Bug #7366: Fix two crashes in operations on source pictures.

A screen's ChangePictureTransform now isn't called when changing the transform,
as source pictures aren't associated with screens.  Also, attempting to set
an AlphaMap to a source picture will fail with BadMatch just like a Window
would, preventing another crash.

2 files changed, 16 insertions, 6 deletions

diff --git a/render/picture.c b/render/picture.c
index ee385e56b..55763fcc1 100644
--- a/render/picture.c
+++ b/render/picture.c
@@ -1217,7 +1217,8 @@ ChangePicture (PicturePtr	pPicture,
 			    error = BadPixmap;
 			    break;
 			}
-			if (pAlpha->pDrawable->type != DRAWABLE_PIXMAP)
+			if (pAlpha->pDrawable == NULL ||
+			    pAlpha->pDrawable->type != DRAWABLE_PIXMAP)
 			{
 			    client->errorValue = pid;
 			    error = BadMatch;
@@ -1469,9 +1470,6 @@ SetPictureTransform (PicturePtr	    pPicture,
 	{ 0x00000, xFixed1, 0x00000 },
 	{ 0x00000, 0x00000, xFixed1 },
     } };
-    ScreenPtr		pScreen = pPicture->pDrawable->pScreen;
-    PictureScreenPtr	ps = GetPictureScreen(pScreen);
-    int			result;
 
     if (transform && memcmp (transform, &identity, sizeof (PictTransform)) == 0)
 	transform = 0;
@@ -1496,9 +1494,16 @@ SetPictureTransform (PicturePtr	    pPicture,
     }
     pPicture->serialNumber |= GC_CHANGE_SERIAL_BIT;
 
-    result = (*ps->ChangePictureTransform) (pPicture, transform);
+    if (pPicture->pDrawable != NULL) {
+	int result;
+	PictureScreenPtr ps = GetPictureScreen(pPicture->pDrawable->pScreen);
 
-    return result;
+	result = (*ps->ChangePictureTransform) (pPicture, transform);
+
+	return result;
+    }
+
+    return Success;
 }
 
 void
diff --git a/render/picturestr.h b/render/picturestr.h
index 1ea91201e..25969a622 100644
--- a/render/picturestr.h
+++ b/render/picturestr.h
@@ -349,7 +349,12 @@ typedef struct _PictureScreen {
     PictFilterAliasPtr		filterAliases;
     int				nfilterAliases;
 
+    /**
+     * Called immediately after a picture's transform is changed through the
+     * SetPictureTransform request.  Not called for source-only pictures.
+     */
     ChangePictureTransformProcPtr   ChangePictureTransform;
+
     ChangePictureFilterProcPtr	ChangePictureFilter;
     DestroyPictureFilterProcPtr	DestroyPictureFilter;