dix: Allow NULL stipple in ChangeGC

miOpqStipDrawable resets the stipple after painting. When that stipple
was NULL, ChangeGC needs to handle that and not crash.

Signed-off-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-off-by: Eric Anholt <eric@anholt.net>

1 files changed, 5 insertions, 3 deletions

diff --git a/dix/gc.c b/dix/gc.c
index efe6d6090..88d650121 100644
--- a/dix/gc.c
+++ b/dix/gc.c
@@ -261,12 +261,14 @@ ChangeGC(ClientPtr client, GC * pGC, BITS32 mask, ChangeGCValPtr pUnion)
         case GCStipple:
             NEXT_PTR(PixmapPtr, pPixmap);
 
-            if ((pPixmap->drawable.depth != 1) ||
-                (pPixmap->drawable.pScreen != pGC->pScreen)) {
+            if (pPixmap && ((pPixmap->drawable.depth != 1) ||
+                            (pPixmap->drawable.pScreen != pGC->pScreen)))
+            {
                 error = BadMatch;
             }
             else {
-                pPixmap->refcnt++;
+                if (pPixmap)
+                    pPixmap->refcnt++;
                 if (pGC->stipple)
                     (*pGC->pScreen->DestroyPixmap) (pGC->stipple);
                 pGC->stipple = pPixmap;