test: include dix-config.h in hashtabletest.c

Missing _XSERVER64 define caused inconsistent sizeof(XID) between the
test and hashtable code, leading to test failures on 64bit big endian
archs like s390x or ppc64.

Signed-off-by: Julien Cristau <jcristau@debian.org>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 930c6ff15d437dfb0f897e8cb4253abba70819cc)
xfree86: improve check for posix saved ids

Replace hardcoded SVR4 || linux || CSRG_BASED with an autoconf check and
the _POSIX_SAVED_IDS macro.

Suggested-by: Mark Kettenis <mark.kettenis@xs4all.nl>
Signed-off-by: Julien Cristau <jcristau@debian.org>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Mark Kettenis <kettenis@openbsd.org>.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit c218ba8423a73a7a643cb17789db8a1dd0901ca6)
dix: add missing include for DeleteWindowFromAnySelections

Fixes build error with XACE disabled:
window.c:886:5: error: implicit declaration of function 'DeleteWindowFromAnySelections' [-Werror=implicit-function-declaration]
     DeleteWindowFromAnySelections(pWin);
     ^

Debian bug#701372

Reported-by: Matthias Klose <doko@debian.org>
Signed-off-by: Julien Cristau <jcristau@debian.org>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit fe7463b8ce0de301c2f82b108c93963424f77219)
Avoid use-after-free in dix/dixfonts.c: doImageText() [CVE-2013-4396]

Save a pointer to the passed in closure structure before copying it
and overwriting the *c pointer to point to our copy instead of the
original.  If we hit an error, once we free(c), reset c to point to
the original structure before jumping to the cleanup code that
references *c.

Since one of the errors being checked for is whether the server was
able to malloc(c->nChars * itemSize), the client can potentially pass
a number of characters chosen to cause the malloc to fail and the
error path to be taken, resulting in the read from freed memory.

Since the memory is accessed almost immediately afterwards, and the
X server is mostly single threaded, the odds of the free memory having
invalid contents are low with most malloc implementations when not using
memory debugging features, but some allocators will definitely overwrite
the memory there, leading to a likely crash.

Reported-by: Pedro Ribeiro <pedrib@gmail.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Julien Cristau <jcristau@debian.org>
Allow disabling XFree86-DGA, DRI, VidModeExtension extensions

Code to recognize these in extension enable/disable options was wrapped
in #ifdef XorgLoader, but that's not defined when building miinitext.c
since the great module merge of 1.13.  Change to an #ifdef that is defined.

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Robert Hooker <robert.hooker@canonical.com>
Reviewed-by: Daniel Stone <daniel@fooishbar.org>
Signed-off-by: Keith Packard <keithp@keithp.com>
Merge commit 'a1985e892f5b5f0959235a631d8bcf676b78bfbc' into server-1.14-branch
test: fix the gcc diagnostics pragma

pop without push restores the commandline options. The proper way is to
push, then ignore, then pop.

And while we're at it, change the pop argument to a comment - pop ignores
the argument, but be proper about it.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit d803f296c616ccf55711cf0af9e7d3eae2edda16)
dix: check for grab type before checking XI2 mask

if the grab type isn't XI2, grab->xi2mask is random. That random data may
have the enter/leave mask set, leading to events sent to the client that the
client can't handler.

Source of these errors:
  _xgeWireToEvent: Unknown extension 131, this should never happen.

Simplest reproducer:
   Start Xephyr, press button inside window, move out. As the pointer leaves
   the Xephyr window, the errors appear.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Adam Jackson <ajax@redhat.com>
(cherry picked from commit 82939e02392cbb880313fe92957091ff89ce2f2b)
Xi: allow for XIAllowEvent requests larger than XI < 2.2 size (#68554)

XIAllowEvents changed length in XI 2.2 (for the touchid). A bug in libXi
causes libXi to always use the new request length if the server supports
2.2, regardless of the client's XIQueryVersion request.

The server takes the client's XIQueryVersion request into account though,
resulting in a BadLength error if a 2.[0,1] client calls XIAllowEvents on a
XI 2.2+ server.

Can't fix this in libXi, so work around this in the server.

X.Org Bug 68554 <http://bugs.freedesktop.org/show_bug.cgi?id=68554>

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Adam Jackson <ajax@redhat.com>
(cherry picked from commit 94d4e29aedc69431fa9b299ca1b67947173d7a24)
DIX/Xi: Pass correct client to CheckDeviceGrabAndHintWindow()

If we have a client which has registered for a DeviceButton grab
be sure to pass this to CheckDeviceGrabAndHintWindow(). Since the
order of clients is arbitrary there is no guarantee that the last
client in the list is the one that belongs to this class.

Signed-off-by: Egbert Eich <eich@freedesktop.org>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 05ea6307fa4f0bee3d3bf536396059f3906791a0)
dix: only allow button and key events to freeze a sync'd pointer

If a client calls XAllowEvents(SyncPointer) it expects events as normal until
the next button press or release event - that freezes the device. An e.g.
proximity event must thus not freeze the pointer.

