Xext/shm.c

@@ -834,6 +834,19 @@ ProcPanoramiXShmGetImage(ClientPtr client)
             return BadMatch;
     }
 
+    if (format == ZPixmap) {
+        widthBytesLine = PixmapBytePad(w, pDraw->depth);
+        length = widthBytesLine * h;
+    }
+    else {
+        widthBytesLine = PixmapBytePad(w, 1);
+        lenPer = widthBytesLine * h;
+        plane = ((Mask) 1) << (pDraw->depth - 1);
+        length = lenPer * Ones(planemask & (plane | (plane - 1)));
+    }
+
+    VERIFY_SHMSIZE(shmdesc, stuff->offset, length, client);
+
     drawables = calloc(PanoramiXNumScreens, sizeof(DrawablePtr));
     if (!drawables)
         return BadAlloc;
@@ -856,18 +869,6 @@ ProcPanoramiXShmGetImage(ClientPtr client)
         .depth = pDraw->depth
     };
 
-    if (format == ZPixmap) {
-        widthBytesLine = PixmapBytePad(w, pDraw->depth);
-        length = widthBytesLine * h;
-    }
-    else {
-        widthBytesLine = PixmapBytePad(w, 1);
-        lenPer = widthBytesLine * h;
-        plane = ((Mask) 1) << (pDraw->depth - 1);
-        length = lenPer * Ones(planemask & (plane | (plane - 1)));
-    }
-
-    VERIFY_SHMSIZE(shmdesc, stuff->offset, length, client);
     xgi.size = length;
 
     if (length == 0) {          /* nothing to do */

Xi/xipassivegrab.c

@@ -88,7 +88,7 @@ ProcXIPassiveGrabDevice(ClientPtr client)
     };
     int i, ret = Success;
     uint32_t *modifiers;
-    xXIGrabModifierInfo *modifiers_failed;
+    xXIGrabModifierInfo *modifiers_failed = NULL;
     GrabMask mask = { 0 };
     GrabParameters param;
     void *tmp;
@@ -232,8 +232,8 @@ ProcXIPassiveGrabDevice(ClientPtr client)
     if (rep.num_modifiers)
         WriteToClient(client, rep.length * 4, modifiers_failed);
 
-    free(modifiers_failed);
  out:
+    free(modifiers_failed);
     xi2mask_free(&mask.xi2mask);
     return ret;
 }

composite/compalloc.c

@@ -47,24 +47,18 @@
 
 #include "compint.h"
 
-static void
-compScreenUpdate(ScreenPtr pScreen)
-{
-    compCheckTree(pScreen);
-    compPaintChildrenToWindow(pScreen->root);
-}
-
-static void
-compBlockHandler(ScreenPtr pScreen, void *pTimeout)
+static Bool
+compScreenUpdate(ClientPtr pClient, void *closure)
 {
+    ScreenPtr pScreen = closure;
     CompScreenPtr cs = GetCompScreen(pScreen);
 
-    pScreen->BlockHandler = cs->BlockHandler;
-    compScreenUpdate(pScreen);
-    (*pScreen->BlockHandler) (pScreen, pTimeout);
+    compCheckTree(pScreen);
+    compPaintChildrenToWindow(pScreen->root);
 
-    /* Next damage will restore the block handler */
-    cs->BlockHandler = NULL;
+    /* Next damage will restore the worker */
+    cs->pendingScreenUpdate = FALSE;
+    return TRUE;
 }
 
 void
@@ -87,9 +81,9 @@ compReportDamage(DamagePtr pDamage, RegionPtr pRegion, void *closure)
     CompScreenPtr cs = GetCompScreen(pScreen);
     CompWindowPtr cw = GetCompWindow(pWin);
 
-    if (!cs->BlockHandler) {
-        cs->BlockHandler = pScreen->BlockHandler;
-        pScreen->BlockHandler = compBlockHandler;
+    if (!cs->pendingScreenUpdate) {
+        QueueWorkProc(compScreenUpdate, serverClient, pScreen);
+        cs->pendingScreenUpdate = TRUE;
     }
     cw->damaged = TRUE;
 

composite/compinit.c

@@ -387,6 +387,8 @@ compScreenInit(ScreenPtr pScreen)
     cs->pOverlayWin = NULL;
     cs->pOverlayClients = NULL;
 
+    cs->pendingScreenUpdate = FALSE;
+
     cs->numAlternateVisuals = 0;
     cs->alternateVisuals = NULL;
     cs->numImplicitRedirectExceptions = 0;
@@ -442,8 +444,6 @@ compScreenInit(ScreenPtr pScreen)
     cs->ChangeWindowAttributes = pScreen->ChangeWindowAttributes;
     pScreen->ChangeWindowAttributes = compChangeWindowAttributes;
 
-    cs->BlockHandler = NULL;
-
     cs->CloseScreen = pScreen->CloseScreen;
     pScreen->CloseScreen = compCloseScreen;
 

composite/compint.h

@@ -156,7 +156,8 @@ typedef struct _CompScreen {
      */
     ChangeWindowAttributesProcPtr ChangeWindowAttributes;
 
-    ScreenBlockHandlerProcPtr BlockHandler;
+    Bool pendingScreenUpdate;
+
     CloseScreenProcPtr CloseScreen;
     int numAlternateVisuals;
     VisualID *alternateVisuals;

configure.ac

@@ -26,9 +26,9 @@ dnl
 dnl Process this file with autoconf to create configure.
 
 AC_PREREQ(2.60)
-AC_INIT([xorg-server], 1.20.1, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
-RELEASE_DATE="2018-08-07"
-RELEASE_NAME="Kale Salad"
+AC_INIT([xorg-server], 1.20.3, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
+RELEASE_DATE="2018-10-25"
+RELEASE_NAME="Harissa Roasted Carrots"
 AC_CONFIG_SRCDIR([Makefile.am])
 AC_CONFIG_MACRO_DIR([m4])
 AM_INIT_AUTOMAKE([foreign dist-bzip2])

debian/changelog

+xorg-server (2:1.20.3-1ubuntu1) disco; urgency=medium
+
+  * Merge from Debian.
+    - CVE-2018-14665.patch, dont-init-glamor-on-llvmpipe.diff,
+      prime-sync-refactor.diff: Dropped, upstream.
+
+ -- Timo Aaltonen <tjaalton@debian.org>  Thu, 22 Nov 2018 15:47:34 +0200
+
+xorg-server (2:1.20.3-1) unstable; urgency=medium
+
+  * New upstream release.
+    - Disables -logfile and -modulepath when running with elevated
+      privileges (CVE-2018-14665).
+
+ -- Andreas Boll <aboll@debian.org>  Thu, 25 Oct 2018 20:15:23 +0200
+
+xorg-server (2:1.20.2-1) unstable; urgency=medium
+
+  * New upstream release.
+    - Fixes various crashes with xwayland (Closes: #777625, #881891,
+      #911146).
+    - Fixes a crash when running the X server inside virtualbox
+      (Closes: #911680).
+  * Drop 08_dont-init-glamor-on-llvmpipe.diff, upstream.
+  * Set source format to 1.0.
+
+ -- Andreas Boll <aboll@debian.org>  Thu, 25 Oct 2018 10:19:31 +0200
+
+xorg-server (2:1.20.1-5) unstable; urgency=medium
+
+  [ Timo Aaltonen ]
+  * 08_dont-init-glamor-on-llvmpipe.diff: Glamor shouldn't be used on
+    llvmpipe, as it might end up crashing the server on a racy bootup.
+    (LP: #1792932) (Closes: #907655, #910135)
+
+ -- Andreas Boll <aboll@debian.org>  Wed, 10 Oct 2018 18:23:15 +0200
+
+xorg-server (2:1.20.1-4) unstable; urgency=medium
+
+  [ Julien Cristau ]
+  * Disable libunwind in udeb build.
+  * Disable libunwind backtraces on mips to work around bug#909242.  Thanks,
+    Simon McVittie!
+
+ -- Timo Aaltonen <tjaalton@debian.org>  Wed, 26 Sep 2018 13:20:47 +0300
+
+xorg-server (2:1.20.1-3ubuntu2.1) cosmic-security; urgency=medium
+
+  * SECURITY UPDATE: Privilege escalation and file overwrite
+    - debian/patches/CVE-2018-14665.patch: disable -logfile and -modulepath
+      when running with elevated privileges in
+      hw/xfree86/common/xf86Init.c.
+    - CVE-2018-14665
+
+ -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 25 Oct 2018 10:53:34 -0400
+
 xorg-server (2:1.20.1-3ubuntu2) cosmic; urgency=medium
 
