Xext/panoramiX.c

@@ -988,10 +988,11 @@ ProcPanoramiXGetScreenSize(ClientPtr client)
     xPanoramiXGetScreenSizeReply rep;
     int rc;
 
+    REQUEST_SIZE_MATCH(xPanoramiXGetScreenSizeReq);
+
     if (stuff->screen >= PanoramiXNumScreens)
         return BadMatch;
 
-    REQUEST_SIZE_MATCH(xPanoramiXGetScreenSizeReq);
     rc = dixLookupWindow(&pWin, stuff->window, client, DixGetAttrAccess);
     if (rc != Success)
         return rc;

Xext/panoramiXprocs.c

@@ -1050,7 +1050,7 @@ PanoramiXClearToBackground(ClientPtr client)
 int
 PanoramiXCopyArea(ClientPtr client)
 {
-    int j, result, srcx, srcy, dstx, dsty;
+    int j, result, srcx, srcy, dstx, dsty, width, height;
     PanoramiXRes *gc, *src, *dst;
     Bool srcIsRoot = FALSE;
     Bool dstIsRoot = FALSE;
@@ -1091,6 +1091,8 @@ PanoramiXCopyArea(ClientPtr client)
     srcy = stuff->srcY;
     dstx = stuff->dstX;
     dsty = stuff->dstY;
+    width = stuff->width;
+    height = stuff->height;
     if ((dst->type == XRT_PIXMAP) && (src->type == XRT_WINDOW)) {
         DrawablePtr drawables[MAXSCREENS];
         DrawablePtr pDst;
@@ -1105,13 +1107,12 @@ PanoramiXCopyArea(ClientPtr client)
                 return rc;
         }
 
-        pitch = PixmapBytePad(stuff->width, drawables[0]->depth);
-        if (!(data = calloc(stuff->height, pitch)))
+        pitch = PixmapBytePad(width, drawables[0]->depth);
+        if (!(data = calloc(height, pitch)))
             return BadAlloc;
 
-        XineramaGetImageData(drawables, srcx, srcy,
-                             stuff->width, stuff->height, ZPixmap, ~0, data,
-                             pitch, srcIsRoot);
+        XineramaGetImageData(drawables, srcx, srcy, width, height, ZPixmap, ~0,
+                             data, pitch, srcIsRoot);
 
         FOR_NSCREENS_BACKWARD(j) {
             stuff->gc = gc->info[j].id;
@@ -1123,14 +1124,63 @@ PanoramiXCopyArea(ClientPtr client)
             }
 
             (*pGC->ops->PutImage) (pDst, pGC, pDst->depth, dstx, dsty,
-                                   stuff->width, stuff->height,
-                                   0, ZPixmap, data);
-
+                                   width, height, 0, ZPixmap, data);
             if (dstShared)
                 break;
         }
-
         free(data);
+
+        if (pGC->graphicsExposures) {
+            RegionRec rgn;
+            int dx, dy;
+            BoxRec sourceBox;
+
+            dx = drawables[0]->x;
+            dy = drawables[0]->y;
+            if (srcIsRoot) {
+                dx += screenInfo.screens[0]->x;
+                dy += screenInfo.screens[0]->y;
+            }
+
+            sourceBox.x1 = min(srcx + dx, 0);
+            sourceBox.y1 = min(srcy + dy, 0);
+            sourceBox.x2 = max(sourceBox.x1 + width, 32767);
+            sourceBox.y2 = max(sourceBox.y1 + height, 32767);
+
+            RegionInit(&rgn, &sourceBox, 1);
+
+            /* subtract the (screen-space) clips of the source drawables */
+            FOR_NSCREENS(j) {
+                ScreenPtr screen = screenInfo.screens[j];
+                RegionPtr sd;
+
+                if (pGC->subWindowMode == IncludeInferiors)
+                    sd = NotClippedByChildren((WindowPtr)drawables[j]);
+                else
+                    sd = &((WindowPtr)drawables[j])->clipList;
+
+                if (srcIsRoot)
+                    RegionTranslate(&rgn, -screen->x, -screen->y);
+
+                RegionSubtract(&rgn, &rgn, sd);
+
+                if (srcIsRoot)
+                    RegionTranslate(&rgn, screen->x, screen->y);
+
+                if (pGC->subWindowMode == IncludeInferiors)
+                    RegionDestroy(sd);
+            }
+
+            /* -dx/-dy to get back to dest-relative, plus request offsets */
+            RegionTranslate(&rgn, -dx + dstx, -dy + dsty);
+
+            /* intersect with gc clip; just one screen is fine because pixmap */
+            RegionIntersect(&rgn, &rgn, pGC->pCompositeClip);
+
+            /* and expose */
+            SendGraphicsExpose(client, &rgn, dst->info[0].id, X_CopyArea, 0);
+            RegionUninit(&rgn);
+        }
     }
     else {
         DrawablePtr pDst = NULL, pSrc = NULL;

Xext/saver.c

@@ -1185,6 +1185,8 @@ ProcScreenSaverUnsetAttributes(ClientPtr client)
         PanoramiXRes *draw;
         int rc, i;
 
+        REQUEST_SIZE_MATCH(xScreenSaverUnsetAttributesReq);
+
         rc = dixLookupResourceByClass((void **) &draw, stuff->drawable,
                                       XRC_DRAWABLE, client, DixWriteAccess);
         if (rc != Success)

