Skip damage calls if DamageCreate fails in exa functions

Fixes parfait errors such as:
   Null pointer dereference (CWE 476): Write to null pointer pDamage
        at line 1833 of miext/damage/damage.c in function 'DamageRegister'.
          Function DamageCreate may return constant 'NULL' at line 1775,
              called at line 232 of exa/exa_migration_mixed.c
              in function 'exaPrepareAccessReg_mixed'.
          Constant 'NULL' passed into function DamageRegister,
              argument pDamage, from call at line 237.
          Null pointer introduced at line 1775 of miext/damage/damage.c
              in function 'DamageCreate'.
   Null pointer dereference (CWE 476): Write to null pointer pDamage
        at line 1833 of miext/damage/damage.c in function 'DamageRegister'.
          Function DamageCreate may return constant 'NULL' at line 1775,
              called at line 104 of exa/exa_mixed.c
              in function 'exaCreatePixmap_mixed'.
          Constant 'NULL' passed into function DamageRegister,
              argument pDamage, from call at line 109.
          Null pointer introduced at line 1775 of miext/damage/damage.c
              in function 'DamageCreate'.

Checks are similar to handling results of other calls to DamageCreate.

[ This bug was found by the Parfait 1.3.0 bug checking tool.
  http://labs.oracle.com/pls/apex/f?p=labs:49:::::P49_PROJECT_ID:13 ]

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
DMX glxproxy: Don't allocate & copy data just to free it unused

Two functions in the DMX glxproxy code loop over all the backend
screens, starting at the highest numbered and counting down to
the lowest.

Previously, for each screen, the code would allocate a buffer
large enough to read the reply from the backend, copy that reply
into the buffer, and then if it wasn't the final screen, free it.
Only the buffer from the final screen is used, to pass on to the
client in the reply.

This modifies it to just immediately discard the responses from
the screens as we loop through it, only doing the allocate & copy
work for the one buffer we pass back to the client.

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Alex Deucher <aleander.deucher@amd.com>
Update GLX dependencies now that DRI & DRI2 are builtins, not modules

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Avoid use-after-free in dix/dixfonts.c: doImageText() [CVE-2013-4396]

Save a pointer to the passed in closure structure before copying it
and overwriting the *c pointer to point to our copy instead of the
original.  If we hit an error, once we free(c), reset c to point to
the original structure before jumping to the cleanup code that
references *c.

Since one of the errors being checked for is whether the server was
able to malloc(c->nChars * itemSize), the client can potentially pass
a number of characters chosen to cause the malloc to fail and the
error path to be taken, resulting in the read from freed memory.

Since the memory is accessed almost immediately afterwards, and the
X server is mostly single threaded, the odds of the free memory having
invalid contents are low with most malloc implementations when not using
memory debugging features, but some allocators will definitely overwrite
the memory there, leading to a likely crash.

Reported-by: Pedro Ribeiro <pedrib@gmail.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Julien Cristau <jcristau@debian.org>
sync: compress two if statements

No functional changes, just merges a > and == condition into a >= condition.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
sync: always call BracketValues when recalculating upper/lower brackets

Both ServertimeBracketValues and IdleTimeBracketValues copy the value into
there SysCounter privates. Call it for a NULL set as well, so we don't end up
with stale pointers and we can remove the block/wakeup handlers.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
sync: supply the counter from IdleTimeBlockHandler

The main idletime counter has an initialized deviceid, might as well be
supplying it properly. Without this, we'd only ever check the XIAllDevices
counter, so the wait would never be adjusted for the device-specific triggers.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
dix: provide accessor methods for the last device event time

And now that we have the accessors, localize it. No functional changes, just
preparing for a future change.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
sync: if the idle time was reset, force alarms to trigger (#70476)

The time between the idle reset and the IdleTimeWakeupHandler to be called is
indeterminate. Clients with an PositiveTransition or NegativeTransition alarm
on a low threshold may miss an alarm.

Work around this by keeping a reset flag for each device. When the
WakeupHandler triggers and the reset flag is set, we force a re-calculation of
everything and pretend the current idle time is zero. Immediately after is the
next calculation with the real idle time.

Relatively reproducible test case: Set up a XSyncNegativeTransition alarm for
a threshold of 1 ms. May trigger, may not.

X.Org Bug 70476 <http://bugs.freedesktop.org/show_bug.cgi?id=70476>

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
sync: always set the brackets (#59644)

The current code sets bracket_greater to the first trigger after the current
value, and bracket_less to the last trigger before the current value.

For example, the idle timer with three negative and three positive transitions
would set this:

         nt1       nt2                 nt3
|--------|------|--|------- idle --|---|--|-----> t
               pt1                pt2    pt3
bracket_less == nt2
bracket_greater == pt2

This is an optimization so we can skip code paths in the block/wakeup handlers
if the current value doesn't meet any of the trigger requirements. Those
handlers largely do a
   if (bracket_less is less than current value &&
       bracket_greater is greater than current value)
        return, nothing to do

However, unless the bracket values are updated at the correct time, the
following may happen:

                                      nt
|--------------|---------- idle ------|--------> t
               pt

In this case, neither bracket is set, we're past the pos transition and not
yet at the neg transition. idle may now go past nt, but the brackets are not
updated. If idle is then reset to 0, no alarm is triggered for nt. Likewise,
idle may now go past pt and no alarm is triggered.

Changing an alarm or triggering an alarm will re-calculate the brackets, so
this bug is somewhat random. If any other client triggers an alarm when the
brackets are wrongly NULL, the recalculation will set them this bug may not
appear.

This patch changes the behavior, so that the brackets are always the nearest
positive or negative transitions to the current counter value. In the example
above, nt will trigger a wakeup and a re-calculation of the brackets, so that
going past it in the negative direction will then cause the proper alarm
triggers.

Or, in Keith's words:

  Timer currently past a positive trigger
      No bracket values, because no trigger in range

  Timer moves backwards before the positive trigger
      Brackets not reset, even though there is now a trigger in range

  Timer moves forward past the positive trigger
      Trigger doesn't fire because brackets not set

Setting the LT bracket in this case will cause everything to get
re-evaluated when the sync value moves backwards before the trigger
value.

X.Org Bug 59644 <http://bugs.freedesktop.org/show_bug.cgi?id=59644>

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
sync: split updating and triggering a counter up

Now that the brackets are always the nearest change points (regardless of
transition) we need to update the counters whenever we check for any updates.

Otherwise we end up with a situation where counter->value is out of date and
an alarm doesn't trigger because we're still using the value from last time
something actually triggered.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
Merge branch 'xsync-transition-bug-59644' into for-keith
Merge commit '2523a445a09a75a8baf642608d099a5e12d5437f'

This is merging the commits along Peter's for-keith branch, without
also merging in the spurious merge at the top of that branch.
Update to version 1.14.99.3

Signed-off-by: Keith Packard <keithp@keithp.com>
unbreak KdEnableInput

pi = ki = 0 here, so not follow them.

Signed-off-by: Strake <strake888@gmail.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
glx: Add support for the new DRI loader entrypoint.

This is going to be exposed (and not the old entrypoint) for some DRI
drivers once the megadrivers series lands, and the plan is to
eventually transition all drivers to that.  Hopefully this is
unobtrusive enough to merge to stable X servers so that they can be
compatible with new Mesa versions.

v2: typo fix in the comment

Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
glx: Allow float renderType in glXCreateContextAttribsARB

This enables GLX_RGBA_FLOAT_TYPE_ARB and
GLX_RGBA_UNSIGNED_FLOAT_TYPE_EXT as valid renderType parameters to
glXCreateContextAttribsARB.

v2 (idr) : Use C-style comments and fix word wrapping.  Re-write commit
message.

Signed-off-by: Daniel Czarnowski <daniel.czarnowski@intel.com>
Signed-off-by: Ian Romanick <ian.d.romanick@intel.com>
Reviewed-by: Ian Romanick <ian.d.romanick@intel.com>
glx: Correctly set render type enum

The type specified is bits, but the context wants an enum.

v2 (idr): Fix various whitespace and formatting problems.  Rename
convFBconfRenderTypeBits2CtxRenderType to
renderTypeBitsToRenderTypeEnum.  Re-write commit message.

Signed-off-by: Daniel Czarnowski <daniel.czarnowski@intel.com>
Signed-off-by: Ian Romanick <ian.d.romanick@intel.com>
Reviewed-by: Ian Romanick <ian.d.romanick@intel.com>
glx: Handle float config types in glxConvertConfigs

Replaces old use of floatMode attribute with new, extended range of
values in __DRI_ATTRIB_RENDER_TYPE. Also adds new conditions, where the
float modes support requires it. Enables support for not only float
configs, but packed float configs as well.

v2 (idr): Whitespace and formatting fixes.  Refactor render type
vs. pbuffer checking to a separate function that includes a quote from
the spec.  Re-write commit message.  Fix compiler warnings:

glxdricommon.c: In function 'glxConvertConfigs':
glxdricommon.c:212:35: warning: pointer targets in passing argument 3 of 'core->getConfigAttrib' differ in signedness [-Wpointer-sign]
glxdricommon.c:212:35: note: expected 'unsigned int *' but argument is of type 'int *'
glxdricommon.c:230:35: warning: pointer targets in passing argument 3 of 'core->getConfigAttrib' differ in signedness [-Wpointer-sign]
glxdricommon.c:230:35: note: expected 'unsigned int *' but argument is of type 'int *'

Signed-off-by: Daniel Czarnowski <daniel.czarnowski@intel.com>
Signed-off-by: Ian Romanick <ian.d.romanick@intel.com>
Reviewed-by: Ian Romanick <ian.d.romanick@intel.com>
glx: Enable GLX_ARB_fbconfig_float for DRI2 drivers

v2 (idr): Maintain sort order of extension list.  Fixed rebase error
(comment header for initializeExtensions was in front of
__glXDRIinvalidateBuffers).  Re-write commit message.

Signed-off-by: Daniel Czarnowski <daniel.czarnowski@intel.com>
Signed-off-by: Ian Romanick <ian.d.romanick@intel.com>
Reviewed-by: Ian Romanick <ian.d.romanick@intel.com>