   * dont-init-glamor-on-llvmpipe.diff: Glamor shouldn't be used on

debian/control

@@ -31,7 +31,7 @@ Build-Depends:
  libaudit-dev [linux-any],
  libdrm-dev (>= 2.4.89) [!hurd-i386],
  libgl1-mesa-dev (>= 9.2),
- libunwind-dev [amd64 arm64 armel armhf hppa i386 ia64 mips mips64 mips64el mipsel powerpc powerpcspe ppc64 ppc64el sh4],
+ libunwind-dev [amd64 arm64 armel armhf hppa i386 ia64 mips64 mips64el mipsel powerpc powerpcspe ppc64 ppc64el sh4],
  libxmuu-dev (>= 1:0.99.1),
  libxext-dev (>= 1:0.99.1),
  libx11-dev (>= 2:1.6),

debian/patches/dont-init-glamor-on-llvmpipe.diff

-commit 0a9415cf793babed1f28c61f8047d51de04f1528
-Author: Adam Jackson <ajax@redhat.com>
-Date:   Fri Sep 14 11:33:43 2018 -0400
-
-    glamor_egl: Don't initialize on llvmpipe
-    
-    Mesa started supporting GL_OES_EGL_image on llvmpipe in 17.3, after this
-    commit:
-    
-        commit bbdeddd5fd0b797e1e281f058338b3da4d98029d
-        Author: Gurchetan Singh <gurchetansingh@chromium.org>
-        Date:   Tue Aug 1 14:49:33 2017 -0700
-    
-            st/dri: add drisw image extension
-    
-    That's pretty cool, but it means glamor now thinks it can initialize on
-    llvmpipe. This is almost certainly not what anyone wants, as glamor on
-    llvmpipe is pretty much uniformly slower than fb.
-    
-    This fixes both Xorg and Xwayland to refuse glamor in such a setup.
-    Xephyr is left alone, both because glamor is not the default there and
-    because Xephyr+glamor+llvmpipe is one of the easier ways to get xts to
-    exercise glamor.
-    
-    The (very small) downside of this change is that you lose DRI3 support.
-    This wouldn't have helped you very much (since an lp glamor blit is
-    slower than a pixman blit), but it would eliminate the PutImage overhead
-    for llvmpipe's glXSwapBuffers. A future change should add DRI3 support
-    for the fb-only case.
-    
-    Reviewed-by: Eric Anholt <eric@anholt.net>
-    Signed-off-by: Adam Jackson <ajax@redhat.com>
-
-diff --git a/glamor/glamor_egl.c b/glamor/glamor_egl.c
-index df278b1a1..9b930d603 100644
---- a/glamor/glamor_egl.c
-+++ b/glamor/glamor_egl.c
-@@ -898,6 +898,7 @@ Bool
- glamor_egl_init(ScrnInfoPtr scrn, int fd)
- {
-     struct glamor_egl_screen_private *glamor_egl;
-+    const GLubyte *renderer;
- 
-     glamor_egl = calloc(sizeof(*glamor_egl), 1);
-     if (glamor_egl == NULL)
-@@ -992,6 +993,14 @@ glamor_egl_init(ScrnInfoPtr scrn, int fd)
-                    "Failed to make EGL context current\n");
-         goto error;
-     }
-+
-+    renderer = glGetString(GL_RENDERER);
-+    if (strstr((const char *)renderer, "llvmpipe")) {
-+        xf86DrvMsg(scrn->scrnIndex, X_INFO,
-+                   "Refusing to try glamor on llvmpipe\n");
-+        goto error;
-+    }
-+
-     /*
-      * Force the next glamor_make_current call to set the right context
-      * (in case of multiple GPUs using glamor)
-@@ -1005,7 +1014,7 @@ glamor_egl_init(ScrnInfoPtr scrn, int fd)
-     }
- 
-     xf86DrvMsg(scrn->scrnIndex, X_INFO, "glamor X acceleration enabled on %s\n",
--               glGetString(GL_RENDERER));
-+               renderer);
- 
- #ifdef GBM_BO_WITH_MODIFIERS
-     if (epoxy_has_egl_extension(glamor_egl->display,
-diff --git a/hw/xwayland/xwayland-glamor-gbm.c b/hw/xwayland/xwayland-glamor-gbm.c
-index 06fcf5239..25a354bf7 100644
---- a/hw/xwayland/xwayland-glamor-gbm.c
-+++ b/hw/xwayland/xwayland-glamor-gbm.c
-@@ -843,6 +843,11 @@ xwl_glamor_gbm_init_egl(struct xwl_screen *xwl_screen)
-         goto error;
-     }
- 
-+    if (strstr((const char *)glGetString(GL_RENDERER), "llvmpipe")) {
-+        ErrorF("Refusing to try glamor on llvmpipe\n");
-+        goto error;
-+    }
-+
-     if (!epoxy_has_gl_extension("GL_OES_EGL_image")) {
-         ErrorF("GL_OES_EGL_image not available\n");
-         goto error;