Xext/shm.c

@@ -650,9 +650,8 @@ ProcShmGetImage(ClientPtr client)
                wBorderWidth((WindowPtr) pDraw) + (int) pDraw->height)
             return BadMatch;
         visual = wVisual(((WindowPtr) pDraw));
-        pVisibleRegion = NotClippedByChildren((WindowPtr) pDraw);
-        if (pVisibleRegion)
-            RegionTranslate(pVisibleRegion, -pDraw->x, -pDraw->y);
+        if (pDraw->type == DRAWABLE_WINDOW)
+            pVisibleRegion = &((WindowPtr) pDraw)->borderClip;
     }
     else {
         if (stuff->x < 0 ||
@@ -715,9 +714,6 @@ ProcShmGetImage(ClientPtr client)
         }
     }
 
-    if (pVisibleRegion)
-        RegionDestroy(pVisibleRegion);
-
     if (client->swapped) {
         swaps(&xgi.sequenceNumber);
         swapl(&xgi.length);
@@ -1238,6 +1234,7 @@ ProcShmCreateSegment(ClientPtr client)
     };
 
     REQUEST_SIZE_MATCH(xShmCreateSegmentReq);
+    LEGAL_NEW_RESOURCE(stuff->shmseg, client);
     if ((stuff->readOnly != xTrue) && (stuff->readOnly != xFalse)) {
         client->errorValue = stuff->readOnly;
         return BadValue;

Xext/vidmode.c

@@ -454,6 +454,20 @@ ProcVidModeAddModeLine(ClientPtr client)
     DEBUG_P("XF86VidModeAddModeline");
 
     ver = ClientMajorVersion(client);
+
+    if (ver < 2) {
+        REQUEST_AT_LEAST_SIZE(xXF86OldVidModeAddModeLineReq);
+        len =
+            client->req_len -
+            bytes_to_int32(sizeof(xXF86OldVidModeAddModeLineReq));
+    }
+    else {
+        REQUEST_AT_LEAST_SIZE(xXF86VidModeAddModeLineReq);
+        len =
+            client->req_len -
+            bytes_to_int32(sizeof(xXF86VidModeAddModeLineReq));
+    }
+
     if (ver < 2) {
         /* convert from old format */
         stuff = &newstuff;
@@ -501,18 +515,6 @@ ProcVidModeAddModeLine(ClientPtr client)
            stuff->after_vsyncend, stuff->after_vtotal,
            (unsigned long) stuff->after_flags);
 
-    if (ver < 2) {
-        REQUEST_AT_LEAST_SIZE(xXF86OldVidModeAddModeLineReq);
-        len =
-            client->req_len -
-            bytes_to_int32(sizeof(xXF86OldVidModeAddModeLineReq));
-    }
-    else {
-        REQUEST_AT_LEAST_SIZE(xXF86VidModeAddModeLineReq);
-        len =
-            client->req_len -
-            bytes_to_int32(sizeof(xXF86VidModeAddModeLineReq));
-    }
     if (len != stuff->privsize)
         return BadLength;
 
@@ -622,6 +624,20 @@ ProcVidModeDeleteModeLine(ClientPtr client)
     DEBUG_P("XF86VidModeDeleteModeline");
 
     ver = ClientMajorVersion(client);
+
+    if (ver < 2) {
+        REQUEST_AT_LEAST_SIZE(xXF86OldVidModeDeleteModeLineReq);
+        len =
+            client->req_len -
+            bytes_to_int32(sizeof(xXF86OldVidModeDeleteModeLineReq));
+    }
+    else {
+        REQUEST_AT_LEAST_SIZE(xXF86VidModeDeleteModeLineReq);
+        len =
+            client->req_len -
+            bytes_to_int32(sizeof(xXF86VidModeDeleteModeLineReq));
+    }
+
     if (ver < 2) {
         /* convert from old format */
         stuff = &newstuff;
@@ -649,18 +665,6 @@ ProcVidModeDeleteModeLine(ClientPtr client)
            stuff->vdisplay, stuff->vsyncstart, stuff->vsyncend, stuff->vtotal,
            (unsigned long) stuff->flags);
 
-    if (ver < 2) {
-        REQUEST_AT_LEAST_SIZE(xXF86OldVidModeDeleteModeLineReq);
-        len =
-            client->req_len -
-            bytes_to_int32(sizeof(xXF86OldVidModeDeleteModeLineReq));
-    }
-    else {
-        REQUEST_AT_LEAST_SIZE(xXF86VidModeDeleteModeLineReq);
-        len =
-            client->req_len -
-            bytes_to_int32(sizeof(xXF86VidModeDeleteModeLineReq));
-    }
     if (len != stuff->privsize) {
         DebugF("req_len = %ld, sizeof(Req) = %d, privsize = %ld, "
                "len = %d, length = %d\n",
@@ -744,6 +748,20 @@ ProcVidModeModModeLine(ClientPtr client)
     DEBUG_P("XF86VidModeModModeline");
 
     ver = ClientMajorVersion(client);
+
+    if (ver < 2) {
+        REQUEST_AT_LEAST_SIZE(xXF86OldVidModeModModeLineReq);
+        len =
+            client->req_len -
+            bytes_to_int32(sizeof(xXF86OldVidModeModModeLineReq));
+    }
+    else {
+        REQUEST_AT_LEAST_SIZE(xXF86VidModeModModeLineReq);
+        len =
+            client->req_len -
+            bytes_to_int32(sizeof(xXF86VidModeModModeLineReq));
+    }
+
     if (ver < 2) {
         /* convert from old format */
         stuff = &newstuff;
@@ -768,18 +786,6 @@ ProcVidModeModModeLine(ClientPtr client)
            stuff->vdisplay, stuff->vsyncstart, stuff->vsyncend,
            stuff->vtotal, (unsigned long) stuff->flags);
 
