Imported nxagent-3.2.0-10.tar.gz

nx-X11/programs/Xserver/hw/nxagent/Args.c

@@ -2080,8 +2080,8 @@ void nxagentSetDeferLevel()
 
       deferTimeout = 200;
 
-      tileWidth  = 65536;
-      tileHeight = 65536;
+      tileWidth  = 4096;
+      tileHeight = 4096;
 
       break;
     }
@@ -2091,8 +2091,8 @@ void nxagentSetDeferLevel()
 
       deferTimeout = 200;
 
-      tileWidth  = 65536;
-      tileHeight = 65536;
+      tileWidth  = 4096;
+      tileHeight = 4096;
 
       break;
     }
@@ -2103,8 +2103,8 @@ void nxagentSetDeferLevel()
 
       deferTimeout = 200;
 
-      tileWidth  = 65536;
-      tileHeight = 65536;
+      tileWidth  = 4096;
+      tileHeight = 4096;
 
       break;
     }

nx-X11/programs/Xserver/hw/nxagent/Atoms.c

@@ -78,6 +78,7 @@ static char *nxagentAtomNames[NXAGENT_NUMBER_OF_ATOMS + 1] =
   "NXDARWIN",             /* 9  */
   "CLIPBOARD",            /* 10 */
   "TIMESTAMP",            /* 11 */
+  "UTF8_STRING",          /* 12 */
   NULL,
   NULL
 };

nx-X11/programs/Xserver/hw/nxagent/Atoms.h

@@ -22,7 +22,7 @@
 #include "../../include/window.h"
 #include "screenint.h"
 
-#define NXAGENT_NUMBER_OF_ATOMS  13
+#define NXAGENT_NUMBER_OF_ATOMS  14
 
 extern Atom nxagentAtoms[NXAGENT_NUMBER_OF_ATOMS];
 

nx-X11/programs/Xserver/hw/nxagent/CHANGELOG

 ChangeLog:
 
+nxagent-3.2.0-10
+
+- Extended fix for TR07F02091 to include font names having zero in
+  fields RESOLUTION_X and RESOLUTION_Y.
+
+nxagent-3.2.0-9
+
+- Fixed TR07F02091. Scalable fonts were not correctly listed among
+  available fonts.
+
+- Fixed TR06F02080. Use the corrupted area extents as maximum size of
+  the image data.
+
+nxagent-3.2.0-8
+
+- Fixed TR07F02082. The agent server could be unable to init core
+  keyboard on 64 bit systems.
+
+nxagent-3.2.0-7
+
+- Imported patch fixing issues from  X.Org security advisory, June
+  11th, 2008: Multiple vulnerabilities in X server extensions. CVE
+  IDs: CVE-2008-1377, CVE-2008-1379, CVE-2008-2360, CVE-2008-2361,
+  CVE-2008-2362.
+
+nxagent-3.2.0-6
+
+- Fixed TR05F02063. Ignore ReparentNotify events for non-rootless
+  sessions.
+
+- Fixed TR06F02068. Try to pack images only if format is ZPixmap.
+
+- Don't require reparent on close of NX window.
+
+nxagent-3.2.0-5
+
+- Fixed TR04F02044. Restored the original MakeRootTile() function in
+  order to create the root window background pixmap.
+
+- Fixed TR04F02041. Gnome panels stayed on top of the NX session win-
+  dow with desktops running Compiz. This fix provides a solution for
+  the Fullscreen mode.
+
+- Improved for the shadow session the handling of master session win-
+  dow resize.
+
+nxagent-3.2.0-4
+
+- Fixed TR10D01535. The agent window is not minimized anymore when
+  pointer leaves.
+
+- Changes aimed to avoid possible type mismatch in XDisplay struct
+  on 64 bit architectures.
+
+nxagent-3.2.0-3
+
+- Fixed a build issue on Solaris.
+
+nxagent-3.2.0-2
+
+- Code clean up. Moved a variable definition to the beginnning of a
+  block.
+
+nxagent-3.2.0-1
+
+- Opened the 3.2.0 branch based on nxagent-3.1.0-9.
+
+nxagent-3.1.0-9
+
+- Fixed TR03F02025. German umlauts couldn't be pasted into a remote
+  Windows application. Now also the UTF8_STRING target is available
+  for ConvertSelection requests.
+
+- Fixed TR03F02031. Moved SetScreenSaverTimer() call in order to avoid
+  undesired reset of the auto-disconnect timeout when a screen saver
+  turns on.
+
+nxagent-3.1.0-8
+
+- Added reference to fixed TR02F02007 and TR07E01762 in the CHANGELOG.
+
+- Set the GC trap before calling fbPolySegment.
+
+- Fixed TR09E01863. A flag is set if a resource has been added or fre-
+  ed and it is checked in FindClientResourcesByType().
+
+- Added void entries to nxagentRequestLiteral vector in order to avoid
+  a wrong string is printed to the output for NoOperation request.
+
+- Fixed TR11E01948. Now keyboard status is initialized again after
+  the NX session is reconnected. This avoids CAPS LOCK and NUM LOCK
+  synchronization problems.
+
+- Added nxagentXkbCapsTrap and nxagentXkbNumTrap to avoid CAPS LOCK
+  and NUM LOCK synchronization problems when CAPS LOCK or NUM LOCK is
+  the first key to be pressed in the NX session.
+
+- Corrected subSize variable initialization in nxagentRealizeImage().
+
+- Fixed various memory leaks.
+
+- Fixed TR11E01950. Copy and paste via edit menu didn't work for some
+  applications.
+
+- Corrected property type in nxagentRequestSelection(). Some external
+  applications didn't enable their paste button when nxagent was the
+  owner of the CLIPBOARD selection.
+
+- Added struct to save values queried by XQueryExtension for XFixes
+  extension.
+
 nxagent-3.1.0-7
 
 - Imported patch fixing issues from  X.Org security advisory, January
@@ -7,8 +118,8 @@ nxagent-3.1.0-7
   CVE-2007-5760    CVE-2007-5958    CVE-2007-6427   CVE-2007-6428
   CVE-2007-6429    CVE-2008-0006.
 
-- Handled the case if nxagentCreateDrawableBitmap() fails to create
-  the pixmap intended to store the bitmap data.
+- Fixed TR02F02007. Handled the case if nxagentCreateDrawableBitmap()
+  fails to create the pixmap intended to store the bitmap data.
 
 nxagent-3.1.0-6
 
@@ -81,7 +192,7 @@ nxagent-3.0.0-90
 - Fixed TR11E01930. If the defer level is set by means of the command
   line, the DeferLevel option is not reset while resuming the session.
 
-- Fixed string comparison in the font replacement routine.
+- Fixed TR07E01762. Problem in comparison of font names.
 
 - Printed the new geometry in the session log when the agent screen is
   resized.

nx-X11/programs/Xserver/hw/nxagent/Clipboard.c

@@ -31,6 +31,10 @@
 #include "Rootless.h"
 #include "Clipboard.h"
 
+#include "gcstruct.h"
+#include "xfixeswire.h"
+#include <X11/extensions/Xfixes.h>
+
 /*
  * Use asyncronous get property replies.
  */
@@ -115,15 +119,24 @@ static Time   lastServerTime;
 
 static Atom serverTARGETS;
 static Atom serverTEXT;
+static Atom serverUTF8_STRING;
 static Atom clientTARGETS;
 static Atom clientTEXT;
 static Atom clientCOMPOUND_TEXT;
+static Atom clientUTF8_STRING;
 
 static char szAgentTARGETS[] = "TARGETS";
 static char szAgentTEXT[] = "TEXT";
 static char szAgentCOMPOUND_TEXT[] = "COMPOUND_TEXT";
+static char szAgentUTF8_STRING[] = "UTF8_STRING";
 static char szAgentNX_CUT_BUFFER_CLIENT[] = "NX_CUT_BUFFER_CLIENT";
 
+/*
+ * Save the values queried from X server.
+ */
+
+XFixesAgentInfoRec nxagentXFixesInfo = { -1, -1, -1, 0 };
+
 extern Display *nxagentDisplay;
 
 Bool nxagentValidServerTargets(Atom target);
@@ -299,7 +312,7 @@ FIXME: Do we need this?
       result = XChangeProperty (nxagentDisplay,
                                 X->xselectionrequest.requestor,
                                 X->xselectionrequest.property,
-                                X->xselectionrequest.target,
+                                XInternAtom(nxagentDisplay, "ATOM", 0),
                                 sizeof(Atom)*8,
                                 PropModeReplace,
                                 (unsigned char*)&xa_STRING,
@@ -1178,19 +1191,20 @@ int nxagentConvertSelection(ClientPtr client, WindowPtr pWin, Atom selection,
 
   if (target == clientTARGETS)
   {
-    Atom xa_STRING[3];
+    Atom xa_STRING[4];
     xEvent x;
 
     xa_STRING[0] = XA_STRING;
     xa_STRING[1] = clientTEXT;
     xa_STRING[2] = clientCOMPOUND_TEXT;
+    xa_STRING[3] = clientUTF8_STRING;
 