debian/patches/prime-sync-refactor.diff

-commit f79e5368512b72bb463925983d265b070261b7aa
-Author: Jim Qu <Jim.Qu@amd.com>
-Date:   Mon Aug 27 13:37:38 2018 +0800
-
-    modesetting: code refactor for PRIME sync
-    
-    The X will be crashed on the system with other DDX driver,
-    such as amdgpu.
-    
-    show the log like:
-    
-    randr: falling back to unsynchronized pixmap sharing
-    (EE)
-    (EE) Backtrace:
-    (EE) 0: /usr/lib/xorg/Xorg (xorg_backtrace+0x4e)
-    (EE) 1: /usr/lib/xorg/Xorg (0x55cb0151a000+0x1b5ce9)
-    (EE) 2: /lib/x86_64-linux-gnu/libpthread.so.0 (0x7f1587a1d000+0x11390)
-    (EE)
-    (EE) Segmentation fault at address 0x0
-    (EE)
-    
-    The issue is that modesetting as the master, and amdgpu as the slave.
-    Thus, when the master attempts to access pSlavePixPriv in ms_dirty_update(),
-    problems result due to the fact that it's accessing AMD's 'ppriv' using the
-    modesetting structure definition.
-    
-    Apart from fixing crash issue, the patch fix other issue in master interface
-    in which driver should refer to master pixmap.
-    
-    Signed-off-by: Jim Qu <Jim.Qu@amd.com>
-    Reviewed-by: Alex Goins <agoins@nvidia.com>
-
-diff --git a/hw/xfree86/drivers/modesetting/driver.c b/hw/xfree86/drivers/modesetting/driver.c
-index 9362370c3..792dfb655 100644
---- a/hw/xfree86/drivers/modesetting/driver.c
-+++ b/hw/xfree86/drivers/modesetting/driver.c
-@@ -640,19 +640,21 @@ ms_dirty_update(ScreenPtr screen, int *timeout)
-     xorg_list_for_each_entry(ent, &screen->pixmap_dirty_list, ent) {
-         region = DamageRegion(ent->damage);
-         if (RegionNotEmpty(region)) {
--            msPixmapPrivPtr ppriv =
--                msGetPixmapPriv(&ms->drmmode, ent->slave_dst);
-+            if (!screen->isGPU) {
-+                   msPixmapPrivPtr ppriv =
-+                    msGetPixmapPriv(&ms->drmmode, ent->slave_dst->master_pixmap);
- 
--            if (ppriv->notify_on_damage) {
--                ppriv->notify_on_damage = FALSE;
-+                if (ppriv->notify_on_damage) {
-+                    ppriv->notify_on_damage = FALSE;
- 
--                ent->slave_dst->drawable.pScreen->
--                    SharedPixmapNotifyDamage(ent->slave_dst);
--            }
-+                    ent->slave_dst->drawable.pScreen->
-+                        SharedPixmapNotifyDamage(ent->slave_dst);
-+                }
- 
--            /* Requested manual updating */
--            if (ppriv->defer_dirty_update)
--                continue;
-+                /* Requested manual updating */
-+                if (ppriv->defer_dirty_update)
-+                    continue;
-+            }
- 
-             redisplay_dirty(screen, ent, timeout);
-             DamageEmpty(ent->damage);
-@@ -1251,8 +1253,8 @@ msStartFlippingPixmapTracking(RRCrtcPtr crtc, DrawablePtr src,
-     ScreenPtr pScreen = src->pScreen;
-     modesettingPtr ms = modesettingPTR(xf86ScreenToScrn(pScreen));
- 
--    msPixmapPrivPtr ppriv1 = msGetPixmapPriv(&ms->drmmode, slave_dst1),
--                    ppriv2 = msGetPixmapPriv(&ms->drmmode, slave_dst2);
-+    msPixmapPrivPtr ppriv1 = msGetPixmapPriv(&ms->drmmode, slave_dst1->master_pixmap),
-+                    ppriv2 = msGetPixmapPriv(&ms->drmmode, slave_dst2->master_pixmap);
- 
-     if (!PixmapStartDirtyTracking(src, slave_dst1, x, y,
-                                   dst_x, dst_y, rotation)) {
-@@ -1280,10 +1282,10 @@ msStartFlippingPixmapTracking(RRCrtcPtr crtc, DrawablePtr src,
- static Bool
- msPresentSharedPixmap(PixmapPtr slave_dst)
- {
--    ScreenPtr pScreen = slave_dst->drawable.pScreen;
-+    ScreenPtr pScreen = slave_dst->master_pixmap->drawable.pScreen;
-     modesettingPtr ms = modesettingPTR(xf86ScreenToScrn(pScreen));
- 
--    msPixmapPrivPtr ppriv = msGetPixmapPriv(&ms->drmmode, slave_dst);
-+    msPixmapPrivPtr ppriv = msGetPixmapPriv(&ms->drmmode, slave_dst->master_pixmap);
- 
-     RegionPtr region = DamageRegion(ppriv->dirty->damage);
- 
-@@ -1304,8 +1306,8 @@ msStopFlippingPixmapTracking(DrawablePtr src,
-     ScreenPtr pScreen = src->pScreen;
-     modesettingPtr ms = modesettingPTR(xf86ScreenToScrn(pScreen));
- 
--    msPixmapPrivPtr ppriv1 = msGetPixmapPriv(&ms->drmmode, slave_dst1),
--                    ppriv2 = msGetPixmapPriv(&ms->drmmode, slave_dst2);
-+    msPixmapPrivPtr ppriv1 = msGetPixmapPriv(&ms->drmmode, slave_dst1->master_pixmap),
-+                    ppriv2 = msGetPixmapPriv(&ms->drmmode, slave_dst2->master_pixmap);
- 
-     Bool ret = TRUE;
- 
-@@ -1471,7 +1473,7 @@ msRequestSharedPixmapNotifyDamage(PixmapPtr ppix)
-     ScrnInfoPtr scrn = xf86ScreenToScrn(screen);
-     modesettingPtr ms = modesettingPTR(scrn);
- 
--    msPixmapPrivPtr ppriv = msGetPixmapPriv(&ms->drmmode, ppix);
-+    msPixmapPrivPtr ppriv = msGetPixmapPriv(&ms->drmmode, ppix->master_pixmap);
- 
-     ppriv->notify_on_damage = TRUE;
- 

debian/patches/series

@@ -23,6 +23,4 @@ xf86-ignore-conflicting-rr-caps.patch
 
 xi2-resize-touch.patch
 fix-default-permissions.patch
-prime-sync-refactor.diff
 sync-i965-pciids.diff
-dont-init-glamor-on-llvmpipe.diff