-    if (ver < 2) {
-        REQUEST_AT_LEAST_SIZE(xXF86OldVidModeModModeLineReq);
-        len =
-            client->req_len -
-            bytes_to_int32(sizeof(xXF86OldVidModeModModeLineReq));
-    }
-    else {
-        REQUEST_AT_LEAST_SIZE(xXF86VidModeModModeLineReq);
-        len =
-            client->req_len -
-            bytes_to_int32(sizeof(xXF86VidModeModModeLineReq));
-    }
     if (len != stuff->privsize)
         return BadLength;
 
@@ -877,6 +883,19 @@ ProcVidModeValidateModeLine(ClientPtr client)
     DEBUG_P("XF86VidModeValidateModeline");
 
     ver = ClientMajorVersion(client);
+
+    if (ver < 2) {
+        REQUEST_AT_LEAST_SIZE(xXF86OldVidModeValidateModeLineReq);
+        len = client->req_len -
+            bytes_to_int32(sizeof(xXF86OldVidModeValidateModeLineReq));
+    }
+    else {
+        REQUEST_AT_LEAST_SIZE(xXF86VidModeValidateModeLineReq);
+        len =
+            client->req_len -
+            bytes_to_int32(sizeof(xXF86VidModeValidateModeLineReq));
+    }
+
     if (ver < 2) {
         /* convert from old format */
         stuff = &newstuff;
@@ -905,17 +924,6 @@ ProcVidModeValidateModeLine(ClientPtr client)
            stuff->vdisplay, stuff->vsyncstart, stuff->vsyncend, stuff->vtotal,
            (unsigned long) stuff->flags);
 
-    if (ver < 2) {
-        REQUEST_AT_LEAST_SIZE(xXF86OldVidModeValidateModeLineReq);
-        len = client->req_len -
-            bytes_to_int32(sizeof(xXF86OldVidModeValidateModeLineReq));
-    }
-    else {
-        REQUEST_AT_LEAST_SIZE(xXF86VidModeValidateModeLineReq);
-        len =
-            client->req_len -
-            bytes_to_int32(sizeof(xXF86VidModeValidateModeLineReq));
-    }
     if (len != stuff->privsize)
         return BadLength;
 
@@ -1027,6 +1035,20 @@ ProcVidModeSwitchToMode(ClientPtr client)
     DEBUG_P("XF86VidModeSwitchToMode");
 
     ver = ClientMajorVersion(client);
+
+    if (ver < 2) {
+        REQUEST_AT_LEAST_SIZE(xXF86OldVidModeSwitchToModeReq);
+        len =
+            client->req_len -
+            bytes_to_int32(sizeof(xXF86OldVidModeSwitchToModeReq));
+    }
+    else {
+        REQUEST_AT_LEAST_SIZE(xXF86VidModeSwitchToModeReq);
+        len =
+            client->req_len -
+            bytes_to_int32(sizeof(xXF86VidModeSwitchToModeReq));
+    }
+
     if (ver < 2) {
         /* convert from old format */
         stuff = &newstuff;
@@ -1055,18 +1077,6 @@ ProcVidModeSwitchToMode(ClientPtr client)
            stuff->vdisplay, stuff->vsyncstart, stuff->vsyncend, stuff->vtotal,
            (unsigned long) stuff->flags);
 
-    if (ver < 2) {
-        REQUEST_AT_LEAST_SIZE(xXF86OldVidModeSwitchToModeReq);
-        len =
-            client->req_len -
-            bytes_to_int32(sizeof(xXF86OldVidModeSwitchToModeReq));
-    }
-    else {
-        REQUEST_AT_LEAST_SIZE(xXF86VidModeSwitchToModeReq);
-        len =
-            client->req_len -
-            bytes_to_int32(sizeof(xXF86VidModeSwitchToModeReq));
-    }
     if (len != stuff->privsize)
         return BadLength;
 
@@ -1457,6 +1467,7 @@ ProcVidModeSetGammaRamp(ClientPtr client)
     VidModePtr pVidMode;
 
     REQUEST(xXF86VidModeSetGammaRampReq);
+    REQUEST_AT_LEAST_SIZE(xXF86VidModeSetGammaRampReq);
 
     if (stuff->screen >= screenInfo.numScreens)
         return BadValue;

Xext/xres.c

@@ -947,6 +947,8 @@ ProcXResQueryResourceBytes (ClientPtr client)
     ConstructResourceBytesCtx    ctx;
 
