[xorg-x11-server/f15/master] fix memcpy abuse

[Adam Jackson]

commit 8e9b95c8071eb5a0ed96fffab156a85e6445a94b
Author: Adam Jackson <ajax at redhat.com>
Date:   Thu Apr 21 16:42:35 2011 -0400

    fix memcpy abuse

 xorg-x11-server.spec              |    7 +++++-
 xserver-1.10.1-memcpy-abuse.patch |   44 +++++++++++++++++++++++++++++++++++++
 2 files changed, 50 insertions(+), 1 deletions(-)
---
diff --git a/xorg-x11-server.spec b/xorg-x11-server.spec
index 035dde3..1320467 100644
--- a/xorg-x11-server.spec
+++ b/xorg-x11-server.spec
@@ -30,7 +30,7 @@
 Summary:   X.Org X11 X server
 Name:      xorg-x11-server
 Version:   1.10.1
-Release:   11%{?gitdate:.%{gitdate}}%{dist}
+Release:   12%{?gitdate:.%{gitdate}}%{dist}
 URL:       http://www.x.org
 License:   MIT
 Group:     User Interface/X
@@ -96,6 +96,8 @@ Patch7011: xserver-1.10-swrastg.patch
 
 # sent upstream, should be in soon
 Patch7012: xserver-1.10-dix-only-transform-valuators-when-we-need-them.patch
+# ditto
+#Patch7013: xserver-1.10.1-memcpy-abuse.patch
 
 %define moduledir	%{_libdir}/xorg/modules
 %define drimoduledir	%{_libdir}/dri
@@ -561,6 +563,9 @@ rm -rf $RPM_BUILD_ROOT
 %{xserver_source_dir}
 
 %changelog
+* Thu Apr 21 2011 Adam Jackson <ajax at redhat.com> 1.10.1-12
+- xserver-1.10.1-memcpy-abuse.patch: Fix memcpy abuse
+
 * Thu Apr 21 2011 Hans de Goede <hdegoede at redhat.com> 1.10.1-11
 - Drop xserver-1.9.0-qxl-fallback.patch, since the latest qxl driver
   supports both revision 1 and 2 qxl devices (#642153)
diff --git a/xserver-1.10.1-memcpy-abuse.patch b/xserver-1.10.1-memcpy-abuse.patch
new file mode 100644
index 0000000..e3b1b97
--- /dev/null
+++ b/xserver-1.10.1-memcpy-abuse.patch
@@ -0,0 +1,44 @@
+From f24c4b2e3803f2b0e4eb7de5288756c4f9758ad5 Mon Sep 17 00:00:00 2001
+From: Adam Jackson <ajax at redhat.com>
+Date: Thu, 21 Apr 2011 16:41:14 -0400
+Subject: [PATCH] fb: fix memcpy abuse
+
+Signed-off-by: Adam Jackson <ajax at redhat.com>
+---
+ fb/fbblt.c |    9 +++++++--
+ 1 files changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/fb/fbblt.c b/fb/fbblt.c
+index 38271c0..980ad5a 100644
+--- a/fb/fbblt.c
++++ b/fb/fbblt.c
+@@ -65,6 +65,7 @@ fbBlt (FbBits   *srcLine,
+     int	    n, nmiddle;
+     Bool    destInvarient;
+     int	    startbyte, endbyte;
++    int     careful;
+     FbDeclareMergeRop ();
+ 
+ #ifdef FB_24BIT
+@@ -76,12 +77,16 @@ fbBlt (FbBits   *srcLine,
+     }
+ #endif
+ 
+-    if (alu == GXcopy && pm == FB_ALLONES && !reverse &&
++    careful = !((srcLine < dstLine && srcLine + width * (bpp/8) > dstLine) ||
++                (dstLine < srcLine && dstLine + width * (bpp/8) > srcLine)) ||
++              (bpp % 8);
++
++    if (alu == GXcopy && pm == FB_ALLONES && !careful &&
+             !(srcX & 7) && !(dstX & 7) && !(width & 7)) {
+         int i;
+         CARD8 *src = (CARD8 *) srcLine;
+         CARD8 *dst = (CARD8 *) dstLine;
+-        
++
+         srcStride *= sizeof(FbBits);
+         dstStride *= sizeof(FbBits);
+         width >>= 3;
+-- 
+1.7.4.4
+