Merge tag 'xorg-server-1.15.1' into cygwin-release-1.15

xorg-server-1.15.1

Conflicts:
	hw/kdrive/ephyr/hostx.c

25 files changed, 167 insertions, 54 deletions

diff --git a/Xext/sync.c b/Xext/sync.c
index 2d58ea1fa..c33b5b5bb 100644
--- a/Xext/sync.c
+++ b/Xext/sync.c
@@ -2731,27 +2731,24 @@ IdleTimeBlockHandler(pointer pCounter, struct timeval **wt, pointer LastSelectMa
          * If we've been idle more than it, and someone wants to know about
          * that level-triggered, schedule an immediate wakeup.
          */
-        unsigned long timeout = -1;
 
         if (XSyncValueLessThan(idle, *greater)) {
             XSyncValue value;
             Bool overflow;
 
             XSyncValueSubtract(&value, *greater, idle, &overflow);
-            timeout = min(timeout, XSyncValueLow32(value));
+            AdjustWaitForDelay(wt, XSyncValueLow32(value));
         }
         else {
             for (list = counter->sync.pTriglist; list;
                  list = list->next) {
                 trig = list->pTrigger;
                 if (trig->CheckTrigger(trig, old_idle)) {
-                    timeout = min(timeout, 0);
+                    AdjustWaitForDelay(wt, 0);
                     break;
                 }
             }
         }
-
-        AdjustWaitForDelay(wt, timeout);
     }
 
     counter->value = old_idle;  /* pop */
diff --git a/Xi/exevents.c b/Xi/exevents.c
index dff0a92b0..ad0265093 100644
--- a/Xi/exevents.c
+++ b/Xi/exevents.c
@@ -1783,8 +1783,25 @@ ProcessDeviceEvent(InternalEvent *ev, DeviceIntPtr device)
         DeliverDeviceEvents(GetSpriteWindow(device), (InternalEvent *) event,
                             NullGrab, NullWindow, device);
 
-    if (deactivateDeviceGrab == TRUE)
+    if (deactivateDeviceGrab == TRUE) {
         (*device->deviceGrab.DeactivateGrab) (device);
+
+        if (!IsMaster (device) && !IsFloating (device)) {
+            int flags, num_events = 0;
+            InternalEvent dce;
+
+            flags = (IsPointerDevice (device)) ?
+                DEVCHANGE_POINTER_EVENT : DEVCHANGE_KEYBOARD_EVENT;
+            UpdateFromMaster (&dce, device, flags, &num_events);
+            BUG_WARN(num_events > 1);
+
+            if (num_events == 1)
+                ChangeMasterDeviceClasses(GetMaster (device, MASTER_ATTACHED),
+                                          &dce.changed_event);
+        }
+
+    }
+
     event->detail.key = key;
 }
 
@@ -2166,7 +2183,8 @@ CheckGrabValues(ClientPtr client, GrabParameters *param)
         return BadValue;
     }
 
-    if (param->grabtype != XI2 && (param->modifiers != AnyModifier) &&
+    if (param->modifiers != AnyModifier &&
+        param->modifiers != XIAnyModifier &&
         (param->modifiers & ~AllModifiersMask)) {
         client->errorValue = param->modifiers;
         return BadValue;
diff --git a/Xi/xichangehierarchy.c b/Xi/xichangehierarchy.c
index e2f4b8a0a..9e36354d1 100644
--- a/Xi/xichangehierarchy.c
+++ b/Xi/xichangehierarchy.c
@@ -143,6 +143,10 @@ add_master(ClientPtr client, xXIAddMasterInfo * c, int flags[MAXDEVICES])
     int rc;
 
     name = calloc(c->name_len + 1, sizeof(char));
+    if (name == NULL) {
+        rc = BadAlloc;
+        goto unwind;
+    }
     strncpy(name, (char *) &c[1], c->name_len);
 
     rc = AllocDevicePair(client, name, &ptr, &keybd,
diff --git a/Xi/xipassivegrab.c b/Xi/xipassivegrab.c
index eccec0ab8..700622d38 100644
--- a/Xi/xipassivegrab.c
+++ b/Xi/xipassivegrab.c
@@ -63,7 +63,7 @@ SProcXIPassiveGrabDevice(ClientPtr client)
     swaps(&stuff->mask_len);
     swaps(&stuff->num_modifiers);
 
-    mods = (uint32_t *) &stuff[1];
+    mods = (uint32_t *) &stuff[1] + stuff->mask_len;
 
     for (i = 0; i < stuff->num_modifiers; i++, mods++) {
         swapl(mods);
@@ -189,6 +189,10 @@ ProcXIPassiveGrabDevice(ClientPtr client)
         uint8_t status = Success;
 
         param.modifiers = *modifiers;
+        ret = CheckGrabValues(client, &param);
+        if (ret != Success)
+            goto out;
+
         switch (stuff->grab_type) {
         case XIGrabtypeButton:
             status = GrabButton(client, dev, mod_dev, stuff->detail,
diff --git a/config/hal.c b/config/hal.c
index 2ead556b0..d8e8db7c2 100644
--- a/config/hal.c
+++ b/config/hal.c
@@ -184,8 +184,7 @@ device_added(LibHalContext * hal_ctx, const char *udi)
     parent = get_prop_string(hal_ctx, udi, "info.parent");
     if (parent) {
         int usb_vendor, usb_product;
-
-        attrs.pnp_id = get_prop_string(hal_ctx, parent, "pnp.id");
+        char *old_parent;
 