     REQUEST_AT_LEAST_SIZE(xXResQueryResourceBytesReq);
+    if (stuff->numSpecs > UINT32_MAX / sizeof(ctx.specs[0]))
+        return BadLength;
     REQUEST_FIXED_SIZE(xXResQueryResourceBytesReq,
                        stuff->numSpecs * sizeof(ctx.specs[0]));
 
@@ -1052,8 +1054,8 @@ SProcXResQueryResourceBytes (ClientPtr client)
     int c;
     xXResResourceIdSpec *specs = (void*) ((char*) stuff + sizeof(*stuff));
 
-    swapl(&stuff->numSpecs);
     REQUEST_AT_LEAST_SIZE(xXResQueryResourceBytesReq);
+    swapl(&stuff->numSpecs);
     REQUEST_FIXED_SIZE(xXResQueryResourceBytesReq,
                        stuff->numSpecs * sizeof(specs[0]));
 

Xext/xvdisp.c

@@ -1493,12 +1493,14 @@ XineramaXvShmPutImage(ClientPtr client)
 {
     REQUEST(xvShmPutImageReq);
     PanoramiXRes *draw, *gc, *port;
-    Bool send_event = stuff->send_event;
+    Bool send_event;
     Bool isRoot;
     int result, i, x, y;
 
     REQUEST_SIZE_MATCH(xvShmPutImageReq);
 
+    send_event = stuff->send_event;
+
     result = dixLookupResourceByClass((void **) &draw, stuff->drawable,
                                       XRC_DRAWABLE, client, DixWriteAccess);
     if (result != Success)

Xi/sendexev.c

@@ -78,7 +78,7 @@ SProcXSendExtensionEvent(ClientPtr client)
 {
     CARD32 *p;
     int i;
-    xEvent eventT;
+    xEvent eventT = { .u.u.type = 0 };
     xEvent *eventP;
     EventSwapPtr proc;
 
@@ -95,9 +95,17 @@ SProcXSendExtensionEvent(ClientPtr client)
 
     eventP = (xEvent *) &stuff[1];
     for (i = 0; i < stuff->num_events; i++, eventP++) {
+        if (eventP->u.u.type == GenericEvent) {
+            client->errorValue = eventP->u.u.type;
+            return BadValue;
+        }
+
         proc = EventSwapVector[eventP->u.u.type & 0177];
-        if (proc == NotImplemented)     /* no swapping proc; invalid event type? */
+        /* no swapping proc; invalid event type? */
+        if (proc == NotImplemented) {
+            client->errorValue = eventP->u.u.type;
             return BadValue;
+        }
         (*proc) (eventP, &eventT);
         *eventP = eventT;
     }
@@ -117,7 +125,7 @@ SProcXSendExtensionEvent(ClientPtr client)
 int
 ProcXSendExtensionEvent(ClientPtr client)
 {
-    int ret;
+    int ret, i;
     DeviceIntPtr dev;
     xEvent *first;
     XEventClass *list;
@@ -141,11 +149,13 @@ ProcXSendExtensionEvent(ClientPtr client)
     /* The client's event type must be one defined by an extension. */
 
     first = ((xEvent *) &stuff[1]);
-    if (!((EXTENSION_EVENT_BASE <= first->u.u.type) &&
-          (first->u.u.type < lastEvent))) {
-        client->errorValue = first->u.u.type;
+    for (i = 0; i < stuff->num_events; i++) {
+        if (!((EXTENSION_EVENT_BASE <= first[i].u.u.type) &&
+            (first[i].u.u.type < lastEvent))) {
+            client->errorValue = first[i].u.u.type;
             return BadValue;
         }
+    }
 
     list = (XEventClass *) (first + stuff->num_events);
     if ((ret = CreateMaskFromList(client, list, stuff->count, tmp, dev,

Xi/xibarriers.c

@@ -830,10 +830,15 @@ SProcXIBarrierReleasePointer(ClientPtr client)
     REQUEST(xXIBarrierReleasePointerReq);
     int i;
 
-    info = (xXIBarrierReleasePointerInfo*) &stuff[1];
-
     swaps(&stuff->length);
+    REQUEST_AT_LEAST_SIZE(xXIBarrierReleasePointerReq);
+
     swapl(&stuff->num_barriers);
+    if (stuff->num_barriers > UINT32_MAX / sizeof(xXIBarrierReleasePointerInfo))
+        return BadLength;
+    REQUEST_FIXED_SIZE(xXIBarrierReleasePointerReq, stuff->num_barriers * sizeof(xXIBarrierReleasePointerInfo));
+
+    info = (xXIBarrierReleasePointerInfo*) &stuff[1];
     for (i = 0; i < stuff->num_barriers; i++, info++) {
         swaps(&info->deviceid);
         swapl(&info->barrier);
@@ -854,6 +859,9 @@ ProcXIBarrierReleasePointer(ClientPtr client)
 
     REQUEST(xXIBarrierReleasePointerReq);
     REQUEST_AT_LEAST_SIZE(xXIBarrierReleasePointerReq);
+    if (stuff->num_barriers > UINT32_MAX / sizeof(xXIBarrierReleasePointerInfo))
+        return BadLength;
+    REQUEST_FIXED_SIZE(xXIBarrierReleasePointerReq, stuff->num_barriers * sizeof(xXIBarrierReleasePointerInfo));
 
     info = (xXIBarrierReleasePointerInfo*) &stuff[1];
     for (i = 0; i < stuff->num_barriers; i++, info++) {