debian/rules.flags

@@ -133,9 +133,12 @@ else # hurd
 endif
 
 # some archs don't have libunwind
-ifneq (,$(filter $(DEB_HOST_ARCH), amd64 arm64 armel armhf hppa i386 ia64 mips mips64 mips64el mipsel powerpc powerpcspe ppc64 ppc64el sh4))
+ifneq (,$(filter $(DEB_HOST_ARCH), amd64 arm64 armel armhf hppa i386 ia64 mips64 mips64el mipsel powerpc powerpcspe ppc64 ppc64el sh4))
 	confflags_main += --enable-libunwind
+else
+	confflags_main += --disable-libunwind
 endif
+confflags_udeb += --disable-libunwind
 
 # linux: libdrm needed for kms (hw/xfree86/os-support/linux/lnx_platform.c)
 #        even in udeb

debian/source/format

+1.0

dix/devices.c

@@ -1177,6 +1177,7 @@ RemoveDevice(DeviceIntPtr dev, BOOL sendevent)
             flags[tmp->id] = IsMaster(tmp) ? XIMasterRemoved : XISlaveRemoved;
             CloseDevice(tmp);
             ret = Success;
+            break;
         }
     }
 
@@ -1193,6 +1194,7 @@ RemoveDevice(DeviceIntPtr dev, BOOL sendevent)
                 prev->next = next;
 
             ret = Success;
+            break;
         }
     }
 

dix/inpututils.c

@@ -282,7 +282,7 @@ change_modmap(ClientPtr client, DeviceIntPtr dev, KeyCode *modkeymap,
     else if (!IsFloating(dev) &&
              GetMaster(dev, MASTER_KEYBOARD)->lastSlave == dev) {
         /* If this fails, expect the results to be weird. */
-        if (check_modmap_change(client, dev->master, modmap))
+        if (check_modmap_change(client, dev->master, modmap) == Success)
             do_modmap_change(client, dev->master, modmap);
     }
 

fb/fboverlay.c

@@ -279,11 +279,11 @@ fbOverlayFinishScreenInit(ScreenPtr pScreen,
         (&fbOverlayScreenPrivateKeyRec, PRIVATE_SCREEN, 0))
         return FALSE;
 
-    pScrPriv = malloc(sizeof(FbOverlayScrPrivRec));
-    if (!pScrPriv)
+    if (bpp1 == 24 || bpp2 == 24)
         return FALSE;
 
-    if (bpp1 == 24 || bpp2 == 24)
+    pScrPriv = malloc(sizeof(FbOverlayScrPrivRec));
+    if (!pScrPriv)
         return FALSE;
 
     if (!fbInitVisuals(&visuals, &depths, &nvisuals, &ndepths, &depth1,

glamor/glamor_egl.c

@@ -892,6 +892,7 @@ Bool
 glamor_egl_init(ScrnInfoPtr scrn, int fd)
 {
     struct glamor_egl_screen_private *glamor_egl;
+    const GLubyte *renderer;
 
     glamor_egl = calloc(sizeof(*glamor_egl), 1);
     if (glamor_egl == NULL)
@@ -986,6 +987,19 @@ glamor_egl_init(ScrnInfoPtr scrn, int fd)
                    "Failed to make EGL context current\n");
         goto error;
     }
+
+    renderer = glGetString(GL_RENDERER);
+    if (!renderer) {
+        xf86DrvMsg(scrn->scrnIndex, X_ERROR,
+                   "glGetString() returned NULL, your GL is broken\n");
+        goto error;
+    }
+    if (strstr((const char *)renderer, "llvmpipe")) {
+        xf86DrvMsg(scrn->scrnIndex, X_INFO,
+                   "Refusing to try glamor on llvmpipe\n");
+        goto error;
+    }
+
     /*
      * Force the next glamor_make_current call to set the right context
      * (in case of multiple GPUs using glamor)
@@ -999,7 +1013,7 @@ glamor_egl_init(ScrnInfoPtr scrn, int fd)
     }
 
     xf86DrvMsg(scrn->scrnIndex, X_INFO, "glamor X acceleration enabled on %s\n",
-               glGetString(GL_RENDERER));
+               renderer);
 