     ChangeWindowProperty(pWin,
                          property,
-                         target,
+                         MakeAtom("ATOM", 4, 1),
                          sizeof(Atom)*8,
                          PropModeReplace,
-                         3,
+                         4,
                          &xa_STRING, 1);
 
     x.u.u.type = SelectionNotify;
@@ -1264,7 +1278,10 @@ int nxagentConvertSelection(ClientPtr client, WindowPtr pWin, Atom selection,
     }
   }
 
-  if ((target == clientTEXT) || (target == XA_STRING) || (target == clientCOMPOUND_TEXT))
+  if ((target == clientTEXT) ||
+          (target == XA_STRING) ||
+              (target == clientCOMPOUND_TEXT) ||
+                  (target == clientUTF8_STRING))
   {
     lastClientWindowPtr = pWin;
     lastClientStage = SelectionStageNone;
@@ -1283,8 +1300,16 @@ int nxagentConvertSelection(ClientPtr client, WindowPtr pWin, Atom selection,
       selection = lastSelectionOwner[nxagentClipboardSelection].selection;
     }
 
-    XConvertSelection(nxagentDisplay, selection, XA_STRING, serverCutProperty,
-                         serverWindow, CurrentTime);
+    if (target == clientUTF8_STRING)
+    {
+      XConvertSelection(nxagentDisplay, selection, serverUTF8_STRING, serverCutProperty,
+                           serverWindow, CurrentTime);
+    }
+    else
+    {
+      XConvertSelection(nxagentDisplay, selection, XA_STRING, serverCutProperty,
+                           serverWindow, CurrentTime);
+    }
 
     #ifdef DEBUG
     fprintf(stderr, "nxagentConvertSelection: Sent XConvertSelection with target=[%s], property [%s]\n",
@@ -1465,6 +1490,7 @@ int nxagentInitClipboard(WindowPtr pWin)
   serverCutProperty = nxagentAtoms[5];  /* NX_CUT_BUFFER_SERVER */
   serverTARGETS = nxagentAtoms[6];  /* TARGETS */
   serverTEXT = nxagentAtoms[7];  /* TEXT */
+  serverUTF8_STRING = nxagentAtoms[12]; /* UTF8_STRING */
 
   if (serverCutProperty == None)
   {
@@ -1482,6 +1508,29 @@ int nxagentInitClipboard(WindowPtr pWin)
 
   XSetSelectionOwner(nxagentDisplay, serverCutProperty, iWindow, CurrentTime);
 
+  if (XQueryExtension(nxagentDisplay,
+                      "XFIXES",
+                      &nxagentXFixesInfo.Opcode,
+                      &nxagentXFixesInfo.EventBase,
+                      &nxagentXFixesInfo.ErrorBase) == 0)
+  {
+    ErrorF("Unable to initialize XFixes extension.\n");
+  }
+
+  else
+  {
+    #ifdef TEST
+    fprintf(stderr, "nxagentInitClipboard: Registering for XFixesSelectionNotify events.\n");
+    #endif
+
+    XFixesSelectSelectionInput(nxagentDisplay, iWindow, nxagentClipboardAtom,
+                               XFixesSetSelectionOwnerNotifyMask |
+                               XFixesSelectionWindowDestroyNotifyMask |
+                               XFixesSelectionClientCloseNotifyMask);
+
+    nxagentXFixesInfo.Initialized = 1;
+  }
+
   if (nxagentSessionId[0])
   {
     #ifdef TEST
@@ -1525,6 +1574,7 @@ int nxagentInitClipboard(WindowPtr pWin)
     clientTARGETS = MakeAtom(szAgentTARGETS, strlen(szAgentTARGETS), True);
     clientTEXT = MakeAtom(szAgentTEXT, strlen(szAgentTEXT), True);
     clientCOMPOUND_TEXT = MakeAtom(szAgentCOMPOUND_TEXT, strlen(szAgentCOMPOUND_TEXT), True);
+    clientUTF8_STRING = MakeAtom(szAgentUTF8_STRING, strlen(szAgentUTF8_STRING), True);
 
     if (clientCutProperty == None)
     {

nx-X11/programs/Xserver/hw/nxagent/Clipboard.h

@@ -19,6 +19,21 @@
 #define __Clipboard_H__
 
 /*
+ * Queried at clipboard initialization.
+ */
+
+typedef struct _XFixesAgentInfo
+{
+  int Opcode;
+  int EventBase;
+  int ErrorBase;
+  int Initialized;
+
+} XFixesAgentInfoRec;
+
+extern XFixesAgentInfoRec nxagentXFixesInfo;
+
+/*
  * Create the NX_CUT_BUFFER_CLIENT atom and
  * initialize the required property to exchange
  * data with the X server.

nx-X11/programs/Xserver/hw/nxagent/Display.c

@@ -123,12 +123,12 @@ static enum
 } reconnectDisplayState;
 
 int nxagentDefaultVisualIndex;
-Colormap *nxagentDefaultColormaps;
+Colormap *nxagentDefaultColormaps = NULL;
 int nxagentNumDefaultColormaps;
-int *nxagentDepths;
+int *nxagentDepths = NULL;
 int nxagentNumDepths;
-XPixmapFormatValues *nxagentPixmapFormats;
-XPixmapFormatValues *nxagentRemotePixmapFormats;
+XPixmapFormatValues *nxagentPixmapFormats = NULL;
+XPixmapFormatValues *nxagentRemotePixmapFormats = NULL;
 int nxagentNumPixmapFormats;
 int nxagentRemoteNumPixmapFormats;
 Pixel nxagentBlackPixel;
@@ -2500,6 +2500,25 @@ Bool nxagentReconnectDisplay(void *p0)
   }
 
   /*
+   * nxagentPixmapFormats and nxagentRemotePixmapFormats
+   * will be reallocated in nxagentInitPixmapFormats().
+   */
+
+  if (nxagentPixmapFormats != NULL)
+  {
+    XFree(nxagentPixmapFormats);
+
+    nxagentPixmapFormats = NULL;
+  }
+
+  if (nxagentRemotePixmapFormats != NULL)
+  {
+    XFree(nxagentRemotePixmapFormats);
+
+    nxagentRemotePixmapFormats = NULL;
+  }
+
+  /*
    * Check if all the required pixmap
    * formats are supported.
    */

nx-X11/programs/Xserver/hw/nxagent/Drawable.c

@@ -371,6 +371,7 @@ int nxagentSynchronizeRegion(DrawablePtr pDrawable, RegionPtr pRegion, unsigned
   int nBox;
   int x, y;
   int w, h;
+  int extentWidth, extentHeight;
   int tileWidth, tileHeight;
   int length, format, leftPad;
   int i;
@@ -590,8 +591,20 @@ int nxagentSynchronizeRegion(DrawablePtr pDrawable, RegionPtr pRegion, unsigned
               pDrawable -> x, pDrawable -> y, pDrawable -> width, pDrawable -> height);
   #endif
 
-  w = tileWidth  = (nxagentOption(TileWidth)  > pDrawable -> width  ? pDrawable -> width  : nxagentOption(TileWidth));
-  h = tileHeight = (nxagentOption(TileHeight) > pDrawable -> height ? pDrawable -> height : nxagentOption(TileHeight));
+  /*
+   * We are going to synchronize the corrupted
+   * area, so we use the corrupted extents as
+   * maximum size of the image data. It's im-
+   * portant to avoid using the drawable size,
+   * because in case of a huge window it had to
+   * result in a failed data memory allocation.
+   */
+
+  extentWidth  = clipRegion -> extents.x2 - clipRegion -> extents.x1;
+  extentHeight = clipRegion -> extents.y2 - clipRegion -> extents.y1;
+
+  w = tileWidth  = (nxagentOption(TileWidth)  > extentWidth  ? extentWidth  : nxagentOption(TileWidth));
+  h = tileHeight = (nxagentOption(TileHeight) > extentHeight ? extentHeight : nxagentOption(TileHeight));
 
   #ifdef DEBUG
   fprintf(stderr, "nxagentSynchronizeRegion: Using tiles of size [%dx%d].\n", tileWidth, tileHeight);
@@ -2613,7 +2626,10 @@ void nxagentCreateDrawableBitmap(DrawablePtr pDrawable)
    * FIXME: A better way it would be create the bitmap
    * with the same extents of the clipRegion. This
    * requires to save the offset with respect to the
-   * drawable origin like in the backing store.
+   * drawable origin like in the backing store. This
+   * becomes particularly important when the drawable
+   * is a huge window, because the pixmap creation
+   * would fail.
    */
 
   pBitmap = nxagentCreatePixmap(pDrawable -> pScreen, pDrawable -> width, pDrawable -> height, pDrawable -> depth);

nx-X11/programs/Xserver/hw/nxagent/Events.c

@@ -22,6 +22,7 @@
 #include "Xproto.h"
 #include "screenint.h"
 #include "input.h"
+#include "dix.h"
 #include "misc.h"
 #include "scrnintstr.h"
 #include "windowstr.h"
@@ -61,6 +62,9 @@
 #include "NXvars.h"
 #include "NXproto.h"
 
+#include "xfixesproto.h"
+#include <X11/extensions/Xfixes.h>
+
 #ifdef NXAGENT_FIXKEYS
 #include "inputstr.h"
 #include "input.h"
@@ -113,6 +117,15 @@ extern int nxagentLastClipboardClient;
 extern Bool nxagentRootlessTreesMatch(void);
 #endif
 
+extern Selection *CurrentSelections;
+extern int NumCurrentSelections;
+
+typedef union _XFixesSelectionEvent {
+        int                          type;
+        XFixesSelectionNotifyEvent   xfixesselection;
+        XEvent                       core;
+} XFixesSelectionEvent;
+
 Bool   xkbdRunning = False;
 pid_t  pidkbd;
 
@@ -742,7 +755,19 @@ void nxagentDispatchEvents(PredicateFuncPtr predicate)
 
         if (nxagentXkbState.Initialized == 0)
         {
+          if (X.xkey.keycode == 66)
+          {
+            nxagentXkbCapsTrap = 1;
+          }
+          else if (X.xkey.keycode == 77)
+          {
+            nxagentXkbNumTrap = 1;
+          }
+
           nxagentInitKeyboardState();
+
+          nxagentXkbCapsTrap = 0;
+          nxagentXkbNumTrap = 0;
         }
 
         x.u.u.type = KeyRelease;
@@ -1283,10 +1308,6 @@ void nxagentDispatchEvents(PredicateFuncPtr predicate)
                       X.xcrossing.mode == NotifyNormal)
           {
             nxagentUngrabPointerAndKeyboard(&X);
-
-            pScreen = nxagentScreen(X.xcrossing.window);
-
-            minimize = True;
           }
         }
 
@@ -1610,7 +1631,7 @@ void nxagentDispatchEvents(PredicateFuncPtr predicate)
          * state modification event.
          */
 
-        if (nxagentHandleKeyboardEvent(&X) == 0)
+        if (nxagentHandleKeyboardEvent(&X) == 0 && nxagentHandleXFixesSelectionNotify(&X) == 0)
         {
           #ifdef TEST
           fprintf(stderr, "nxagentDispatchEvents: WARNING! Unhandled event code [%d].\n",
@@ -1805,7 +1826,19 @@ int nxagentHandleKeyPress(XEvent *X, enum HandleEventResult *result)
 
   if (nxagentXkbState.Initialized == 0)
   {
+    if (X -> xkey.keycode == 66)
+    {
+      nxagentXkbCapsTrap = 1;
+    }
+    else if (X -> xkey.keycode == 77)
+    {
+      nxagentXkbNumTrap = 1;
+    }
+
     nxagentInitKeyboardState();
+
+    nxagentXkbCapsTrap = 0;
+    nxagentXkbNumTrap = 0;
   }
 
   if (nxagentCheckSpecialKeystroke(&X -> xkey, result))
@@ -2228,7 +2261,11 @@ int nxagentHandleClientMessageEvent(XEvent *X, enum HandleEventResult *result)
         {
           pScreen = nxagentScreen(X -> xmap.window);
 
-          nxagentMaximizeToFullScreen(pScreen);
+          XMapRaised(nxagentDisplay, nxagentFullscreenWindow);
+
+          XIconifyWindow(nxagentDisplay, nxagentIconWindow,
+                             DefaultScreen(nxagentDisplay));
+
         }
 
         if (X -> xclient.window == (nxagentOption(Fullscreen) ?
@@ -2273,7 +2310,10 @@ int nxagentHandleKeyboardEvent(XEvent *X)
       fprintf(stderr, "nxagentHandleKeyboardEvent: Sending fake key [66] to engage capslock.\n");
       #endif
 
-      nxagentSendFakeKey(66);
+      if (!nxagentXkbCapsTrap)
+      {
+        nxagentSendFakeKey(66);
+      }
     }
 
     if (nxagentXkbState.Caps == 1 &&
@@ -2288,6 +2328,18 @@ int nxagentHandleKeyboardEvent(XEvent *X)
       nxagentSendFakeKey(66);
     }
 
+    if (nxagentXkbState.Caps == 0 &&
+          !(nxagentXkbState.Locked & CAPSFLAG_IN_EVENT) &&
+              nxagentXkbCapsTrap)
+    {
+
+      #ifdef TEST
+      fprintf(stderr, "nxagentHandleKeyboardEvent: Sending fake key [66] to release capslock.\n");
+      #endif
+
+      nxagentSendFakeKey(66);
+    }
+
     if (nxagentXkbState.Num == 0 &&
             (nxagentXkbState.Locked & NUMFLAG_IN_EVENT))
     {
@@ -2297,7 +2349,10 @@ int nxagentHandleKeyboardEvent(XEvent *X)
       fprintf(stderr, "nxagentHandleKeyboardEvent: Sending fake key [77] to engage numlock.\n");
       #endif
 
-      nxagentSendFakeKey(77);
+      if (!nxagentXkbNumTrap)
+      {
+        nxagentSendFakeKey(77);
+      }
     }
 
     if (nxagentXkbState.Num == 1 &&
@@ -2312,12 +2367,95 @@ int nxagentHandleKeyboardEvent(XEvent *X)
       nxagentSendFakeKey(77);
     }
 
+    if (nxagentXkbState.Num == 0 &&
+          !(nxagentXkbState.Locked & NUMFLAG_IN_EVENT) &&
+              nxagentXkbNumTrap)
+    {
+
+      #ifdef TEST
+      fprintf(stderr, "nxagentHandleKeyboardEvent: Sending fake key [77] to release numlock.\n");
+      #endif
+
+      nxagentSendFakeKey(77);
+    }
+
     return 1;
   }
 
   return 0;
 }
 
+int nxagentHandleXFixesSelectionNotify(XEvent *X)
+{
+  int i;
+  Atom local;
+
+  XFixesSelectionEvent *xfixesEvent = (XFixesSelectionEvent *) X;
+
+  if (nxagentXFixesInfo.Initialized == 0 ||
+          xfixesEvent -> type != (nxagentXFixesInfo.EventBase + XFixesSelectionNotify))
+    return 0;
+
+  #ifdef TEST
+  fprintf(stderr, "nxagentHandleXFixesSelectionNotify: Handling event.\n");
+  #endif
+
+  local = nxagentRemoteToLocalAtom(xfixesEvent -> xfixesselection.selection);
+
+  if (SelectionCallback)
+  {
+    i = 0;
+
+    while ((i < NumCurrentSelections) &&
+            CurrentSelections[i].selection != local)
+      i++;
+
+    if (i < NumCurrentSelections)
+    {
+      SelectionInfoRec    info;
+
+      if (CurrentSelections[i].client != 0)
+      {
+        #ifdef TEST
+        fprintf(stderr, "nxagentHandleXFixesSelectionNotify: Do nothing.\n");
+        #endif
+
+        return 1;
+      }
+
+      #ifdef TEST
+      fprintf(stderr, "nxagentHandleXFixesSelectionNotify: Calling callbacks for %d [%s] selection.\n",
+                       CurrentSelections[i].selection, NameForAtom(CurrentSelections[i].selection));
+      #endif
+
+      #ifdef DEBUG
+      fprintf(stderr, "nxagentHandleXFixesSelectionNotify: Subtype ");
+
+      switch (xfixesEvent -> xfixesselection.subtype)
+      {
+        case SelectionSetOwner:
+          fprintf(stderr, "SelectionSetOwner.\n");
+          break;
+        case SelectionWindowDestroy:
+          fprintf(stderr, "SelectionWindowDestroy.\n");
+          break;
+        case SelectionClientClose:
+          fprintf(stderr, "SelectionClientClose.\n");
+          break;
+        default:
+          fprintf(stderr, ".\n");
+          break;
+      }
+      #endif
+
+      info.selection = &CurrentSelections[i];
+      info.kind = xfixesEvent->xfixesselection.subtype;
+      CallCallbacks(&SelectionCallback, &info);
+    }
+  }
+  return 1;
+}
+
 int nxagentHandleProxyEvent(XEvent *X)
 {
   switch (X -> xclient.data.l[0])
@@ -2924,56 +3062,6 @@ int nxagentHandleReparentNotify(XEvent* X)
 
     return 1;
   }
-  else
-  {
-    /*
-     * This code is supposed to detect if a window manager
-     * is running but in some cases it may be unreliable.
-     * Each window manager behaves differently so the check
-     * can fail for some less common WMs.
-     */
-
-    if (!nxagentWMIsRunning && nxagentOption(Fullscreen) &&
-            X -> xreparent.window == nxagentDefaultWindows[pScreen -> myNum])
-    {
-      #ifdef WARNING
-      fprintf(stderr, "Warning: The agent window was reparented. Is a "
-                  "window manager running?\n");
-      #endif
-
-      /*
-       * If no window manager is running and we are supposed to
-       * be in fullscreen mode then don't wait for the reparent
-       * event. We can assume that there is an undetected window
-       * manager and, as switching to fullscreen could have fail-
-       * ed, we try it again.
-       */
-
-      nxagentSwitchFullscreen(pScreen, True);
-
-      nxagentWMIsRunning = True;
-    }
-    else if (nxagentWMIsRunning && X -> xreparent.window ==
-                 nxagentDefaultWindows[pScreen -> myNum] && X -> xreparent.parent ==
-                     RootWindow(nxagentDisplay, (pScreen -> myNum)))
-    {
-      #ifdef WARNING
-
-      fprintf(stderr, "Warning: The agent window has been reparented to the root.\n");
-
-      fprintf(stderr, "Warning: No window manager seems to be running.\n");
-
-      #endif
-
-      /*
-       * The agent window was unexpectedly reparented
-       * to the root window. We assume that the window
-       * manager was terminated.
-       */
-
-      nxagentWMIsRunning = False;
-    }
-  }
 
   return 1;
 }

nx-X11/programs/Xserver/hw/nxagent/Events.h

@@ -115,6 +115,7 @@ extern int nxagentHandlePropertyNotify(XEvent *X);
 extern int nxagentHandleKeyPress(XEvent *X, enum HandleEventResult*);
 extern int nxagentHandleReparentNotify(XEvent *X);
 extern int nxagentHandleConfigureNotify(XEvent *X);
+extern int nxagentHandleXFixesSelectionNotify(XEvent *X);
 
 /*
  * Send a fake keystroke to the remote

nx-X11/programs/Xserver/hw/nxagent/Font.c

@@ -101,6 +101,8 @@ static XFontStruct *nxagentLoadQueryFont(register Display *dpy , char *fontName
 int nxagentFreeFont(XFontStruct *fs);
 static Bool nxagentGetFontServerPath(char * fontServerPath);
 
+static char * nxagentMakeScalableFontName(const char *fontName, int scalableResolution);
+
 RESTYPE RT_NX_FONT;
 
 #ifdef NXAGENT_RECONNECT_FONT_DEBUG
@@ -419,13 +421,59 @@ Bool nxagentFontFind(const char *name, int *pos)
 Bool nxagentFontLookUp(const char *name)
 {
   int i;
-  if (name)
-    if (!strlen(name))
-       return 0;
-  if (nxagentFontFind(name, &i))
-    return (nxagentRemoteFontList.list[i]->status > 0);
-  else
+  int result;
+
+  char *scalable;
+
+  if (name != NULL && strlen(name) == 0)
+  {
+    return 0;
+  }
+
+  result = nxagentFontFind(name, &i);
+
+  scalable = NULL;
+
+  /*
+   * Let's try with the scalable font description.
+   */
+
+  if (result == 0)
+  {
+    scalable = nxagentMakeScalableFontName(name, 0); 
+
+    if (scalable != NULL)
+    {
+      result = nxagentFontFind(scalable, &i);
+
+      free(scalable);
+    }
+  }
+
+  /*
+   * Let's try again after replacing zero to xdpi and ydpi in the pattern.
+   */
+
+  if (result == 0)
+  {
+    scalable = nxagentMakeScalableFontName(name, 1); 
+
+    if (scalable != NULL)
+    {
+      result = nxagentFontFind(scalable, &i);
+
+      free(scalable);
+    }
+  }
+
+  if (result == 0)
+  {
     return 0;
+  }
+  else
+  {
+    return (nxagentRemoteFontList.list[i]->status > 0);
+  }
 }
 
 Bool nxagentRealizeFont(ScreenPtr pScreen, FontPtr pFont)
@@ -768,6 +816,11 @@ static XFontStruct *nxagentLoadBestQueryFont(Display* dpy, char *fontName, FontP
         fprintf(stderr, "nxagentLoadBestQueryFont: Weight '%d' of more accurate font '%s' .\n", weight, substFontBuf);
         #endif
       }
+
+      for (j = 0; j < numSearchFields; j++)
+      {
+        free (searchFields[j]);
+      }
     }
   }
 
@@ -783,6 +836,11 @@ static XFontStruct *nxagentLoadBestQueryFont(Display* dpy, char *fontName, FontP
 
   free (substFontBuf);
 
+  for (j = 0; j < numFontFields; j++)
+  {
+    free (fontNameFields[j]);
+  }
+
   return fontStruct;
 }
 
@@ -1688,3 +1746,88 @@ int nxagentSplitString(char *string, char *fields[], int nfields, char *sep)
   return i;
 }
 
+char *nxagentMakeScalableFontName(const char *fontName, int scalableResolution)
+{
+  char *scalableFontName;
+  const char *s;
+  int len;
+  int field;
+
+  len = strlen(fontName) + 1;
+
+  scalableFontName = malloc(len);
+
+  if (scalableFontName == NULL)
+  {
+    #ifdef PANIC
+    fprintf(stderr, "nxagentMakeScalableFontName: PANIC! malloc() failed.\n");
+    #endif
+
+    return NULL;
+  }
+
+  scalableFontName[0] = 0;
+
+  if (*fontName != '-')
+  {
+    goto MakeScalableFontNameError;
+  }
+
+  s = fontName;
+
+  field = 0;
+
+  while (s != NULL)
+  {
+    s = strchr(s + 1, '-');
+
+    if (s != NULL)
+    {
+      if (field == 6 || field == 7 || field == 11)
+      {
+        /*
+         * PIXEL_SIZE || POINT_SIZE || AVERAGE_WIDTH
+         */
+
+        strcat(scalableFontName, "-0");
+      }
+      else if (scalableResolution == 1 && (field == 8 || field == 9))
+      {
+        /*
+         * RESOLUTION_X || RESOLUTION_Y
+         */
+
+        strcat(scalableFontName, "-0");
+      }
+      else
+      {
+        strncat(scalableFontName, fontName, s - fontName);
+      }
+
+      fontName = s;
+    }
+    else
+    {
+      strcat(scalableFontName, fontName);
+    }
+
+    field++;
+  }
+
+  if (field != 14)
+  {
+    goto MakeScalableFontNameError;
+  }
+
+  return scalableFontName;
+
+MakeScalableFontNameError:
+
+  free(scalableFontName);
+
+  #ifdef DEBUG
+  fprintf(stderr, "nxagentMakeScalableFontName: Invalid font name.\n");
+  #endif
+
+  return NULL;
+}

nx-X11/programs/Xserver/hw/nxagent/GCOps.c

@@ -451,6 +451,8 @@ FIXME: The popup could be synchronized with one
 
       CARD32 targetAttributes[2];
 
+      Bool pClipRegionFree = True;
+
       /*
        * As we want to copy only the synchronized
        * areas of the source drawable, we create
@@ -503,6 +505,13 @@ FIXME: The popup could be synchronized with one
 
         nxagentChangeClip(targetGC, CT_REGION, pClipRegion, 0);
 
+        /*
+         * Next call to nxagentChangeClip() will destroy
+         * pClipRegion, so it has not to be freed.
+         */
+
+        pClipRegionFree = False;
+
         #ifdef DEBUG
         fprintf(stderr, "nxagentDeferCopyArea: Going to execute a copy area with clip mask "
                     "[%d,%d,%d,%d] and origin [%d,%d].\n", ((RegionPtr) targetGC -> clientClip) -> extents.x1,
@@ -518,6 +527,11 @@ FIXME: The popup could be synchronized with one
 
       nxagentChangeClip(targetGC, CT_NONE, NullRegion, 0);
 
+      if (pClipRegionFree == True)
+      {
+        nxagentFreeRegion(pSrcDrawable, pClipRegion);
+      }
+
       FreeScratchGC(targetGC);
     }
     else
@@ -1184,7 +1198,9 @@ void nxagentPolySegment(DrawablePtr pDrawable, GCPtr pGC,
                     (XSegment *) pSegments, nSegments);
     }
 
+    SET_GC_TRAP();
     fbPolySegment(nxagentVirtualDrawable(pDrawable), pGC, nSegments, pSegments);
+    RESET_GC_TRAP();
 
     return;
   }
@@ -1193,7 +1209,9 @@ void nxagentPolySegment(DrawablePtr pDrawable, GCPtr pGC,
     XDrawSegments(nxagentDisplay, nxagentDrawable(pDrawable), nxagentGC(pGC),
                  (XSegment *) pSegments, nSegments);
 
+    SET_GC_TRAP();
     fbPolySegment(pDrawable, pGC, nSegments, pSegments);
+    RESET_GC_TRAP();
   }
 }
 

nx-X11/programs/Xserver/hw/nxagent/Handlers.c

@@ -33,6 +33,7 @@
 #include "Millis.h"
 
 #include "NXlib.h"
+#include "Shadow.h"
 
 /*
  * Set here the required log level.
@@ -705,6 +706,7 @@ void nxagentShadowBlockHandler(pointer data, struct timeval **timeout, pointer m
   int changed;
   int suspended = 0;
   int result;
+  int width_, height_;
 
   #ifdef BLOCKS
   fprintf(stderr, "[Begin block]\n");
@@ -754,6 +756,19 @@ void nxagentShadowBlockHandler(pointer data, struct timeval **timeout, pointer m
 
   changed = 0;
 
+  NXShadowGetScreenSize(&width_, &height_);
+
+  if (width_ != nxagentShadowWidth || height_ != nxagentShadowHeight)
+  {
+    /*
+     * The master session has been resized.
+     */
+
+    NXShadowSetScreenSize(&nxagentShadowWidth, &nxagentShadowHeight);
+
+    nxagentShadowAdaptToRatio();
+  }
+
   nxagentShadowPoll(nxagentShadowPixmapPtr, nxagentShadowGCPtr, nxagentShadowDepth, nxagentShadowWidth,
                         nxagentShadowHeight, nxagentShadowBuffer, &changed, &suspended);
 

nx-X11/programs/Xserver/hw/nxagent/Image.c

@@ -922,7 +922,12 @@ void nxagentRealizeImage(DrawablePtr pDrawable, GCPtr pGC, int depth,
   int numSubImages;
   int totalHeight;
 
-  const int subSize = (MAX_REQUEST_SIZE << 2) - sizeof(xPutImageReq);
+  /*
+   * NXPutPackedImage is longer than PutPackedImage
+   * so that we subtract the bigger one to be sure.
+   */
+
+  const int subSize = (MAX_REQUEST_SIZE << 2) - sizeof(xNXPutPackedImageReq);
 
   Visual *pVisual = NULL;
 
@@ -1171,7 +1176,7 @@ FIXME: Should use an unpack resource here.
    */
 
   pack = (nxagentOption(LinkType) != LINK_TYPE_NONE &&
-              packMethod != PACK_NONE && depth > 8);
+              packMethod != PACK_NONE && depth > 8 && format == ZPixmap);
 
   lossless = (packMethod == nxagentPackLossless);
 

nx-X11/programs/Xserver/hw/nxagent/Init.c

@@ -74,7 +74,7 @@ is" without express or implied warranty.
 #undef  DEBUG
 #undef  DUMP
 
-#define NXAGENT_VERSION  "3.1.0"
+#define NXAGENT_VERSION  "3.2.0"
 
 /*
  * ProcVector array defined in tables.c.
@@ -332,6 +332,13 @@ FIXME: These variables, if not removed at all because have probably
   nxagentAllocateGraphicContexts();
 
   nxagentDoFullGeneration = nxagentFullGeneration;
+
+  /*
+   * Use a solid black root window
+   * background.
+   */
+
+  blackRoot = TRUE;
 }
 
 void InitInput(argc, argv)

nx-X11/programs/Xserver/hw/nxagent/Keyboard.c

@@ -444,7 +444,7 @@ N/A
                                      max_keycode - min_keycode + 1,
                                      &mapWidth);
 
-        if (keymap == NULL)
+        if (keymap64 == NULL)
         {
           XFreeModifiermap(modifier_keymap);
 
@@ -756,6 +756,8 @@ XkbError:
           XkbInitKeyboardDeviceStruct((pointer)pDev, &names, &keySyms, modmap,
                                           nxagentBell, nxagentChangeKeyboardControl);
 
+          free(nxagentXkbConfigFilePath);
+
           if (!nxagentKeyboard ||
                  (nxagentKeyboard && (strcmp(nxagentKeyboard, "query") == 0)))
           {

nx-X11/programs/Xserver/hw/nxagent/Literals.h

@@ -142,6 +142,13 @@ static char *nxagentRequestLiteral[] =
   "GetPointerMapping",
   "SetModifierMapping",
   "GetModifierMapping",
+  "",
+  "",
+  "",
+  "",
+  "",
+  "",
+  "",
   "NoOperation"
 };
 

nx-X11/programs/Xserver/hw/nxagent/Reconnect.c

@@ -553,12 +553,6 @@ Bool nxagentReconnectSession(void)
            strcmp(nxagentKeyboard, nxagentOldKeyboard) != 0 ||
                strcmp(nxagentKeyboard, "query") == 0)
     {
-      if (nxagentOldKeyboard != NULL)
-      {
-        xfree(nxagentOldKeyboard);
-
-        nxagentOldKeyboard = NULL;
-      }
 
       if (nxagentResetKeyboard() == 0)
       {
@@ -576,6 +570,15 @@ Bool nxagentReconnectSession(void)
     }
   }
 
+  nxagentXkbState.Initialized = 0;
+
+  if (nxagentOldKeyboard != NULL)
+  {
+    xfree(nxagentOldKeyboard);
+
+    nxagentOldKeyboard = NULL;
+  }
+
   nxagentDeactivatePointerGrab();
 
   nxagentWakeupByReconnect();
@@ -686,6 +689,13 @@ nxagentReconnectError:
     nxagentDisconnectDisplay();
   }
 
+  if (nxagentOldKeyboard != NULL)
+  {
+    xfree(nxagentOldKeyboard);
+
+    nxagentOldKeyboard = NULL;
+  }
+
   return 0;
 }
 

nx-X11/programs/Xserver/hw/nxagent/Screen.c

@@ -78,7 +78,16 @@ is" without express or implied warranty.
 #include "Utils.h"
 
 #include "Xrandr.h"
+
+#define GC     XlibGC
+#define Font   XlibFont
+#define KeySym XlibKeySym
+#define XID    XlibXID
 #include <X11/Xlibint.h>
+#undef  GC
+#undef  Font
+#undef  KeySym
+#undef  XID
 
 #include "Xatom.h"
 #include "Xproto.h"
@@ -309,10 +318,44 @@ void nxagentMaximizeToFullScreen(ScreenPtr pScreen)
 /*
     XUnmapWindow(nxagentDisplay, nxagentIconWindow);
 */
+/*
+FIXME: We'll chech for ReparentNotify and LeaveNotify events after XReparentWindow()
+       in order to avoid the session window is iconified.
+       We could avoid the sesssion window is iconified when a LeaveNotify event is received,
+       so this check would be unnecessary.
+*/
+    struct timeval timeout;
+    int i;
+    XEvent e;
+
+    XReparentWindow(nxagentDisplay, nxagentFullscreenWindow,
+                        RootWindow(nxagentDisplay, DefaultScreen(nxagentDisplay)), 0, 0);
+
+    for (i = 0; i < 100 && nxagentWMIsRunning; i++)
+    {
+      #ifdef TEST
+      fprintf(stderr, "nxagentSwitchFullscreen: WARNING! Going to wait for the ReparentNotify event.\n");
+      #endif
+
+      if (XCheckTypedWindowEvent(nxagentDisplay, nxagentFullscreenWindow, ReparentNotify, &e))
+      {
+        break;
+      }
+
+      XSync(nxagentDisplay, 0);
+
+      timeout.tv_sec = 0;
+      timeout.tv_usec = 50 * 1000;
+
+      nxagentWaitEvents(nxagentDisplay, &timeout);
+    }
+
     XMapRaised(nxagentDisplay, nxagentFullscreenWindow);
 
     XIconifyWindow(nxagentDisplay, nxagentIconWindow,
                        DefaultScreen(nxagentDisplay));
+
+    while (XCheckTypedWindowEvent(nxagentDisplay, nxagentFullscreenWindow, LeaveNotify, &e));
 /*
     XMapWindow(nxagentDisplay, nxagentIconWindow);
 */
@@ -2872,6 +2915,15 @@ int nxagentShadowPoll(PixmapPtr nxagentShadowPixmapPtr, GCPtr nxagentShadowGCPtr
       width = pBox[n].y1 - pBox[n].x1;/* y1 = x2 */
       height = y2 - pBox[n].x2;   /* x2 = y1 */
 
+      if((x + width) > nxagentShadowWidth || (y + height) > nxagentShadowHeight)
+      {
+        /*
+         * Out of bounds. Maybe a resize of the master session is going on.
+         */
+
+        continue;
+      }
+
       line = PixmapBytePad(width, nxagentMasterDepth);
 
       #ifdef DEBUG
@@ -3826,8 +3878,8 @@ void nxagentShadowAdaptToRatio(void)
 
   pScreen = screenInfo.screens[0];
 
-  nxagentShadowSetRatio(nxagentOption(Width) * 1.0 / WindowTable[0] -> drawable.width, 
-                            nxagentOption(Height) * 1.0 / WindowTable[0] -> drawable.height);
+  nxagentShadowSetRatio(nxagentOption(Width) * 1.0 / nxagentShadowWidth,
+                            nxagentOption(Height) * 1.0 / nxagentShadowHeight);
 
   nxagentShadowCreateMainWindow(pScreen, WindowTable[0], nxagentShadowWidth, nxagentShadowHeight);
 

nx-X11/programs/Xserver/hw/nxagent/Trap.c

@@ -96,4 +96,19 @@ int nxagentLosslessTrap = 0;
 
 int nxagentSplitTrap = 0;
 