As per the spec, only button and key events may do so, so narrow it to these
cases.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit be6ea80b79b3d6eb97106ea142e01acbdf059995)
include: change grabtypes to start at 1

Avoid erroneous detection of an unset grabtype as CORE

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 6159811a1aaf848016dbfa7bde68df097027870c)
dix: don't attempt to deliver an event for a different grabtype

For an active grab, grab->eventMask can be either the core or the XI1 mask.
With the overlap of event filters, calling DeliverOneGrabbedEvent(XI1) for a
ProximityOut event will trigger if the client has selected for enter events -
the filter is the same for both.

Thus, we end up delivering a proximity event to a client not expecting one.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 78944d62ffc7fec6f75b6f514ab7a139ba9bc77b)
dix: only deliver for the current grab type

Use the grabtype to determine which type of event to send - all other events
are pointless and may result in erroneous events being delivered.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 7cf1b595c8c8f9776a39559d2878cf90af3f2859)
sync: compress two if statements

No functional changes, just merges a > and == condition into a >= condition.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 5c7cfd4c6978834551848e1be62af240102e39b5)
sync: always call BracketValues when recalculating upper/lower brackets

Both ServertimeBracketValues and IdleTimeBracketValues copy the value into
there SysCounter privates. Call it for a NULL set as well, so we don't end up
with stale pointers and we can remove the block/wakeup handlers.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 2efe49c1029f959fe80879bcf50df42e8b80451d)
sync: supply the counter from IdleTimeBlockHandler

The main idletime counter has an initialized deviceid, might as well be
supplying it properly. Without this, we'd only ever check the XIAllDevices
counter, so the wait would never be adjusted for the device-specific triggers.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit b7c9bd9cf276e92a73be57ff2ed32b47a80f13fb)
dix: provide accessor methods for the last device event time

And now that we have the accessors, localize it. No functional changes, just
preparing for a future change.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit efc1035ca958f2c9d266338a308518a0834b1773)
sync: if the idle time was reset, force alarms to trigger (#70476)

The time between the idle reset and the IdleTimeWakeupHandler to be called is
indeterminate. Clients with an PositiveTransition or NegativeTransition alarm
on a low threshold may miss an alarm.

Work around this by keeping a reset flag for each device. When the
WakeupHandler triggers and the reset flag is set, we force a re-calculation of
everything and pretend the current idle time is zero. Immediately after is the
next calculation with the real idle time.

Relatively reproducible test case: Set up a XSyncNegativeTransition alarm for
a threshold of 1 ms. May trigger, may not.

X.Org Bug 70476 <http://bugs.freedesktop.org/show_bug.cgi?id=70476>

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 06b87aa528d7a739ba20101a1f83b1a428691a01)
sync: always set the brackets (#59644)

The current code sets bracket_greater to the first trigger after the current
value, and bracket_less to the last trigger before the current value.

For example, the idle timer with three negative and three positive transitions
would set this:

         nt1       nt2                 nt3
|--------|------|--|------- idle --|---|--|-----> t
               pt1                pt2    pt3
bracket_less == nt2
bracket_greater == pt2

This is an optimization so we can skip code paths in the block/wakeup handlers
if the current value doesn't meet any of the trigger requirements. Those
handlers largely do a
   if (bracket_less is less than current value &&
       bracket_greater is greater than current value)
        return, nothing to do

However, unless the bracket values are updated at the correct time, the
following may happen:

                                      nt
|--------------|---------- idle ------|--------> t
               pt

In this case, neither bracket is set, we're past the pos transition and not
yet at the neg transition. idle may now go past nt, but the brackets are not
updated. If idle is then reset to 0, no alarm is triggered for nt. Likewise,
idle may now go past pt and no alarm is triggered.

Changing an alarm or triggering an alarm will re-calculate the brackets, so
this bug is somewhat random. If any other client triggers an alarm when the
brackets are wrongly NULL, the recalculation will set them this bug may not
appear.

This patch changes the behavior, so that the brackets are always the nearest
positive or negative transitions to the current counter value. In the example
above, nt will trigger a wakeup and a re-calculation of the brackets, so that
going past it in the negative direction will then cause the proper alarm
triggers.

Or, in Keith's words:

  Timer currently past a positive trigger
      No bracket values, because no trigger in range

  Timer moves backwards before the positive trigger
      Brackets not reset, even though there is now a trigger in range

  Timer moves forward past the positive trigger
      Trigger doesn't fire because brackets not set

Setting the LT bracket in this case will cause everything to get
re-evaluated when the sync value moves backwards before the trigger
value.

X.Org Bug 59644 <http://bugs.freedesktop.org/show_bug.cgi?id=59644>

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit e57ec99b03b2ad840c384a97ab2766ce9da0f5cc)