Ok, here's what I think we should release as 1.17. I plan on doing that
in a few days (Monday? Tuesday?), unless there's some good reason not
to. Let me know if there's some critical (i.e. crashing) fixes that I've
missed somehow. And, again, I think we can run a shorter 1.18 cycle,
given the pent-up list of fixes.
Sorry for not getting this wrapped up sooner. Turns out that switching
employers takes a bunch of time, especially if you're also busy enjoying
the sunshine in New Zealand.
-keith
Aaron Plattner (2):
xfree86: Bump ABI versions (video: 19, extension: 9)
os: "Server terminated successfully" is not an error
Adam Jackson (17):
mi: Fix regression in arc drawing
render: fix ChangePicture when Xinerama is active (v2) (#49170)
glx: Be more paranoid about variable-length requests [CVE-2014-8093 1/6]
glx: Be more strict about rejecting invalid image sizes [CVE-2014-8093
2/6]
glx: Additional paranoia in __glXGetAnswerBuffer / __GLX_GET_ANSWER_BUFFER
(v2) [CVE-2014-8093 3/6]
glx: Fix image size computation for EXT_texture_integer [CVE-2014-8098
1/8]
glx: Add safe_{add,mul,pad} (v3) [CVE-2014-8093 4/6]
glx: Integer overflow protection for non-generated render requests (v3)
[CVE-2014-8093 5/6]
glx: Length checking for RenderLarge requests (v2) [CVE-2014-8098 3/8]
glx: Top-level length checking for swapped VendorPrivate requests
[CVE-2014-8098 4/8]
glx: Request length checks for SetClientInfoARB [CVE-2014-8098 5/8]
glx: Length-checking for non-generated vendor private requests
[CVE-2014-8098 6/8]
glx: Length checking for non-generated single requests (v2) [CVE-2014-8098
7/8]
glx: Pass remaining request length into ->varsize (v2) [CVE-2014-8098
8/8]
glx: Dynamically compute attribute slot in GetDrawableAttributes
glx: Add hack for GLX-1.2-style naked windows to GetDrawableAttributes
dix: make RegionInit legal C++
Alan Coopersmith (22):
Add -iglx & +iglx to Xserver.man
unchecked malloc may allow unauthed client to crash Xserver
[CVE-2014-8091]
dix: integer overflow in ProcPutImage() [CVE-2014-8092 1/4]
dix: integer overflow in GetHosts() [CVE-2014-8092 2/4]
dix: integer overflow in RegionSizeof() [CVE-2014-8092 3/4]
dix: integer overflow in REQUEST_FIXED_SIZE() [CVE-2014-8092 4/4]
dri2: integer overflow in ProcDRI2GetBuffers() [CVE-2014-8094]
dbe: unvalidated lengths in DbeSwapBuffers calls [CVE-2014-8097]
Xi: unvalidated lengths in Xinput extension [CVE-2014-8095]
xcmisc: unvalidated length in SProcXCMiscGetXIDList() [CVE-2014-8096]
Xv: unvalidated lengths in XVideo extension swapped procs [CVE-2014-8099]
dri3: unvalidated lengths in DRI3 extension swapped procs [CVE-2014-8103
1/2]
present: unvalidated lengths in Present extension procs [CVE-2014-8103
2/2]
randr: unvalidated lengths in RandR extension swapped procs
[CVE-2014-8101]
render: unvalidated lengths in Render extn. swapped procs [CVE-2014-8100
2/2]
xfixes: unvalidated length in SProcXFixesSelectSelectionInput
[CVE-2014-8102]
Add request length checking test cases for some Xinput 1.x requests
Add request length checking test cases for some Xinput 2.x requests
Add REQUEST_FIXED_SIZE testcases to test/misc.c
Solaris: delete undocumented, unuseful -protect0 flag
Move RTLD_DI_SETSIGNAL code into a separate block to quiet warning
Solaris: Move shared declarations to xf86_OSlib.h
Axel Davy (1):
Fix present_notify to return right away when querying current or past msc.
