Merge branch 'uli42-pr/various_backports' into 3.6.x

nx-X11/programs/Xserver/damageext/damageext.c

@@ -296,7 +296,7 @@ ProcDamageDispatch (ClientPtr client)
     REQUEST(xDamageReq);
     DamageClientPtr pDamageClient = GetDamageClient (client);
 
-    if (pDamageClient->major_version > NUM_VERSION_REQUESTS)
+    if (pDamageClient->major_version >= NUM_VERSION_REQUESTS)
 	return BadRequest;
     if (stuff->damageReqType > version_requests[pDamageClient->major_version])
 	return BadRequest;

nx-X11/programs/Xserver/dix/devices.c

@@ -210,6 +210,7 @@ CloseDevice(register DeviceIntPtr dev)
 	if (dev->key->xkbInfo)
 	    XkbFreeInfo(dev->key->xkbInfo);
 #endif
+	dev->key->xkbInfo = NULL;
 	free(dev->key->curKeySyms.map);
 	free(dev->key->modifierKeyMap);
 	free(dev->key);

nx-X11/programs/Xserver/miext/cw/cw.c

@@ -463,7 +463,7 @@ cwPaintWindowBackground(WindowPtr pWin, RegionPtr pRegion, int what)
 	DrawablePtr pBackingDrawable;
 	int x_off, y_off, x_screen, y_screen;
 
-	while (pWin && pWin->backgroundState == ParentRelative)
+	while (pWin->backgroundState == ParentRelative)
 	    pWin = pWin->parent;
 
 	pBackingDrawable = cwGetBackingDrawable((DrawablePtr)pWin, &x_off,

nx-X11/programs/Xserver/miext/cw/cw.h

@@ -60,7 +60,8 @@ typedef struct {
     unsigned long   stateChanges;
 } cwPictureRec, *cwPicturePtr;
 
-#define getCwPicture(pPicture)	((cwPicturePtr)(pPicture)->devPrivates[cwPictureIndex].ptr)
+#define getCwPicture(pPicture) \
+    (pPicture->pDrawable ? (cwPicturePtr)(pPicture)->devPrivates[cwPictureIndex].ptr : 0)
 #define setCwPicture(pPicture,p) ((pPicture)->devPrivates[cwPictureIndex].ptr = (void *) (p))
 
 extern int  cwPictureIndex;

nx-X11/programs/Xserver/randr/rrcrtc.c

@@ -89,13 +89,10 @@ RRCrtcCreate(ScreenPtr pScreen, void *devPrivate)
     pScrPriv = rrGetScrPriv(pScreen);
 
     /* make space for the crtc pointer */
-    if (pScrPriv->numCrtcs)
-        crtcs = reallocarray(pScrPriv->crtcs,
-                             pScrPriv->numCrtcs + 1, sizeof(RRCrtcPtr));
-    else
-        crtcs = malloc(sizeof(RRCrtcPtr));
+    crtcs = reallocarray(pScrPriv->crtcs,
+            pScrPriv->numCrtcs + 1, sizeof(RRCrtcPtr));
     if (!crtcs)
-        return FALSE;
+        return NULL;
     pScrPriv->crtcs = crtcs;
 
     crtc = calloc(1, sizeof(RRCrtcRec));
@@ -772,6 +769,7 @@ RRCrtcDestroyResource(void *value, XID pid)
     free(crtc->gammaRed);
     if (crtc->mode)
         RRModeDestroy(crtc->mode);
+    free(crtc->outputs);
     free(crtc);
     return 1;
 }

nx-X11/programs/Xserver/randr/rroutput.c

@@ -74,13 +74,10 @@ RROutputCreate(ScreenPtr pScreen,
 
     pScrPriv = rrGetScrPriv(pScreen);
 
-    if (pScrPriv->numOutputs)
-        outputs = reallocarray(pScrPriv->outputs,
-                               pScrPriv->numOutputs + 1, sizeof(RROutputPtr));
-    else
-        outputs = malloc(sizeof(RROutputPtr));
+    outputs = reallocarray(pScrPriv->outputs,
+                           pScrPriv->numOutputs + 1, sizeof(RROutputPtr));
     if (!outputs)
-        return FALSE;
+        return NULL;
 
     pScrPriv->outputs = outputs;
 

nx-X11/programs/Xserver/render/picture.c

@@ -982,6 +982,7 @@ static PicturePtr createSourcePicture(void)
     pPicture->pDrawable = 0;
     pPicture->pFormat = 0;
     pPicture->pNext = 0;
+    pPicture->devPrivates = 0;
 
     SetPictureToDefaults(pPicture);
     return pPicture;

nx-X11/programs/Xserver/xfixes/region.c

@@ -817,6 +817,7 @@ ProcXFixesExpandRegion (ClientPtr client)
 	    RegionInit(&r, &pTmp[i], 0);
 	    RegionUnion(pDestination, pDestination, &r);
 	}
+	free(pTmp);
     }
     if (ret == Success) 
 	ret = client->noClientException;

nx-X11/programs/Xserver/xfixes/xfixes.c

@@ -120,7 +120,7 @@ ProcXFixesDispatch (ClientPtr client)
     REQUEST(xXFixesReq);
     XFixesClientPtr pXFixesClient = GetXFixesClient (client);
 
-    if (pXFixesClient->major_version > NUM_VERSION_REQUESTS)
+    if (pXFixesClient->major_version >= NUM_VERSION_REQUESTS)
 	return BadRequest;
     if (stuff->xfixesReqType > version_requests[pXFixesClient->major_version])
 	return BadRequest;

nx-X11/programs/Xserver/xkb/maprules.c

@@ -358,13 +358,6 @@ Bool		found;
 	remap->num_remap= 0;
 	return;
    }
-   if (((present&PART_MASK)&(1<<OPTION))&&
-				((present&PART_MASK)!=(1<<OPTION))) {
-	PR_DEBUG("Options cannot appear with other parts\n");
-	PR_DEBUG("Illegal mapping ignored\n");
-	remap->num_remap= 0;
-	return;
-   }
    if (((present&COMPONENT_MASK)&(1<<KEYMAP))&&
 				((present&COMPONENT_MASK)!=(1<<KEYMAP))) {
 	PR_DEBUG("Keymap cannot appear with other components\n");