+/*
+ * Set to avoid CapsLock synchronization
+ * problems when CapsLock is the first
+ * key to be pressed in the session.
+ */
+
+int nxagentXkbCapsTrap = 0;
+
+/*
+ * Set to avoid NumLock synchronization
+ * problems when NumLock is the first
+ * key to be pressed in the session.
+ */
+
+int nxagentXkbNumTrap = 0;
 

nx-X11/programs/Xserver/hw/nxagent/Trap.h

@@ -97,4 +97,20 @@ extern int nxagentLosslessTrap;
 
 extern int nxagentSplitTrap;
 
+/*
+ * Set to avoid CapsLock synchronization
+ * problems when CapsLock is the first
+ * key to be pressed in the session.
+ */
+
+extern int nxagentXkbCapsTrap;
+
+/*
+ * Set to avoid NumLock synchronization
+ * problems when NumLock is the first
+ * key to be pressed in the session.
+ */
+
+extern int nxagentXkbNumTrap;
+
 #endif /* __Trap_H__ */

nx-X11/programs/Xserver/hw/nxagent/X/NXdispatch.c

@@ -3835,6 +3835,8 @@ ProcSetScreenSaver (register ClientPtr client)
       {
         ScreenSaverInterval = defaultScreenSaverInterval;
       }
+
+      SetScreenSaverTimer();
     }
     #ifdef TEST
 
@@ -3846,7 +3848,6 @@ ProcSetScreenSaver (register ClientPtr client)
 
     #endif
 
-    SetScreenSaverTimer();
     return (client->noClientException);
 }
 

nx-X11/programs/Xserver/hw/nxagent/X/NXdispatch.c.NX.original

@@ -3835,6 +3835,8 @@ ProcSetScreenSaver (register ClientPtr client)
       {
         ScreenSaverInterval = defaultScreenSaverInterval;
       }
+
+      SetScreenSaverTimer();
     }
     #ifdef TEST
 
@@ -3846,7 +3848,6 @@ ProcSetScreenSaver (register ClientPtr client)
 
     #endif
 
-    SetScreenSaverTimer();
     return (client->noClientException);
 }
 

nx-X11/programs/Xserver/hw/nxagent/X/NXglyph.c

@@ -69,6 +69,17 @@
 #undef  DEBUG
 #undef  TEST
 
+#else
+
+#include "picturestr.h"
+#include "glyphstr.h"
+
+#endif
+
+#if HAVE_STDINT_H
+#include <stdint.h>
+#elif !defined(UINT32_MAX)
+#define UINT32_MAX 0xffffffffU
 #endif
 
 /*
@@ -401,8 +412,12 @@ AllocateGlyph (xGlyphInfo *gi, int fdepth)
 {
     int		size;
     GlyphPtr	glyph;
-
-    size = gi->height * PixmapBytePad (gi->width, glyphDepths[fdepth]);
+    size_t	     padded_width;
+    
+    padded_width = PixmapBytePad (gi->width, glyphDepths[fdepth]);
+    if (gi->height && padded_width > (UINT32_MAX - sizeof(GlyphRec))/gi->height)
+	return 0;
+    size = gi->height * padded_width;
     glyph = (GlyphPtr) xalloc (size + sizeof (GlyphRec));
     if (!glyph)
 	return 0;

nx-X11/programs/Xserver/hw/nxagent/X/NXglyph.c.NX.original

@@ -69,6 +69,17 @@
 #undef  DEBUG
 #undef  TEST
 
+#else
+
+#include "picturestr.h"
+#include "glyphstr.h"
+
+#endif
+
+#if HAVE_STDINT_H
+#include <stdint.h>
+#elif !defined(UINT32_MAX)
+#define UINT32_MAX 0xffffffffU
 #endif
 
 /*
@@ -401,8 +412,12 @@ AllocateGlyph (xGlyphInfo *gi, int fdepth)
 {
     int		size;
     GlyphPtr	glyph;
-
-    size = gi->height * PixmapBytePad (gi->width, glyphDepths[fdepth]);
+    size_t	     padded_width;
+    
+    padded_width = PixmapBytePad (gi->width, glyphDepths[fdepth]);
+    if (gi->height && padded_width > (UINT32_MAX - sizeof(GlyphRec))/gi->height)
+	return 0;
+    size = gi->height * padded_width;
     glyph = (GlyphPtr) xalloc (size + sizeof (GlyphRec));
     if (!glyph)
 	return 0;

nx-X11/programs/Xserver/hw/nxagent/X/NXglyph.c.X.original

@@ -43,6 +43,12 @@
 #include "picturestr.h"
 #include "glyphstr.h"
 
+#if HAVE_STDINT_H
+#include <stdint.h>
+#elif !defined(UINT32_MAX)
+#define UINT32_MAX 0xffffffffU
+#endif
+
 /*
  * From Knuth -- a good choice for hash/rehash values is p, p-2 where
  * p and p-2 are both prime.  These tables are sized to have an extra 10%
@@ -334,8 +340,12 @@ AllocateGlyph (xGlyphInfo *gi, int fdepth)
 {
     int		size;
     GlyphPtr	glyph;
-
-    size = gi->height * PixmapBytePad (gi->width, glyphDepths[fdepth]);
+    size_t	     padded_width;
+    
+    padded_width = PixmapBytePad (gi->width, glyphDepths[fdepth]);
+    if (gi->height && padded_width > (UINT32_MAX - sizeof(GlyphRec))/gi->height)
+	return 0;
+    size = gi->height * padded_width;
     glyph = (GlyphPtr) xalloc (size + sizeof (GlyphRec));
     if (!glyph)
 	return 0;

nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c

@@ -1893,6 +1893,8 @@ ProcRenderCreateCursor (ClientPtr client)
     pScreen = pSrc->pDrawable->pScreen;
     width = pSrc->pDrawable->width;
     height = pSrc->pDrawable->height;
+    if (height && width > UINT32_MAX/(height*sizeof(CARD32)))
+	return BadAlloc;
     if ( stuff->x > width 
       || stuff->y > height )
 	return (BadMatch);
@@ -2353,6 +2355,8 @@ static int ProcRenderCreateLinearGradient (ClientPtr client)
     LEGAL_NEW_RESOURCE(stuff->pid, client);
 
     len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq);
+    if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
+	return BadLength;
     if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
         return BadLength;
 
@@ -2955,18 +2959,18 @@ SProcRenderCreateSolidFill(ClientPtr client)
     return (*ProcRenderVector[stuff->renderReqType]) (client);
 }
 
-static void swapStops(void *stuff, int n)
+static void swapStops(void *stuff, int num)
 {
-    int i;
+    int i, n;
     CARD32 *stops;
     CARD16 *colors;
     stops = (CARD32 *)(stuff);
-    for (i = 0; i < n; ++i) {
+    for (i = 0; i < num; ++i) {
         swapl(stops, n);
         ++stops;
     }
     colors = (CARD16 *)(stops);
-    for (i = 0; i < 4*n; ++i) {
+    for (i = 0; i < 4*num; ++i) {
         swaps(stops, n);
         ++stops;
     }
@@ -2989,6 +2993,8 @@ SProcRenderCreateLinearGradient (ClientPtr client)
     swapl(&stuff->nStops, n);
 
     len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq);
+    if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
+	return BadLength;
     if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
         return BadLength;
 
@@ -3016,6 +3022,8 @@ SProcRenderCreateRadialGradient (ClientPtr client)
     swapl(&stuff->nStops, n);
 
     len = (client->req_len << 2) - sizeof(xRenderCreateRadialGradientReq);
+    if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
+	return BadLength;
     if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
         return BadLength;
 
@@ -3040,6 +3048,8 @@ SProcRenderCreateConicalGradient (ClientPtr client)
     swapl(&stuff->nStops, n);
 
     len = (client->req_len << 2) - sizeof(xRenderCreateConicalGradientReq);
+    if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
+	return BadLength;
     if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
         return BadLength;
 

nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c.NX.original

@@ -1893,6 +1893,8 @@ ProcRenderCreateCursor (ClientPtr client)
     pScreen = pSrc->pDrawable->pScreen;
     width = pSrc->pDrawable->width;
     height = pSrc->pDrawable->height;
+    if (height && width > UINT32_MAX/(height*sizeof(CARD32)))
+	return BadAlloc;
     if ( stuff->x > width 
       || stuff->y > height )
 	return (BadMatch);
@@ -2353,6 +2355,8 @@ static int ProcRenderCreateLinearGradient (ClientPtr client)
     LEGAL_NEW_RESOURCE(stuff->pid, client);
 
     len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq);
+    if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
+	return BadLength;
     if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
         return BadLength;
 