Carl Worth (1):
os/xsha1.c: Add license and copyright attribution.
Carlos Olmedo Escobar (1):
Avoid possible null pointer dereference.
Carlos Sánchez de La Lama (1):
randr: swap num-preferred field on RRGetOutputInfo reply
Chris Wilson (1):
dri2: SourceOffloads may be for DRI3 only
Colin Harrison (1):
hw/xwin: Don't allocate one wchar_t too much for unicode text placed
on the Windows clipboard
Daniel Martin (5):
config/udev: Prefix and shift "removing GPU" message
modesetting: Move Bool glamor into drmmode struct
modesetting: Create new EGL screen in drmmode_xf86crtc_resize
modesetting: Fix ifdefs s/HAVE_UDEV/CONFIG_UDEV_KMS/
modesetting: Remove unused params from drmmode_output_init()
Dave Airlie (2):
glamor: Add an accessor for the GBM device.
glamor: use screen blockhandler rather than dix one (v3)
Dima Ryazanov (1):
Fix "Back", "Forward", and other special mouse buttons
in XWayland.
Jason Ekstrand (4):
modesetting: Refactor drmmode_glamor_new_screen_pixmap
modesetting: Add drmmode_bo_has_bo and drmmode_bo_map helper function
modesetting: Add support for using RandR shadow buffers
modesetting: Return the crtc for a drawable even if it's rotated
Jasper St. Pierre (1):
modesetting: Update the cursor without hiding it
John Hunter (1):
fix an annotation mistake
Jon TURNEY (11):
hw/xwin: Remove some redundant clipboard externs, now defined in
winglobals.h
hw/xwin: In SelectionNotify, delete the property containing returned data
after we have retrieved it
hw/xwin: In SelectionNotify, don't pointlessly retrieve just the size
of the property
hw/xwin: Retrieve TARGETS to avoid unnecessary failing conversion attempts
hw/xwin: Add controls for enabling/disabling monitoring of PRIMARY
selection
hw/xwin: Improve reliability of clipboard X->Windows pastes
hw/xwin: Fix clipboard thread restart
hw/xwin: Fix hang on shutdown when we own the clipboard.
Revert "glx: Simplify glXDestroyContext"
glx: Flush context which is being made non-current due to drawable going
away
glx: Fix crash when a client exits without deleting GL contexts
Julien Cristau (2):
render: check request size before reading it [CVE-2014-8100 1/2]
glx: Length checking for GLXRender requests (v2) [CVE-2014-8098 2/8]
Keith Packard (17):
glamor: Don't insert fbos from external objects into fbo cache
glamor: Always destroy EGL image associated with destroyed pixmap
glamor: Remove redundant reference to screen pixmap EGL image
glamor: Free existing EGL image when assigning new one
dbe: Call to DDX SwapBuffers requires address of int, not unsigned int
[CVE-2014-8097 pt. 2]
glx: Can't mix declarations and code in X.org sources [CVE-2014-8098
pt. 9]
Missing parens in REQUEST_FIXED_SIZE macro [CVE-2014-8092 pt. 5]
dix: GetHosts bounds check using wrong pointer value [CVE-2014-8092 pt. 6]
modesetting: [v2] Don't re-enable the cursor when loading the image
modesetting: Enable Xv when using glamor
modesetting: Fix damage tracking auto-disable code
modesetting: Detect whether damage tracking is needed
glamor: Fix nlines in glamor_xv_put_image when src_y is odd
dix: Allow zero-height PutImage requests
doc: Create a script to filter xmlto output
drivers/modesetting: Save current BlockHandler on return in msBlockHandler
Update to version 1.16.99.902
Kenneth Graunke (13):
modesetting: Stop using glamor_egl_create_textured_screen_ext().
modesetting: Move ModifyPixmapHeader calls out of if/else branches.
modesetting: Create helper for glamor_egl_create_textured_screen call.
modesetting: Move dumb_bo into its own source files.
modesetting: Drop dumb_bo::map_count field and dead unmap code.
modesetting: Create a drmmode_bo wrapper; use it for front_bo.
modesetting: Use GBM for buffer allocations if Glamor supports it.
present: If present_queue_vblank() fails, do present_execute().
modesetting: Track the CRTC's DPMS mode.
modesetting: Check DPMS mode in ms_covering_crtc().
modesetting: Include glamor.h from driver.h.
modesetting: Add vblank synchronization support when using Present.
modesetting: Fix build with --disable-glamor.
