dix: set the device transformation matrix

The property handler is registered after setting the property, so
dev->transform remains as all-zeros. That causes pixman_f_transform_invert()
to fail (in transformAbsolute()) and invert remains as garbage. This
may then cause a cursor jump to 0,0.

Since the axes are not yet initialized here and we need to allow for drivers
changing the matrix, we cannot use the property handler for matrix
initialization, essentially duplicating the code.

Triggered by the fix to (#49347) in 749a593e49adccdf1225be28a521412ec85333f4

https://bugzilla.redhat.com/show_bug.cgi?id=852841

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Chase Douglas <chase.douglas@ubuntu.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 3d1051aecbb1955084804133cacd12c7f696833a)
Update changelog
Upload to unstable
Handle failure to create counter in init_system_idle_counter

Check for NULL pointer (which can be returned for multiple reasons)
before trying to dereference it to add privates.   To avoid memory leak
in error path, delay malloc of privates until we're ready to add them.

In case we do return NULL up through SyncInitDeviceIdleTime, handle the
possibility of getting NULL passed back down to SyncRemoveDeviceIdleTime.

As reported by parfait 1.1:
Error: Null pointer dereference (CWE 476)
   Read from null pointer 'idle_time_counter'
        at line 2764 of xserver/Xext/sync.c in function 'init_system_idle_counter'.
          Function 'SyncCreateSystemCounter' may return constant 'NULL' at line 952, called at line 2756.
          Null pointer introduced at line 952 in function 'SyncCreateSystemCounter'.

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Stop leaking overlayWin in PanoramiXCompositeGetOverlayWindow error paths

Found by parfait 1.1 code analyzer:

Error: Memory leak (CWE 401)
   Memory leak of pointer 'overlayWin' allocated with malloc(72)
        at line 806 of composite/compext.c in function 'PanoramiXCompositeGetOverlayWindow'.
          pointer allocated at line 794 with malloc(72).
          <unknown> leaks when rc != 0 at line 804.
        at line 816 of composite/compext.c in function 'PanoramiXCompositeGetOverlayWindow'.
          pointer allocated at line 794 with malloc(72).
          <unknown> leaks when pOc == NULL at line 815.
        at line 825 of composite/compext.c in function 'PanoramiXCompositeGetOverlayWindow'.
          pointer allocated at line 794 with malloc(72).
          <unknown> leaks when cs->pOverlayWin == NULL at line 822
              and compCreateOverlayWindow(pScreen) == 0 at line 823.
        at line 834 of composite/compext.c in function 'PanoramiXCompositeGetOverlayWindow'.
          pointer allocated at line 794 with malloc(72).
          <unknown> leaks when rc != 0 at line 832.

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Free keymap on error in Xephyr's hostx_load_keymap

Found by parfait 1.1 code analyser:
   Memory leak of pointer 'keymap' allocated with XGetKeyboardMapping(HostX.dpy, min_keycode, ((max_keycode - min_keycode) + 1), &host_width)
        at line 861 of hw/kdrive/ephyr/hostx.c in function 'hostx_load_keymap'.
          'keymap' allocated at line 845 with XGetKeyboardMapping(HostX.dpy, min_keycode, ((max_keycode - min_keycode) + 1), &host_width).

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Make xf86ValidateModes actually copy clock range list to screen pointer

Our in-house parfait 1.1 code analysis tool complained that every exit
path from xf86ValidateModes() in hw/xfree86/common/xf86Mode.c leaks the
storeClockRanges allocation made at line 1501 with XNFalloc.

Investigating, it seems that this code to copy the clock range list to
the clockRanges list in the screen pointer is just plain insane, and
according to git, has been since we first imported it from XFree86.

We start at line 1495 by walking the linked list from scrp->clockRanges
until we find the end.  But that was just a diversion, since we've found
the end and immediately forgotten it, and thus at 1499 we know that
storeClockRanges is NULL, but that's not a problem since we're going to
immediately overwrite that value as the first thing in the loop.

So we move on through this loop at 1499, which takes us through the
linked list from the clockRanges variable, and for every entry in
that list allocates a new structure and copies cp to it.  If we've
not filled in the screen's clockRanges pointer yet, we set it to
the first storeClockRanges we copied from cp.   Otherwise, as best
I can tell, we just drop it into memory and let it leak away, as
parfait warned.

And then we hit the loop action, which if we haven't hit the end of
the cp list, advances cp to the next item in the list, and then just
for the fun of it, also sets storeClockRanges to the ->next pointer it
has just copied from cp as well, even though it's going to overwrite
it as the very first instruction in the loop body.

v2: rewritten using nt_list_* macros from Xorg's list.h header

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Avoid NULL pointer dereference in xf86TokenToOptinfo if token not found

Reported by parfait 1.1 code analyzer:

Error: Null pointer dereference (CWE 476)
   Read from null pointer 'p'
        at line 746 of hw/xfree86/common/xf86Option.c in function 'xf86TokenToOptName'.
          Function 'xf86TokenToOptinfo' may return constant 'NULL' at line 721, called at line 745.
          Null pointer introduced at line 721 in function 'xf86TokenToOptinfo'.

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Avoid memory leak on realloc failure in localRegisterFreeBoxCallback

Also avoids leaving invalid pointers in structures if realloc had to
move them elsewhere to make them larger.

Found by parfait 1.1 code analyzer:
   Memory leak of pointer 'newCallbacks' allocated with realloc(((char*)offman->FreeBoxesUpdateCallback), (8 * (offman->NumCallbacks + 1)))
        at line 328 of hw/xfree86/common/xf86fbman.c in function 'localRegisterFreeBoxCallback'.
          'newCallbacks' allocated at line 320 with realloc(((char*)offman->FreeBoxesUpdateCallback), (8 * (offman->NumCallbacks + 1))).
          newCallbacks leaks when newCallbacks != NULL at line 327.
   Memory leak of pointer 'newPrivates' allocated with realloc(((char*)offman->devPrivates), (8 * (offman->NumCallbacks + 1)))
        at line 328 of hw/xfree86/common/xf86fbman.c in function 'localRegisterFreeBoxCallback'.
          'newPrivates' allocated at line 324 with realloc(((char*)offman->devPrivates), (8 * (offman->NumCallbacks + 1))).
          newPrivates leaks when newCallbacks == NULL at line 327.

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
xf86XvMCScreenInit: Avoid leak if dixRegisterPrivateKey fails

Found by parfait 1.1 memory analyser:
   Memory leak of pointer 'pAdapt' allocated with malloc((88 * num_adaptors))
        at line 162 of hw/xfree86/common/xf86xvmc.c in function 'xf86XvMCScreenInit'.
          'pAdapt' allocated at line 158 with malloc((88 * num_adaptors)).

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Avoid memory leak in ddc resort() if find_header() fails

Call find_header first, returning on failure before calling malloc.

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
randr: fix "set but unused" warnings

rrcrtc.c: In function 'RRCrtcDetachScanoutPixmap':
rrcrtc.c:366:9: warning: variable 'ret' set but not used
[-Wunused-but-set-variable]
rrcrtc.c: In function 'rrCheckPixmapBounding':
rrcrtc.c:505:13: warning: variable 'ret' set but not used
[-Wunused-but-set-variable]
rrcrtc.c:445:9: warning: unused variable 'i' [-Wunused-variable]

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Mark Kettenis <kettenis@openbsd.org>
xfree86: drop unused prevSIGIO

Unused as of 5d309af2ed93e91c7d72f548a11052051efbb40f

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Mark Kettenis <kettenis@openbsd.org>
fb: drop two unneeded shadowing variables

fbpict.c: In function 'fbGlyphs':
fbpict.c:188:6: warning: declaration of 'x' shadows a previous local
[-Wshadow]
fbpict.c:111:9: warning: shadowed declaration is here [-Wshadow]
fbpict.c:188:9: warning: declaration of 'y' shadows a previous local
[-Wshadow]
fbpict.c:111:12: warning: shadowed declaration is here [-Wshadow]

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Soren Sandmann <ssp@redhat.com>
Reviewed-by: Mark Kettenis <kettenis@openbsd.org>
Xext: renaming shadowing variable

xvdisp.c: In function 'ProcXvStopVideo':
xvdisp.c:712:11: warning: declaration of 'rc' shadows a previous local
[-Wshadow]
xvdisp.c:705:17: warning: shadowed declaration is here [-Wshadow]

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Mark Kettenis <kettenis@openbsd.org>
Xext: rename two shadowing variables

panoramiX.c: In function 'PanoramiXCreateConnectionBlock':
panoramiX.c:599:10: warning: declaration of 'disableBackingStore' shadows a
global declaration [-Wshadow]
In file included from ../include/windowstr.h:60:0,
                 from panoramiX.c:47:
../include/opaque.h:56:52: warning: shadowed declaration is here [-Wshadow]

panoramiX.c: In function 'PanoramiXConsolidate':
panoramiX.c:834:19: warning: declaration of 'pScreen' shadows a previous
local [-Wshadow]
panoramiX.c:813:15: warning: shadowed declaration is here [-Wshadow]

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Mark Kettenis <kettenis@openbsd.org>
xkb: remove unused variable 'names'

xkb.c: In function '_XkbSetNamesCheck':
xkb.c:3987:18: warning: variable 'names' set but not used
[-Wunused-but-set-variable]

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Mark Kettenis <kettenis@openbsd.org>
xfree86: remove redundant declaration of inputInfo

xf86Cursor.c:19:18: warning: redundant redeclaration of 'inputInfo'
[-Wredundant-decls]
In file included from xf86Cursor.c:18:0:
../../../include/inputstr.h:614:57: note: previous declaration of
'inputInfo' was here

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Mark Kettenis <kettenis@openbsd.org>
Merge branch 'master' of git+ssh://people.freedesktop.org/~alanc/xserver into next
dix: FreeAllAtoms() on reset

==5712== 6 bytes in 1 blocks are still reachable in loss record 17 of 585
==5712==    at 0x4A074CD: malloc (vg_replace_malloc.c:236)
==5712==    by 0x3D1DE885B1: strndup (strndup.c:46)
==5712==    by 0x41CB71: MakeAtom (atom.c:121)
==5712==    by 0x55AE3E: XIGetKnownProperty (xiproperty.c:401)
==5712==    by 0x4251C9: AddInputDevice (devices.c:312)
==5712==    by 0x42AC0C: AllocDevicePair (devices.c:2657)
==5712==    by 0x425E6E: InitCoreDevices (devices.c:677)
==5712==    by 0x5ACA05: main (main.c:257)

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Chase Douglas <chase.douglas@canonical.com>