@@ -2955,18 +2959,18 @@ SProcRenderCreateSolidFill(ClientPtr client)
     return (*ProcRenderVector[stuff->renderReqType]) (client);
 }
 
-static void swapStops(void *stuff, int n)
+static void swapStops(void *stuff, int num)
 {
-    int i;
+    int i, n;
     CARD32 *stops;
     CARD16 *colors;
     stops = (CARD32 *)(stuff);
-    for (i = 0; i < n; ++i) {
+    for (i = 0; i < num; ++i) {
         swapl(stops, n);
         ++stops;
     }
     colors = (CARD16 *)(stops);
-    for (i = 0; i < 4*n; ++i) {
+    for (i = 0; i < 4*num; ++i) {
         swaps(stops, n);
         ++stops;
     }
@@ -2989,6 +2993,8 @@ SProcRenderCreateLinearGradient (ClientPtr client)
     swapl(&stuff->nStops, n);
 
     len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq);
+    if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
+	return BadLength;
     if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
         return BadLength;
 
@@ -3016,6 +3022,8 @@ SProcRenderCreateRadialGradient (ClientPtr client)
     swapl(&stuff->nStops, n);
 
     len = (client->req_len << 2) - sizeof(xRenderCreateRadialGradientReq);
+    if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
+	return BadLength;
     if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
         return BadLength;
 
@@ -3040,6 +3048,8 @@ SProcRenderCreateConicalGradient (ClientPtr client)
     swapl(&stuff->nStops, n);
 
     len = (client->req_len << 2) - sizeof(xRenderCreateConicalGradientReq);
+    if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
+	return BadLength;
     if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
         return BadLength;
 

nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c.X.original

@@ -1505,6 +1505,8 @@ ProcRenderCreateCursor (ClientPtr client)
     pScreen = pSrc->pDrawable->pScreen;
     width = pSrc->pDrawable->width;
     height = pSrc->pDrawable->height;
+    if (height && width > UINT32_MAX/(height*sizeof(CARD32)))
+	return BadAlloc;
     if ( stuff->x > width 
       || stuff->y > height )
 	return (BadMatch);
@@ -1918,6 +1920,8 @@ static int ProcRenderCreateLinearGradient (ClientPtr client)
     LEGAL_NEW_RESOURCE(stuff->pid, client);
 
     len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq);
+    if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
+	return BadLength;
     if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
         return BadLength;
 
@@ -2489,18 +2493,18 @@ SProcRenderCreateSolidFill(ClientPtr client)
     return (*ProcRenderVector[stuff->renderReqType]) (client);
 }
 
-static void swapStops(void *stuff, int n)
+static void swapStops(void *stuff, int num)
 {
-    int i;
+    int i, n;
     CARD32 *stops;
     CARD16 *colors;
     stops = (CARD32 *)(stuff);
-    for (i = 0; i < n; ++i) {
+    for (i = 0; i < num; ++i) {
         swapl(stops, n);
         ++stops;
     }
     colors = (CARD16 *)(stops);
-    for (i = 0; i < 4*n; ++i) {
+    for (i = 0; i < 4*num; ++i) {
         swaps(stops, n);
         ++stops;
     }
@@ -2523,6 +2527,8 @@ SProcRenderCreateLinearGradient (ClientPtr client)
     swapl(&stuff->nStops, n);
 
     len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq);
+    if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
+	return BadLength;
     if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
         return BadLength;
 
@@ -2550,6 +2556,8 @@ SProcRenderCreateRadialGradient (ClientPtr client)
     swapl(&stuff->nStops, n);
 
     len = (client->req_len << 2) - sizeof(xRenderCreateRadialGradientReq);
+    if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
+	return BadLength;
     if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
         return BadLength;
 
@@ -2574,6 +2582,8 @@ SProcRenderCreateConicalGradient (ClientPtr client)
     swapl(&stuff->nStops, n);
 
     len = (client->req_len << 2) - sizeof(xRenderCreateConicalGradientReq);
+    if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
+	return BadLength;
     if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
         return BadLength;
 

nx-X11/programs/Xserver/hw/nxagent/X/NXresource.c

@@ -201,6 +201,10 @@ void RegisterResourceName (RESTYPE type, char *name)
 
 #endif
 
+#ifdef NXAGENT_SERVER
+static int nxagentResChangedFlag = 0;
+#endif
+
 RESTYPE
 CreateNewResourceType(DeleteType deleteFunc)
 {
@@ -590,6 +594,9 @@ AddResource(XID id, RESTYPE type, pointer value)
     res->value = value;
     *head = res;
     rrec->elements++;
+    #ifdef NXAGENT_SERVER
+    nxagentResChangedFlag = 1;
+    #endif
     if (!(id & SERVER_BIT) && (id >= rrec->expectID))
 	rrec->expectID = id + 1;
     return TRUE;
@@ -675,6 +682,9 @@ FreeResource(XID id, RESTYPE skipDeleteFuncType)
 		RESTYPE rtype = res->type;
 		*prev = res->next;
 		elements = --*eltptr;
+                #ifdef NXAGENT_SERVER
+                nxagentResChangedFlag = 1;
+                #endif
 		if (rtype & RC_CACHED)
 		    FlushClientCaches(res->id);
 		if (rtype != skipDeleteFuncType)
@@ -715,6 +725,9 @@ FreeResourceByType(XID id, RESTYPE type, Bool skipFree)
 	    if (res->id == id && res->type == type)
 	    {
 		*prev = res->next;
+                #ifdef NXAGENT_SERVER
+                nxagentResChangedFlag = 1;
+                #endif
 		if (type & RC_CACHED)
 		    FlushClientCaches(res->id);
 		if (!skipFree)
@@ -809,12 +822,44 @@ RestartLoop:
 	    next = this->next;
 	    if (!type || this->type == type) {
 		elements = *eltptr;
+
+                /*
+                 * FIXME:
+                 * It is not safe to let a function change the resource
+                 * table we are reading!
+                 */
+
+                #ifdef NXAGENT_SERVER
+                nxagentResChangedFlag = 0;
+                #endif
 		(*func)(this->value, this->id, cdata);
+
+                /*
+                 * Avoid that a call to RebuildTable() could invalidate the
+                 * pointer. This is safe enough, because in RebuildTable()
+                 * the new pointer is allocated just before the old one is
+                 * freed, so it can't point to the same address.
+                 */
+
                 #ifdef NXAGENT_SERVER
                 if (*resptr != resources)
                    goto RestartLoop;
                 #endif
+
+                /*
+                 * It's not enough to check if the number of elements has
+                 * changed, beacause it could happen that the number of
+                 * resources that have been added matches the number of
+                 * the freed ones.
+                 * 'nxagentResChangedFlag' is set if a resource has been
+                 * added or freed.
+                 */
+
+                #ifdef NXAGENT_SERVER
+                if (*eltptr != elements || nxagentResChangedFlag)
+                #else
 		if (*eltptr != elements)
+                #endif
 		    next = resources[i]; /* start over */
 	    }
 	}
@@ -861,12 +906,44 @@ RestartLoop:
         {
             next = this->next;
             elements = *eltptr;
+
+            /*
+             * FIXME:
+             * It is not safe to let a function change the resource
+             * table we are reading!
+             */
+
+            #ifdef NXAGENT_SERVER
+            nxagentResChangedFlag = 0;
+            #endif
             (*func)(this->value, this->id, this->type, cdata);
+
+            /*
+             * Avoid that a call to RebuildTable() could invalidate the
+             * pointer. This is safe enough, because in RebuildTable()
+             * the new pointer is allocated just before the old one is
+             * freed, so it can't point to the same address.
+             */
+
             #ifdef NXAGENT_SERVER
             if (*resptr != resources)
                 goto RestartLoop;
             #endif
+
+            /*
+             * It's not enough to check if the number of elements has
+             * changed, beacause it could happen that the number of
+             * resources that have been added matches the number of
+             * the freed ones.
+             * 'nxagentResChangedFlag' is set if a resource has been
+             * added or freed.
+             */
+
+            #ifdef NXAGENT_SERVER
+            if (*eltptr != elements || nxagentResChangedFlag)
+            #else
             if (*eltptr != elements)
+            #endif
                 next = resources[i]; /* start over */
         }
     }

nx-X11/programs/Xserver/hw/nxagent/X/NXresource.c.NX.original

@@ -201,6 +201,10 @@ void RegisterResourceName (RESTYPE type, char *name)
 