Xi/xichangehierarchy.c

@@ -423,7 +423,7 @@ ProcXIChangeHierarchy(ClientPtr client)
     if (!stuff->num_changes)
         return rc;
 
-    len = ((size_t)stuff->length << 2) - sizeof(xXIAnyHierarchyChangeInfo);
+    len = ((size_t)stuff->length << 2) - sizeof(xXIChangeHierarchyReq);
 
     any = (xXIAnyHierarchyChangeInfo *) &stuff[1];
     while (stuff->num_changes--) {

Xi/xiwarppointer.c

@@ -186,6 +186,10 @@ ProcXIWarpPointer(ClientPtr client)
     pDev->last.valuators[1] = y;
     miPointerUpdateSprite(pDev);
 
+    if (*newScreen->CursorWarpedTo)
+        (*newScreen->CursorWarpedTo) (pDev, newScreen, client,
+                                      dest, pSprite, x, y);
+
     /* FIXME: XWarpPointer is supposed to generate an event. It doesn't do it
        here though. */
     return Success;

composite/compositeext.h

@@ -39,6 +39,8 @@ extern _X_EXPORT Bool CompositeRegisterImplicitRedirectionException(ScreenPtr pS
                                                                     VisualID parentVisual,
                                                                     VisualID winVisual);
 
+
+extern _X_EXPORT Bool compIsAlternateVisual(ScreenPtr pScreen, XID visual);
 extern _X_EXPORT RESTYPE CompositeClientWindowType;
 
 #endif                          /* _COMPOSITEEXT_H_ */

composite/compwindow.c

@@ -320,18 +320,13 @@ compClipNotify(WindowPtr pWin, int dx, int dy)
     }
 }
 
-/*
- * Returns TRUE if the window needs server-provided automatic redirect,
- * which is true if the child and parent aren't both regular or ARGB visuals
- */
-
-static Bool
+Bool
 compIsAlternateVisual(ScreenPtr pScreen, XID visual)
 {
     CompScreenPtr cs = GetCompScreen(pScreen);
     int i;
 
-    for (i = 0; i < cs->numAlternateVisuals; i++)
+    for (i = 0; cs && i < cs->numAlternateVisuals; i++)
         if (cs->alternateVisuals[i] == visual)
             return TRUE;
     return FALSE;

config/udev.c

@@ -134,7 +134,8 @@ device_added(struct udev_device *udev_device)
     }
 #endif
 
-    if (!udev_device_get_property_value(udev_device, "ID_INPUT")) {
+    value = udev_device_get_property_value(udev_device, "ID_INPUT");
+    if (value && !strcmp(value, "0")) {
         LogMessageVerb(X_INFO, 10,
                        "config/udev: ignoring device %s without "
                        "property ID_INPUT set\n", path);
@@ -237,38 +238,36 @@ device_added(struct udev_device *udev_device)
         else if (!strcmp(key, "ID_VENDOR")) {
             LOG_PROPERTY(path, key, value);
             attrs.vendor = strdup(value);
-        }
-        else if (!strcmp(key, "ID_INPUT_KEY")) {
-            LOG_PROPERTY(path, key, value);
-            attrs.flags |= ATTR_KEY;
-        }
-        else if (!strcmp(key, "ID_INPUT_KEYBOARD")) {
-            LOG_PROPERTY(path, key, value);
-            attrs.flags |= ATTR_KEYBOARD;
-        }
-        else if (!strcmp(key, "ID_INPUT_MOUSE")) {
-            LOG_PROPERTY(path, key, value);
-            attrs.flags |= ATTR_POINTER;
-        }
-        else if (!strcmp(key, "ID_INPUT_JOYSTICK")) {
-            LOG_PROPERTY(path, key, value);
-            attrs.flags |= ATTR_JOYSTICK;
-        }
-        else if (!strcmp(key, "ID_INPUT_TABLET")) {
+        } else if (!strncmp(key, "ID_INPUT_", 9)) {
+            const struct pfmap {
+                const char *property;
+                unsigned int flag;
+            } map[] = {
+                { "ID_INPUT_KEY", ATTR_KEY },
+                { "ID_INPUT_KEYBOARD", ATTR_KEYBOARD },
+                { "ID_INPUT_MOUSE", ATTR_POINTER },
+                { "ID_INPUT_JOYSTICK", ATTR_JOYSTICK },
+                { "ID_INPUT_TABLET", ATTR_TABLET },
+                { "ID_INPUT_TABLET_PAD", ATTR_TABLET_PAD },
+                { "ID_INPUT_TOUCHPAD", ATTR_TOUCHPAD },
+                { "ID_INPUT_TOUCHSCREEN", ATTR_TOUCHSCREEN },
+                { NULL, 0 },
+            };
+
+            /* Anything but the literal string "0" is considered a
+             * boolean true. The empty string isn't a thing with udev
+             * properties anyway */
+            if (value && strcmp(value, "0")) {
+                const struct pfmap *m = map;
+
+                while (m->property != NULL) {
+                    if (!strcmp(m->property, key)) {
                         LOG_PROPERTY(path, key, value);
-            attrs.flags |= ATTR_TABLET;
+                        attrs.flags |= m->flag;
                     }
-        else if (!strcmp(key, "ID_INPUT_TABLET_PAD")) {
-            LOG_PROPERTY(path, key, value);
-            attrs.flags |= ATTR_TABLET_PAD;
+                    m++;
                 }
-        else if (!strcmp(key, "ID_INPUT_TOUCHPAD")) {
-            LOG_PROPERTY(path, key, value);
-            attrs.flags |= ATTR_TOUCHPAD;
             }
-        else if (!strcmp(key, "ID_INPUT_TOUCHSCREEN")) {
-            LOG_PROPERTY(path, key, value);
-            attrs.flags |= ATTR_TOUCHSCREEN;
         }
     }
 

configure.ac

@@ -26,9 +26,9 @@ dnl
 dnl Process this file with autoconf to create configure.
 
 AC_PREREQ(2.60)
-AC_INIT([xorg-server], 1.19.3, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
-RELEASE_DATE="2017-03-15"
-RELEASE_NAME="Lobster Bisque"
+AC_INIT([xorg-server], 1.19.6, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
+RELEASE_DATE="2017-12-20"
+RELEASE_NAME="Lousiana Gumbo"
 AC_CONFIG_SRCDIR([Makefile.am])
 AC_CONFIG_MACRO_DIR([m4])
 AM_INIT_AUTOMAKE([foreign dist-bzip2])
@@ -134,7 +134,7 @@ AM_CONDITIONAL(SPECIAL_DTRACE_OBJECTS, [test "x$SPECIAL_DTRACE_OBJECTS" = "xyes"
 AC_HEADER_DIRENT
 AC_HEADER_STDC
 AC_CHECK_HEADERS([fcntl.h stdlib.h string.h unistd.h dlfcn.h stropts.h \
- fnmatch.h sys/mkdev.h sys/utsname.h])
+ fnmatch.h sys/mkdev.h sys/sysmacros.h sys/utsname.h])
 
 dnl Checks for typedefs, structures, and compiler characteristics.
 AC_C_CONST
@@ -2647,6 +2647,7 @@ hw/xfree86/shadowfb/Makefile
 hw/xfree86/vbe/Makefile
 hw/xfree86/vgahw/Makefile
 hw/xfree86/x86emu/Makefile
+hw/xfree86/xkb/Makefile
 hw/xfree86/utils/Makefile
 hw/xfree86/utils/man/Makefile
 hw/xfree86/utils/cvt/Makefile

dbe/dbe.c

@@ -574,6 +574,9 @@ ProcDbeGetVisualInfo(ClientPtr client)
     XdbeScreenVisualInfo *pScrVisInfo;
 
     REQUEST_AT_LEAST_SIZE(xDbeGetVisualInfoReq);
+    if (stuff->n > UINT32_MAX / sizeof(CARD32))
+        return BadLength;
+    REQUEST_FIXED_SIZE(xDbeGetVisualInfoReq, stuff->n * sizeof(CARD32));
 
     if (stuff->n > UINT32_MAX / sizeof(DrawablePtr))
         return BadAlloc;
@@ -924,7 +927,7 @@ SProcDbeSwapBuffers(ClientPtr client)
 
     swapl(&stuff->n);
     if (stuff->n > UINT32_MAX / sizeof(DbeSwapInfoRec))
-        return BadAlloc;
+        return BadLength;
     REQUEST_FIXED_SIZE(xDbeSwapBuffersReq, stuff->n * sizeof(xDbeSwapInfo));
 