Mario Kleiner (2):
present: Avoid crashes in DebugPresent(), a bit more info.
present: Fix use of vsynced pageflips and honor PresentOptionAsync. (v4)
Markus Wick (1):
xwayland: Set glamor filter to nearest
Michel Dänzer (8):
glamor: Reinstate glamor_(egl_)destroy_textured_pixmap
glamor: Fix use-after-free in glamor_destroy_textured_pixmap
glamor: Make glamor_set_pixmap_private not crash if the pixmap has no fbo
glamor: Make glamor_destroy_textured_pixmap idempotent
glamor: Make sure glamor_egl_close_screen wraps glamor_close_screen
glamor: Call glamor_pixmap_destroy_fbo from glamor_set_pixmap_private
glamor: Make glamor_purge_fbo static
glamor: Make sure Xvideo source image data is properly aligned
Michele Baldessari (2):
ephyr: Implement per-screen colormaps
ephyr: Implement per-screen colormaps
Neil Roberts (1):
glx: Add implementation of __GLXContext->loseCurrent for direct ctxts
Olivier Fourdan (3):
Remove explicit dependency on $(WAYLAND_LIBS)
Fix subwindow in Xi emulated events
Synchronize capslock in Xnest and Xephyr
Peter Harris (1):
Fix overflow of ConnectionOutput->size and ->count
Peter Hutterer (13):
include: fix compiler warning about casting int to uint16_t
include: fix documentation for list.h
include: change RegionSize() to take a size_t
Xext: fix clang compiler warning
xfree86: drop double-typedef of DBusConnection
xwayland: declare fatal log handler as noreturn
dix: silence compiler warning
dix: silence compiler warning comparing CARD32 to -1
Drop trailing whitespaces
mi: fix documentation for miPointerSetPosition
dix: offset touch root coordinates by ScreenRec origins (#86655)
xfree86: rename Xorg.bin to Xorg
mi: fix accidental x/y coordinate swap
Robert Morell (1):
glx: Fix mask truncation in __glXGetAnswerBuffer [CVE-2014-8093 6/6]
Thierry Reding (1):
xv: Add missing gcstruct.h include
git tag: xorg-server-1.16.99.902
http://xorg.freedesktop.org/archive/individual/xserver/xorg-server-1.16.99.902.tar.bz2
MD5: 18e5d1dc739e657c785eed848b66ae2a xorg-server-1.16.99.902.tar.bz2
SHA1: a505f971b60e954d72770218de9938c70f557941 xorg-server-1.16.99.902.tar.bz2
SHA256: b25ec3a920d5a7f49ed3c44ec3a2189c333afc974eec6518839a14b968376115
xorg-server-1.16.99.902.tar.bz2
PGP:
http://xorg.freedesktop.org/archive/individual/xserver/xorg-server-1.16.99.902.tar.bz2.sig
http://xorg.freedesktop.org/archive/individual/xserver/xorg-server-1.16.99.902.tar.gz
MD5: da1471e29ed2b61d9d8b9ccf401c3590 xorg-server-1.16.99.902.tar.gz
SHA1: e34708a520d666f22f028464cc518efbcd6b420b xorg-server-1.16.99.902.tar.gz
SHA256: ae7f2737dfc26046142bdd001304bc085ef78306d92524b14cd34fefda661ad2
xorg-server-1.16.99.902.tar.gz
PGP:
http://xorg.freedesktop.org/archive/individual/xserver/xorg-server-1.16.99.902.tar.gz.sig
--
-keith
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 810 bytes
Desc: not available
URL:
<http://lists.x.org/archives/xorg-announce/attachments/20150123/975ddd26/attachment.sig>
