; but will they overflow a 32-bit pointer? */ -+ size = PixmapBytePad(width, depth) * height; -+ if (sizeof(void *) == 4 && BitsPerPixel(depth) > 8) { -+ if (size < width * height) -+ return BadAlloc; -+ /* thankfully, offset is unsigned */ -+ if (stuff->offset + size < size) -+ return BadAlloc; -+ } -+ -+ VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client); - - if(!(newPix = (PanoramiXRes *) xalloc(sizeof(PanoramiXRes)))) - return BadAlloc; -@@ -1086,6 +1104,8 @@ ProcShmCreatePixmap(client) - register int i, rc; - ShmDescPtr shmdesc; - REQUEST(xShmCreatePixmapReq); -+ unsigned int width, height, depth; -+ unsigned long size; - - REQUEST_SIZE_MATCH(xShmCreatePixmapReq); - client->errorValue = stuff->pid; -@@ -1098,11 +1118,18 @@ ProcShmCreatePixmap(client) - return rc; - - VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client); -- if (!stuff->width || !stuff->height) -+ -+ width = stuff->width; -+ height = stuff->height; -+ depth = stuff->depth; -+ if (!width || !height || !depth) - { - client->errorValue = 0; - return BadValue; - } -+ if (width > 32767 || height > 32767) -+ return BadAlloc; -+ - if (stuff->depth != 1) - { - pDepth = pDraw->pScreen->allowedDepths; -@@ -1112,10 +1139,19 @@ ProcShmCreatePixmap(client) - client->errorValue = stuff->depth; - return BadValue; - } -+ - CreatePmap: -- VERIFY_SHMSIZE(shmdesc, stuff->offset, -- PixmapBytePad(stuff->width, stuff->depth) * stuff->height, -- client); -+ /* now w/h/d are valid; but will they overflow a 32-bit pointer? */ -+ size = PixmapBytePad(width, depth) * height; -+ if (sizeof(void *) == 4 && BitsPerPixel(depth) > 8) { -+ if (size < width * height) -+ return BadAlloc; -+ /* thankfully, offset is unsigned */ -+ if (stuff->offset + size < size) -+ return BadAlloc; -+ } -+ -+ VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client); - pMap = (*shmFuncs[pDraw->pScreen->myNum]->CreatePixmap)( - pDraw->pScreen, stuff->width, - stuff->height, stuff->depth, --- -1.5.3.6 - diff --git a/cve-2008-0006-server-fixup.patch b/cve-2008-0006-server-fixup.patch deleted file mode 100644 index b797118..0000000 --- a/cve-2008-0006-server-fixup.patch +++ /dev/null @@ -1,22 +0,0 @@ -From bbde5b62a137ba726a747b838d81e92d72c1b42b Mon Sep 17 00:00:00 2001 -From: Matthieu Herrb -Date: Thu, 17 Jan 2008 15:26:41 +0100 -Subject: [PATCH] Fix for CVE-2008-0006 - server side part of fix - -diff -up xorg-x11-6.8.2/xc/programs/Xserver/dix/dixfonts.c.jx xorg-x11-6.8.2/xc/programs/Xserver/dix/dixfonts.c ---- xorg-x11-6.8.2/xc/programs/Xserver/dix/dixfonts.c.jx 2004-04-23 15:04:44.000000000 -0400 -+++ xorg-x11-server/dix/dixfonts.c 2008-01-14 11:15:00.000000000 -0500 -@@ -339,6 +339,13 @@ doOpenFont(ClientPtr client, OFclosurePt - err = BadFontName; - goto bail; - } -+ /* check values for firstCol, lastCol, firstRow, and lastRow */ -+ if (pfont->info.firstCol > pfont->info.lastCol || -+ pfont->info.firstRow > pfont->info.lastRow || -+ pfont->info.lastCol - pfont->info.firstCol > 255) { -+ err = AllocError; -+ goto bail; -+ } - if (!pfont->fpe) - pfont->fpe = fpe; - pfont->refcnt++; diff --git a/sources b/sources index 830fd4d..d4d9d90 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -42ce248a3546e26c5f4a0a1e71d949e8 xorg-server-20080107.tar.bz2 +562c750bd294847e2829e8e2913cfbe4 xorg-server-20080215.tar.bz2 diff --git a/xorg-x11-server.spec b/xorg-x11-server.spec index ba1cbc6..f6e47da 100644 --- a/xorg-x11-server.spec +++ b/xorg-x11-server.spec @@ -15,12 +15,12 @@ # RHEL5 bugfix sync %define pkgname xorg-server -%define gitdate 20080107 +%define gitdate 20080215 Summary: X.Org X11 X server Name: xorg-x11-server Version: 1.4.99.1 -Release: 0.20.