rpms/xorg-x11-server/F-8 xserver-1.3.0-render-traps-crash.patch, NONE, 1.1 xorg-x11-server.spec, 1.276, 1.277 xserver-1.3.0-randr-updates.patch, 1.2, 1.3 xserver-1.3.0-xrandr-timestamp-buglet.patch, 1.1, 1.2

[Adam Jackson (ajax)]

Author: ajax

Update of /cvs/pkgs/rpms/xorg-x11-server/F-8
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv16479

Modified Files:
	xorg-x11-server.spec xserver-1.3.0-randr-updates.patch 
	xserver-1.3.0-xrandr-timestamp-buglet.patch 
Added Files:
	xserver-1.3.0-render-traps-crash.patch 
Log Message:
* Thu Jul 24 2008 Adam Jackson <ajax at redhat.com> 1.3.0.0-47
- xserver-1.3.0-render-traps-crash.patch: Fix a crash in Render trapezoid
  rasterisation. (#455209)


xserver-1.3.0-render-traps-crash.patch:

--- NEW FILE xserver-1.3.0-render-traps-crash.patch ---
diff -up xorg-server-1.3.0.0/fb/fbtrap.c.jx xorg-server-1.3.0.0/fb/fbtrap.c
--- xorg-server-1.3.0.0/fb/fbtrap.c.jx	2006-11-16 13:01:23.000000000 -0500
+++ xorg-server-1.3.0.0/fb/fbtrap.c	2008-07-24 10:14:16.000000000 -0400
@@ -115,6 +115,9 @@ fbRasterizeTrapezoid (PicturePtr    pPic
     RenderEdge	l, r;
     xFixed	t, b;
     
+    if (!xTrapezoidValid (trap))
+	return;
+
     fbGetDrawable (pPicture->pDrawable, buf, stride, bpp, pxoff, pyoff);
 
     width = pPicture->pDrawable->width;
diff -up xorg-server-1.3.0.0/render/renderedge.c.jx xorg-server-1.3.0.0/render/renderedge.c
--- xorg-server-1.3.0.0/render/renderedge.c.jx	2006-06-06 13:13:55.000000000 -0400
+++ xorg-server-1.3.0.0/render/renderedge.c	2008-07-24 10:13:48.000000000 -0400
@@ -143,6 +143,7 @@ RenderEdgeInit (RenderEdge	*e,
     dx = x_bot - x_top;
     dy = y_bot - y_top;
     e->dy = dy;
+    e->dx = 0
     if (dy)
     {
 	if (dx >= 0)


Index: xorg-x11-server.spec
===================================================================
RCS file: /cvs/pkgs/rpms/xorg-x11-server/F-8/xorg-x11-server.spec,v
retrieving revision 1.276
retrieving revision 1.277
diff -u -r1.276 -r1.277
--- xorg-x11-server.spec	11 Jun 2008 23:37:18 -0000	1.276
+++ xorg-x11-server.spec	24 Jul 2008 14:26:24 -0000	1.277
@@ -9,7 +9,7 @@
 Summary:   X.Org X11 X server
 Name:      xorg-x11-server
 Version:   1.3.0.0
-Release:   46%{?dist}
+Release:   47%{?dist}
 URL:       http://www.x.org
 License:   MIT
 Group:     User Interface/X
@@ -110,6 +110,8 @@
 Patch3009:  cve-2008-2360.patch
 Patch3010:  cve-2008-2361.patch
 Patch3011:  cve-2008-2362.patch
+# technically CVE-2007-2437, but it's DoS only so don't glorify it.
+Patch3012:  xserver-1.3.0-render-traps-crash.patch
 
 %define moduledir	%{_libdir}/xorg/modules
 %define drimoduledir	%{_libdir}/dri
@@ -399,6 +401,7 @@
 %patch3009 -p1 -b .cve-2008-2360
 %patch3010 -p1 -b .cve-2008-2361
 %patch3011 -p1 -b .cve-2008-2362
+%patch3012 -p1 -b .render-traps-crash
 
 %build
 
@@ -667,6 +670,10 @@
 
 
 %changelog
+* Thu Jul 24 2008 Adam Jackson <ajax at redhat.com> 1.3.0.0-47
+- xserver-1.3.0-render-traps-crash.patch: Fix a crash in Render trapezoid
+  rasterisation. (#455209)
+
 * Thu Jun 12 2008 Dave Airlie <airlied at redhat.com> 1.3.0.0-46
 - cve-2008-1377.patch: Record and Security Extension Input validation
 - cve-2008-1379.patch: MIT-SHM extension Input Validation flaw

xserver-1.3.0-randr-updates.patch:


xserver-1.3.0-xrandr-timestamp-buglet.patch: