This commit was manufactured by cvs2svn to create branch 'netbsd-4-0'.
Pull up following revision(s) (requested by tron in ticket #1047):
	xsrc/xfree/xc/lib/font/bitmap/pcfread.c: revision 1.3
Apply security fix for CVE-2008-0006.
Pull up following revision(s) (requested by snj in ticket #1359):
	xfree/xc/extras/expat/lib/xmltok_impl.c: revision 1.2
Apply revisions 1.14 and 1.15 from expat CVS to fix SA36425.
Pull up following revision(s) (requested by tron in ticket #1383):
	xsrc/xfree/xc/extras/expat/lib/xmlparse.c: revision 1.2
Add patch from upstream CVS to fix CVE-2009-3560 (possible DOS due to
crash on bad input).
Apply patch (requested by mrg in ticket #1426):
Fix CVE-2011-0465
Pull up following revision(s) (requested by joerg in ticket #1433):
	usr.bin/compress/zopen.c: revision 1.14-1.15
	xfree/xc/lib/font/fontfile/decompress.c: revision 1.2
	xfree/xc/extras/freetype2/src/lzw/zopen.c: revision 1.2
	usr.bin/gzip/zuncompress.c: revision 1.9-1.11

Fix CVS-2011-2895, buffer overflow in decompress
provisional fix for CVS-2011-2895, buffer overflow when uncompressing
provisional fix for CVE-2011-2895, buffer overflow in decompression
set errno on overflow return.
Do proper input validation without penalizing performance.
Do proper input validation. Allow decompressing all input streams.
Increase robustness of LZW decoding to avoid buffer overflow on
arbitrary manipulated input streams in combination with uninitalised
memory.
Increase strictness of LZW parser.
Pull up following revision(s) (requested by joerg in ticket #1433):
	Additional pullup to fix build on some architectures
	xfree/xc/extras/freetype2/src/lzw/zopen.c: revision 1.3
Don't assign errno here.