xace: Fix XaceCensorImage to actually censor the right part of the image

The caller passes arguments into XaceCensorImage that are in
window-relative coordinates. However, the pBuf that it uses to construct
a temporary pixmap has its origin at (x, y) relative to the window in
question. The code to convert the censor region into boxes adjusts for
the Y coordinate, but leaves the X coordinate alone. The result is that
if x is not zero, it censors the wrong part of the image.

Fix this by just translating censorRegion into pixmap-relative
coordinates and using the resulting boxes as-is.

Reported-by: Fabien Lelaquais <Fabien.Lelaquais@roguewave.com>
Link: https://lists.x.org/archives/xorg/2016-August/058165.html
Reviewed-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Aaron Plattner <aplattner@nvidia.com>

1 files changed, 2 insertions, 1 deletions

diff --git a/Xext/xace.c b/Xext/xace.c
index 91c74d591..a3a83a20c 100644
--- a/Xext/xace.c
+++ b/Xext/xace.c
@@ -245,6 +245,7 @@ XaceCensorImage(ClientPtr client,
 
     /* censorRegion = imageRegion - visibleRegion */
     RegionSubtract(&censorRegion, &imageRegion, pVisibleRegion);
+    RegionTranslate(&censorRegion, -x, -y);
     nRects = RegionNumRects(&censorRegion);
     if (nRects > 0) {           /* we have something to censor */
         GCPtr pScratchGC = NULL;
@@ -265,7 +266,7 @@ XaceCensorImage(ClientPtr client,
         }
         for (pBox = RegionRects(&censorRegion), i = 0; i < nRects; i++, pBox++) {
             pRects[i].x = pBox->x1;
-            pRects[i].y = pBox->y1 - imageBox.y1;
+            pRects[i].y = pBox->y1;
             pRects[i].width = pBox->x2 - pBox->x1;
             pRects[i].height = pBox->y2 - pBox->y1;
         }