     if (stuff->n != 0) {

debian/changelog

+xorg-server (2:1.19.6-1ubuntu2) UNRELEASED; urgency=medium
+
+  * improve-outputclass.diff: Backport commits from upstream to improve
+    OutputClass to support options and overriding primary GPU.
+  * 191-Xorg-add-an-extra-module-path.patch, rules.flags: Drop adding
+    extra-modules dir, not necessary anymore with outputclass additions.
+  * 105_nvidia_autodetect.patch: Dropped, obsolete now.
+  * 188_default_primary_to_first_busid.patch: Dropped, obsolete now.
+
+ -- Timo Aaltonen <tjaalton@debian.org>  Thu, 15 Feb 2018 15:08:45 +0200
+
+xorg-server (2:1.19.6-1ubuntu1) bionic; urgency=medium
+
+  * Merge with Debian.
+  * XShmGetImage_fix_censoring.patch: Dropped, upstream.
+
+ -- Timo Aaltonen <tjaalton@debian.org>  Fri, 26 Jan 2018 17:27:50 +0200
+
+xorg-server (2:1.19.6-1) unstable; urgency=medium
+
+  [ Emilio Pozuelo Monfort ]
+  * Use --sourcedir=debian/tmp/udeb for the udeb package and
+    --sourcedir=debian/tmp/main for the rest, so that we don't have
+    to specify where the files come from as well as where they should
+    be installed to in *.install.
+  * Install xorg-server.pc to a multiarch location. Based on a patch
+    from Helmut Grohne. Closes: #836453.
+  * Move xserver-xorg-legacy to priority optional, as priority extra is
+    deprecated.
+  * Make calculation of xserver-xorg-core's xinput/video ABI provides more
+    robust.
+  * Use ${prefix} rather than ${libexecdir} for --with-module-dir, as the
+    module dir ends up in the pkg-config file, where libexecdir is not
+    defined.
+
+  [ Timo Aaltonen ]
+  * New upstream release.
+  * 07-glx-do-not-pick-srgb-config-for-32bit-rgba-visual.diff: Add a
+    patch from upstream to fix potential issues with mesa git.
+
+ -- Timo Aaltonen <tjaalton@debian.org>  Thu, 18 Jan 2018 14:11:18 +0200
+
+xorg-server (2:1.19.5-1) unstable; urgency=high
+
+  [ Emilio Pozuelo Monfort ]
+  * rules: Try to simplify a bit flags handling and move them
+    to rules.flags.
+  * rules: Remove --disable-silent-rules, dh passes that for us.
+
+  [ Andreas Boll ]
+  * New upstream release.
+    - CVE-2017-12176, CVE-2017-12177, CVE-2017-12178, CVE-2017-12179,
+    - CVE-2017-12180, CVE-2017-12181, CVE-2017-12182, CVE-2017-12183,
+    - CVE-2017-12184, CVE-2017-12185, CVE-2017-12186, CVE-2017-12187
+
+ -- Julien Cristau <jcristau@debian.org>  Fri, 13 Oct 2017 11:28:05 +0200
+
+xorg-server (2:1.19.5-0ubuntu2) artful; urgency=medium
+
+  * Backport upstream patch to fix cropping in XShmGetImage (LP: #1723732).
+
+ -- Dmitry Shachnev <mitya57@ubuntu.com>  Sun, 15 Oct 2017 14:59:53 +0300
+
+xorg-server (2:1.19.5-0ubuntu1) artful; urgency=medium
+
+  * New upstream release
+    - Fix CVE's:
+      CVE-2017-12176, CVE-2017-12177, CVE-2017-12178, CVE-2017-12179,
+      CVE-2017-12180, CVE-2017-12181, CVE-2017-12182, CVE-2017-12183,
+      CVE-2017-12184, CVE-2017-12185, CVE-2017-12186, CVE-2017-12187
+    - Revert a commit that regressed PRIME sync
+    - os: Make sure big requests have sufficient length.
+
+ -- Timo Aaltonen <tjaalton@debian.org>  Fri, 13 Oct 2017 08:46:24 +0300
+
+xorg-server (2:1.19.4-1ubuntu2) artful; urgency=medium
+
+  * xvfb-run: Keep redirecting stderr to stdout, autopkgtests need it.
+
+ -- Timo Aaltonen <tjaalton@debian.org>  Wed, 11 Oct 2017 11:12:57 +0300
+
+xorg-server (2:1.19.4-1ubuntu1) artful; urgency=medium
+
+  * Merge from Debian.
+    - new bugfix release
+
+ -- Timo Aaltonen <tjaalton@debian.org>  Tue, 10 Oct 2017 11:13:48 +0300
+
+xorg-server (2:1.19.4-1) unstable; urgency=medium
+
+  [ Sven Joachim ]
+  * xvfb-run: Do not redirect stderr to stdout when running the program
+    (Closes: #868876, LP: #1059947).
+
+  [ Timo Aaltonen ]
+  * New upstream release. (Closes: #855206, #857983, #860886)
+    - CVE-2017-13721, CVE-2017-13723
+  * rules: Drop dh_strip override, dbgsym transition is done
+    (Closes: #876690).
+  * signing-key.asc: Update Adam Jackson's key.
+
+  [ Julien Cristau ]
+  * Restore definition of DEB_HOST_ARCH_OS in debian/rules, lost in dh
+    conversion (2:1.19.1-1).  Thanks, Helmut Grohne!
+
+ -- Timo Aaltonen <tjaalton@debian.org>  Tue, 10 Oct 2017 00:33:18 +0300
+
+xorg-server (2:1.19.3-2) unstable; urgency=high
+
+  * CVE-2017-10972: information leak out of the X server due to an
+    uninitialized stack area when swapping:
+    - Xi: Zero target buffer in SProcXSendExtensionEvent
+  * CVE-2017-10971: stack overflow due to missing GenericEvent handling in
+    XSendEvent:
+    - dix: Disallow GenericEvent in SendEvent request
+    - Xi: Verify all events in ProcXSendExtensionEvent
+    - Xi: Do not try to swap GenericEvent
+  * With both those fixes, this closes: #867492
+
+ -- Julien Cristau <jcristau@debian.org>  Fri, 07 Jul 2017 07:31:11 +0200
+
+xorg-server (2:1.19.3-1ubuntu7) artful; urgency=medium
+
+  * Sync from xserver-1.19-branch, drop upstreamed patches:
+    CVE-2017-10971-{1,2,3}.patch,
+    CVE-2017-10972.patch,
+    add-cfl-cnl-ids.diff,
+    sync-i965-ids.diff,
+    xwayland-pointer-confine.diff
+
+ -- Timo Aaltonen <tjaalton@debian.org>  Tue, 03 Oct 2017 00:24:32 +0300
+
+xorg-server (2:1.19.3-1ubuntu6) artful; urgency=medium
+
+  * xwayland-add-grab-protocol-support.diff: Dropped, causes issues with
+    kvm. (LP: #1713981)
+
+ -- Timo Aaltonen <tjaalton@debian.org>  Wed, 30 Aug 2017 14:42:05 +0300
+
+xorg-server (2:1.19.3-1ubuntu5) artful; urgency=medium
+
+  * add-cfl-cnl-ids.diff: Add Coffee Lake and Cannonlake pci-ids.
+
+ -- Timo Aaltonen <tjaalton@debian.org>  Mon, 28 Aug 2017 18:44:04 +0300
+
 xorg-server (2:1.19.3-1ubuntu4) artful; urgency=medium
 