 #ifdef GBM_BO_WITH_MODIFIERS
     if (epoxy_has_egl_extension(glamor_egl->display,

glamor/glamor_gradient.c

@@ -38,7 +38,7 @@
 #define RADIAL_SMALL_STOPS (6 + 2)
 #define RADIAL_LARGE_STOPS (16 + 2)
 
-static const char *
+static char *
 _glamor_create_getcolor_fs_source(ScreenPtr screen, int stops_count,
                                   int use_array)
 {
@@ -310,7 +310,7 @@ _glamor_create_radial_gradient_program(ScreenPtr screen, int stops_count,
 	    "}\n"\
 	    "\n"\
             "%s\n" /* fs_getcolor_source */
-    const char *fs_getcolor_source;
+    char *fs_getcolor_source;
 
     glamor_priv = glamor_get_screen_private(screen);
 
@@ -343,6 +343,7 @@ _glamor_create_radial_gradient_program(ScreenPtr screen, int stops_count,
     fs_prog = glamor_compile_glsl_prog(GL_FRAGMENT_SHADER, gradient_fs);
 
     free(gradient_fs);
+    free(fs_getcolor_source);
 
     glAttachShader(gradient_prog, vs_prog);
     glAttachShader(gradient_prog, fs_prog);
@@ -493,7 +494,7 @@ _glamor_create_linear_gradient_program(ScreenPtr screen, int stops_count,
 	    "}\n"\
 	    "\n"\
             "%s" /* fs_getcolor_source */
-    const char *fs_getcolor_source;
+    char *fs_getcolor_source;
 
     glamor_priv = glamor_get_screen_private(screen);
 
@@ -522,6 +523,7 @@ _glamor_create_linear_gradient_program(ScreenPtr screen, int stops_count,
 
     fs_prog = glamor_compile_glsl_prog(GL_FRAGMENT_SHADER, gradient_fs);
     free(gradient_fs);
+    free(fs_getcolor_source);
 
     glAttachShader(gradient_prog, vs_prog);
     glAttachShader(gradient_prog, fs_prog);

glx/createcontext.c

@@ -28,6 +28,7 @@
 #include "glxserver.h"
 #include "glxext.h"
 #include "indirect_dispatch.h"
+#include "opaque.h"
 
 #define ALL_VALID_FLAGS \
     (GLX_CONTEXT_DEBUG_BIT_ARB | GLX_CONTEXT_FORWARD_COMPATIBLE_BIT_ARB \
@@ -320,6 +321,17 @@ __glXDisp_CreateContextAttribsARB(__GLXclientState * cl, GLbyte * pc)
         err = BadAlloc;
     }
     else {
+        /* Only allow creating indirect GLX contexts if allowed by
+         * server command line.  Indirect GLX is of limited use (since
+         * it's only GL 1.4), it's slower than direct contexts, and
+         * it's a massive attack surface for buffer overflow type
+         * errors.
+         */
+        if (!enableIndirectGLX) {
+            client->errorValue = req->isDirect;
+            return BadValue;
+        }
+
         ctx = glxScreen->createContext(glxScreen, config, shareCtx,
                                        req->numAttribs, (uint32_t *) attribs,
                                        &err);

hw/xfree86/common/xf86Config.c

@@ -939,11 +939,13 @@ configServerFlags(XF86ConfFlagsPtr flagsconf, XF86OptionPtr layoutopts)
 	from = X_CMDLINE;
     i = -1;
     if (xf86GetOptValInteger(FlagOptions, FLAG_MAX_CLIENTS, &i)) {
-	if (i != 64 && i != 128 && i != 256 && i != 512)
-		ErrorF("MaxClients must be one of 64, 128, 256 or 512\n");
+        if (Ones(i) != 1 || i < 64 || i > 2048) {
+	    ErrorF("MaxClients must be one of 64, 128, 256, 512, 1024, or 2048\n");
+        } else {
             from = X_CONFIG;
             LimitClients = i;
         }
+    }
     xf86Msg(from, "Max clients allowed: %i, resource mask: 0x%x\n",
 	    LimitClients, RESOURCE_ID_MASK);
 }