 #endif
 
+#ifdef NXAGENT_SERVER
+static int nxagentResChangedFlag = 0;
+#endif
+
 RESTYPE
 CreateNewResourceType(DeleteType deleteFunc)
 {
@@ -590,6 +594,9 @@ AddResource(XID id, RESTYPE type, pointer value)
     res->value = value;
     *head = res;
     rrec->elements++;
+    #ifdef NXAGENT_SERVER
+    nxagentResChangedFlag = 1;
+    #endif
     if (!(id & SERVER_BIT) && (id >= rrec->expectID))
 	rrec->expectID = id + 1;
     return TRUE;
@@ -675,6 +682,9 @@ FreeResource(XID id, RESTYPE skipDeleteFuncType)
 		RESTYPE rtype = res->type;
 		*prev = res->next;
 		elements = --*eltptr;
+                #ifdef NXAGENT_SERVER
+                nxagentResChangedFlag = 1;
+                #endif
 		if (rtype & RC_CACHED)
 		    FlushClientCaches(res->id);
 		if (rtype != skipDeleteFuncType)
@@ -715,6 +725,9 @@ FreeResourceByType(XID id, RESTYPE type, Bool skipFree)
 	    if (res->id == id && res->type == type)
 	    {
 		*prev = res->next;
+                #ifdef NXAGENT_SERVER
+                nxagentResChangedFlag = 1;
+                #endif
 		if (type & RC_CACHED)
 		    FlushClientCaches(res->id);
 		if (!skipFree)
@@ -809,12 +822,44 @@ RestartLoop:
 	    next = this->next;
 	    if (!type || this->type == type) {
 		elements = *eltptr;
+
+                /*
+                 * FIXME:
+                 * It is not safe to let a function change the resource
+                 * table we are reading!
+                 */
+
+                #ifdef NXAGENT_SERVER
+                nxagentResChangedFlag = 0;
+                #endif
 		(*func)(this->value, this->id, cdata);
+
+                /*
+                 * Avoid that a call to RebuildTable() could invalidate the
+                 * pointer. This is safe enough, because in RebuildTable()
+                 * the new pointer is allocated just before the old one is
+                 * freed, so it can't point to the same address.
+                 */
+
                 #ifdef NXAGENT_SERVER
                 if (*resptr != resources)
                    goto RestartLoop;
                 #endif
+
+                /*
+                 * It's not enough to check if the number of elements has
+                 * changed, beacause it could happen that the number of
+                 * resources that have been added matches the number of
+                 * the freed ones.
+                 * 'nxagentResChangedFlag' is set if a resource has been
+                 * added or freed.
+                 */
+
+                #ifdef NXAGENT_SERVER
+                if (*eltptr != elements || nxagentResChangedFlag)
+                #else
 		if (*eltptr != elements)
+                #endif
 		    next = resources[i]; /* start over */
 	    }
 	}
@@ -861,12 +906,44 @@ RestartLoop:
         {
             next = this->next;
             elements = *eltptr;
+
+            /*
+             * FIXME:
+             * It is not safe to let a function change the resource
+             * table we are reading!
+             */
+
+            #ifdef NXAGENT_SERVER
+            nxagentResChangedFlag = 0;
+            #endif
             (*func)(this->value, this->id, this->type, cdata);
+
+            /*
+             * Avoid that a call to RebuildTable() could invalidate the
+             * pointer. This is safe enough, because in RebuildTable()
+             * the new pointer is allocated just before the old one is
+             * freed, so it can't point to the same address.
+             */
+
             #ifdef NXAGENT_SERVER
             if (*resptr != resources)
                 goto RestartLoop;
             #endif
+
+            /*
+             * It's not enough to check if the number of elements has
+             * changed, beacause it could happen that the number of
+             * resources that have been added matches the number of
+             * the freed ones.
+             * 'nxagentResChangedFlag' is set if a resource has been
+             * added or freed.
+             */
+
+            #ifdef NXAGENT_SERVER
+            if (*eltptr != elements || nxagentResChangedFlag)
+            #else
             if (*eltptr != elements)
+            #endif
                 next = resources[i]; /* start over */
         }
     }

nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c

@@ -967,8 +967,17 @@ ProcShmPutImage(client)
         return BadValue;
     }
 
-    VERIFY_SHMSIZE(shmdesc, stuff->offset, length * stuff->totalHeight,
-		   client);
+    /* 
+     * There's a potential integer overflow in this check:
+     * VERIFY_SHMSIZE(shmdesc, stuff->offset, length * stuff->totalHeight,
+     *                client);
+     * the version below ought to avoid it
+     */
+    if (stuff->totalHeight != 0 && 
+	length > (shmdesc->size - stuff->offset)/stuff->totalHeight) {
+	client->errorValue = stuff->totalWidth;
+	return BadValue;
+    }
     if (stuff->srcX > stuff->totalWidth)
     {
 	client->errorValue = stuff->srcX;

nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c.NX.original

@@ -967,8 +967,17 @@ ProcShmPutImage(client)
         return BadValue;
     }
 
-    VERIFY_SHMSIZE(shmdesc, stuff->offset, length * stuff->totalHeight,
-		   client);
+    /* 
+     * There's a potential integer overflow in this check:
+     * VERIFY_SHMSIZE(shmdesc, stuff->offset, length * stuff->totalHeight,
+     *                client);
+     * the version below ought to avoid it
+     */
+    if (stuff->totalHeight != 0 && 
+	length > (shmdesc->size - stuff->offset)/stuff->totalHeight) {
+	client->errorValue = stuff->totalWidth;
+	return BadValue;
+    }
     if (stuff->srcX > stuff->totalWidth)
     {
 	client->errorValue = stuff->srcX;

nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c.X.original

@@ -863,8 +863,17 @@ ProcShmPutImage(client)
         return BadValue;
     }
 
-    VERIFY_SHMSIZE(shmdesc, stuff->offset, length * stuff->totalHeight,
-		   client);
+    /* 
+     * There's a potential integer overflow in this check:
+     * VERIFY_SHMSIZE(shmdesc, stuff->offset, length * stuff->totalHeight,
+     *                client);
+     * the version below ought to avoid it
+     */
+    if (stuff->totalHeight != 0 && 
+	length > (shmdesc->size - stuff->offset)/stuff->totalHeight) {
+	client->errorValue = stuff->totalWidth;
+	return BadValue;
+    }
     if (stuff->srcX > stuff->totalWidth)
     {
 	client->errorValue = stuff->srcX;

nx-X11/programs/Xserver/hw/nxagent/X/NXwindow.c

@@ -153,6 +153,9 @@ extern Bool nxagentScreenTrap;
  *
  ******/
 
+static unsigned char _back_lsb[4] = {0x88, 0x22, 0x44, 0x11};
+static unsigned char _back_msb[4] = {0x11, 0x44, 0x22, 0x88};
+
 int screenIsSaved = SCREEN_SAVER_OFF;
 
 ScreenSaverStuffRec savedScreenInfo[MAXSCREENS];
@@ -355,18 +358,7 @@ void nxagentClearSplash(WindowPtr pW)
     (*pScreen->ChangeWindowAttributes)(pW, CWBackPixmap|CWBackPixel);
 }
 
-static void
-#if NeedFunctionPrototypes
-MakeRootTile(WindowPtr pWin)
-#else
-MakeRootTile(pWin)
-    WindowPtr pWin;
-#endif
-{
-    nxagentRootTileWindow = pWin;
-}
-
-#else /* NXAGENT_SERVER */
+#endif /* NXAGENT_SERVER */
 
 static void
 MakeRootTile(WindowPtr pWin)
@@ -412,9 +404,10 @@ MakeRootTile(WindowPtr pWin)
 
    FreeScratchGC(pGC);
 
-}
-
+#ifdef NXAGENT_SERVER
+   nxagentRootTileWindow = pWin;
 #endif /* NXAGENT_SERVER */
+}
 
 WindowPtr
 AllocateWindow(ScreenPtr pScreen)

nx-X11/programs/Xserver/hw/nxagent/X/NXwindow.c.NX.original

@@ -153,6 +153,9 @@ extern Bool nxagentScreenTrap;
  *
  ******/
 
+static unsigned char _back_lsb[4] = {0x88, 0x22, 0x44, 0x11};
+static unsigned char _back_msb[4] = {0x11, 0x44, 0x22, 0x88};
+
 int screenIsSaved = SCREEN_SAVER_OFF;
 
 ScreenSaverStuffRec savedScreenInfo[MAXSCREENS];
@@ -355,18 +358,7 @@ void nxagentClearSplash(WindowPtr pW)
     (*pScreen->ChangeWindowAttributes)(pW, CWBackPixmap|CWBackPixel);
 }
 
-static void
-#if NeedFunctionPrototypes
-MakeRootTile(WindowPtr pWin)
-#else
-MakeRootTile(pWin)
-    WindowPtr pWin;
-#endif
-{
-    nxagentRootTileWindow = pWin;
-}
-
-#else /* NXAGENT_SERVER */
+#endif /* NXAGENT_SERVER */
 
 static void
 MakeRootTile(WindowPtr pWin)
@@ -412,9 +404,10 @@ MakeRootTile(WindowPtr pWin)
 
    FreeScratchGC(pGC);
 
-}
-
+#ifdef NXAGENT_SERVER
+   nxagentRootTileWindow = pWin;
 #endif /* NXAGENT_SERVER */
+}
 
 WindowPtr
 AllocateWindow(ScreenPtr pScreen)