   * xwayland-tablet.diff: Add support for Wacom tablets in xwayland.

debian/control

@@ -5,6 +5,7 @@ Maintainer: Ubuntu X-SWAT <ubuntu-x@lists.ubuntu.com>
 XSBC-Original-Maintainer: Debian X Strike Force <debian-x@lists.debian.org>
 Build-Depends:
  debhelper (>= 9),
+ dh-autoreconf,
  po-debconf,
  dpkg-dev (>= 1.16.1),
  quilt,
@@ -384,7 +385,6 @@ Description: Xwayland X server
 
 Package: xserver-xorg-legacy
 Architecture: any
-Priority: extra
 Depends:
  xserver-common (>= ${source:Version}),
  ${shlibs:Depends},

debian/patches/07-glx-do-not-pick-srgb-config-for-32bit-rgba-visual.diff

+commit a13271f2feb6e480b2e698d4efa3b94150a6808b
+Author: Tapani Pälli <tapani.palli@intel.com>
+Date:   Tue Nov 28 09:23:29 2017 +0200
+
+    glx: do not pick sRGB config for 32-bit RGBA visual
+    
+    This fixes blending issues seen with kwin and gnome-shell when
+    32bit visual has sRGB capability set.
+    
+    Reviewed-by: Adam Jackson <ajax@redhat.com>
+    Signed-off-by: Tapani Pälli <tapani.palli@intel.com>
+    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=103699
+    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=103646
+    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=103655
+    (cherry picked from commit c2954b16c8730c7ed8441fd8dba25900f3aed265)
+
+diff --git a/glx/glxscreens.c b/glx/glxscreens.c
+index 29bacd9..62d66bc 100644
+--- a/glx/glxscreens.c
++++ b/glx/glxscreens.c
+@@ -275,6 +275,11 @@ pickFBConfig(__GLXscreen * pGlxScreen, VisualPtr visual)
+         /* If it's the 32-bit RGBA visual, demand a 32-bit fbconfig. */
+         if (visual->nplanes == 32 && config->rgbBits != 32)
+             continue;
++        /* If it's the 32-bit RGBA visual, do not pick sRGB capable config.
++         * This can cause issues with compositors that are not sRGB aware.
++         */
++        if (visual->nplanes == 32 && config->sRGBCapable == GL_TRUE)
++            continue;
+         /* Can't use the same FBconfig for multiple X visuals.  I think. */
+         if (config->visualID != 0)
+             continue;

debian/patches/105_nvidia_autodetect.patch

-Description: Load proprietary drivers automatically when installed.
-Author: Robert Hooker <sarvatt@ubuntu.com>
-
---- a/hw/xfree86/common/xf86AutoConfig.c
-+++ b/hw/xfree86/common/xf86AutoConfig.c
-@@ -76,6 +76,13 @@
- 	"\tDevice\t" BUILTIN_DEVICE_NAME "\n" \
- 	"EndSection\n\n"
- 
-+#define BUILTIN_SCREEN_SECTION_PROPRIETARY \
-+	"Section \"Screen\"\n" \
-+	"\tIdentifier\t" BUILTIN_SCREEN_NAME "\n" \
-+	"\tDevice\t" BUILTIN_DEVICE_NAME "\n" \
-+	"\tDefaultDepth\t24\n" \
-+	"EndSection\n\n"
-+
- #define BUILTIN_LAYOUT_SECTION_PRE \
- 	"Section \"ServerLayout\"\n" \
- 	"\tIdentifier\t\"Builtin Default Layout\"\n"
-@@ -154,7 +161,11 @@ xf86AutoConfig(void)
-     for (p = deviceList; *p; p++) {
-         snprintf(buf, sizeof(buf), BUILTIN_DEVICE_SECTION, *p, 0, *p);
-         AppendToConfig(buf);
--        snprintf(buf, sizeof(buf), BUILTIN_SCREEN_SECTION, *p, 0, *p, 0);
-+        if (strcmp(*p, "nvidia") == 0)
-+            snprintf(buf, sizeof(buf), BUILTIN_SCREEN_SECTION_PROPRIETARY, *p,
-+                     0, *p, 0);
-+        else
-+            snprintf(buf, sizeof(buf), BUILTIN_SCREEN_SECTION, *p, 0, *p, 0);
-         AppendToConfig(buf);
-     }
- 
---- a/hw/xfree86/common/xf86pciBus.c
-+++ b/hw/xfree86/common/xf86pciBus.c
-@@ -1205,6 +1205,7 @@ xf86VideoPtrToDriverList(struct pci_devi
-     {
-         int idx = 0;
- 
-+        driverList[idx++] = "nvidia";
- #ifdef __linux__
-         driverList[idx++] = "nouveau";
- #endif