%{?gitdate}%{?dist} +Release: 0.21.%{?gitdate}%{?dist} URL: http://www.x.org License: MIT Group: User Interface/X @@ -42,7 +42,6 @@ Patch19: xserver-1.3.0-xnest-exposures.patch # OpenGL compositing manager feature/optimization patches. Patch100: xorg-x11-server-1.1.0-no-move-damage.patch Patch101: xserver-1.4.99-dont-backfill-bg-none.patch -Patch102: xserver-1.4.99-engage-composite-crack-mode.patch # Red Hat specific tweaking, not intended for upstream # XXX move these to the end of the list @@ -57,13 +56,6 @@ Patch2004: xserver-1.3.0-honor-displaysize.patch Patch2007: xserver-1.3.0-randr12-config-hack.patch Patch2013: xserver-1.4.99-document-fontpath-correctly.patch -# Trivial things, already merged - cves already upstream -Patch3000: cve-2007-5760.patch -Patch3001: cve-2007-6427.patch -Patch3002: cve-2007-6428.patch -Patch3003: cve-2007-6429.patch -Patch3004: cve-2008-0006-server-fixup.patch - # Trivial things to maybe merge upstream at next rebase #Patch4003: argh-pixman.patch #fixme Patch4004: xserver-1.4.99-xephyr-dri.patch @@ -134,6 +126,7 @@ Requires: libdrm >= 2.4.0 %endif BuildRequires: libselinux-devel audit-libs-devel +BuildRequires: hal-devel dbus-devel # Make sure libXfont has the catalogue FPE Conflicts: libXfont < 1.2.9 @@ -427,6 +420,7 @@ rm -rf $RPM_BUILD_ROOT %{_libdir}/xorg/modules/extensions/libGLcore.so %{_libdir}/xorg/modules/extensions/libglx.so %{_libdir}/xorg/modules/extensions/libdri.so +%{_libdir}/xorg/modules/extensions/libdri2.so %{_libdir}/xorg/modules/extensions/libdbe.so %{_libdir}/xorg/modules/extensions/libextmod.so %{_libdir}/xorg/modules/extensions/librecord.so @@ -517,6 +511,9 @@ rm -rf $RPM_BUILD_ROOT %changelog +* Fri Feb 15 2008 Adam Jackson 1.4.99.1-0.21 +- Today's git snapshot. Features DRI2 and input hotplugging. Tasty. + * Mon Feb 11 2008 Adam Jackson 1.4.99.1-0.20 - Conflict against insufficiently new libpciaccess. (#390751) diff --git a/xserver-1.4.99-engage-composite-crack-mode.patch b/xserver-1.4.99-engage-composite-crack-mode.patch deleted file mode 100644 index b48027b..0000000 --- a/xserver-1.4.99-engage-composite-crack-mode.patch +++ /dev/null @@ -1,26 +0,0 @@ -From f5be9cb93c3a85572d741d56acb891bb56faf6a0 Mon Sep 17 00:00:00 2001 -From: =?utf-8?q?Kristian=20H=C3=B8gsberg?= -Date: Wed, 16 Jan 2008 20:24:11 -0500 -Subject: [PATCH] Don't break grab and focus state for a window when redirecting it. - ---- - dix/window.c | 3 ++- - 1 files changed, 2 insertions(+), 1 deletions(-) - -diff --git a/dix/window.c b/dix/window.c -index f65fb84..ccfec2b 100644 ---- a/dix/window.c -+++ b/dix/window.c -@@ -3022,7 +3022,8 @@ UnrealizeTree( - } - #endif - (* Unrealize)(pChild); -- DeleteWindowFromAnyEvents(pChild, FALSE); -+ if (MapUnmapEventsEnabled(pWin)) -+ DeleteWindowFromAnyEvents(pChild, FALSE); - if (pChild->viewable) - { - #ifdef DO_SAVE_UNDERS --- -1.5.3.7 -