         /* construct USB ID in lowercase - "0000:ffff" */
         usb_vendor = libhal_device_get_property_int(hal_ctx, parent,
@@ -203,7 +202,18 @@ device_added(LibHalContext * hal_ctx, const char *udi)
                 == -1)
                 attrs.usb_id = NULL;
 
-        free(parent);
+        attrs.pnp_id = get_prop_string(hal_ctx, parent, "pnp.id");
+        old_parent = parent;
+
+        while (!attrs.pnp_id &&
+               (parent = get_prop_string(hal_ctx, parent, "info.parent"))) {
+            attrs.pnp_id = get_prop_string(hal_ctx, parent, "pnp.id");
+
+            free(old_parent);
+            old_parent = parent;
+        }
+
+        free(old_parent);
     }
 
     input_options = input_option_new(NULL, "_source", "server/hal");
diff --git a/config/udev.c b/config/udev.c
index b55b78ec5..bcafbd9d8 100644
--- a/config/udev.c
+++ b/config/udev.c
@@ -130,10 +130,6 @@ device_added(struct udev_device *udev_device)
             LOG_PROPERTY(ppath, "NAME", name);
         }
 
-        if (pnp_id)
-            attrs.pnp_id = strdup(pnp_id);
-        LOG_SYSATTR(ppath, "id", pnp_id);
-
         /* construct USB ID in lowercase hex - "0000:ffff" */
         if (product &&
             sscanf(product, "%*x/%4x/%4x/%*x", &usb_vendor, &usb_model) == 2) {
@@ -143,6 +139,17 @@ device_added(struct udev_device *udev_device)
             else
                 LOG_PROPERTY(ppath, "PRODUCT", product);
         }
+
+        while (!pnp_id && (parent = udev_device_get_parent(parent))) {
+            pnp_id = udev_device_get_sysattr_value(parent, "id");
+            if (!pnp_id)
+                continue;
+
+            attrs.pnp_id = strdup(pnp_id);
+            ppath = udev_device_get_devnode(parent);
+            LOG_SYSATTR(ppath, "id", pnp_id);
+        }
+
     }
     if (!name)
         name = "(unnamed)";
diff --git a/configure.ac b/configure.ac
index ed650defa..aaa19e7c4 100644
--- a/configure.ac
+++ b/configure.ac
@@ -26,9 +26,9 @@ dnl
 dnl Process this file with autoconf to create configure.
 
 AC_PREREQ(2.60)
-AC_INIT([xorg-server], 1.15.0, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
-RELEASE_DATE="2013-12-27"
-RELEASE_NAME="Egg Nog"
+AC_INIT([xorg-server], 1.15.1, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
+RELEASE_DATE="2014-04-13"
+RELEASE_NAME="Heart Candy"
 AC_CONFIG_SRCDIR([Makefile.am])
 AM_INIT_AUTOMAKE([foreign dist-bzip2])
 AC_USE_SYSTEM_EXTENSIONS
diff --git a/dix/devices.c b/dix/devices.c
index a680ed8d7..8b9f5dd93 100644
--- a/dix/devices.c
+++ b/dix/devices.c
@@ -1279,6 +1279,7 @@ InitButtonClassDeviceStruct(DeviceIntPtr dev, int numButtons, Atom *labels,
 
     BUG_RETURN_VAL(dev == NULL, FALSE);
     BUG_RETURN_VAL(dev->button != NULL, FALSE);
+    BUG_RETURN_VAL(numButtons >= MAX_BUTTONS, FALSE);
 
     butc = calloc(1, sizeof(ButtonClassRec));
     if (!butc)
diff --git a/dix/dixfonts.c b/dix/dixfonts.c
index 2e34d370f..9a686e69c 100644
--- a/dix/dixfonts.c
+++ b/dix/dixfonts.c
@@ -1789,11 +1789,14 @@ GetFontPath(ClientPtr client, int *count, int *length, unsigned char **result)
         fpe = font_path_elements[i];
         len += fpe->name_length + 1;
     }
-    font_path_string = (unsigned char *) realloc(font_path_string, len);
-    if (!font_path_string)
+    c = realloc(font_path_string, len);
+    if (c == NULL) {
+        free(font_path_string);
+        font_path_string = NULL;
         return BadAlloc;
+    }
 
-    c = font_path_string;
+    font_path_string = c;
     *length = 0;
     for (i = 0; i < num_fpes; i++) {
         fpe = font_path_elements[i];
diff --git a/dix/getevents.c b/dix/getevents.c
index 14b65cabc..23f9c33f5 100644
--- a/dix/getevents.c
+++ b/dix/getevents.c
@@ -1654,6 +1654,8 @@ GetPointerEvents(InternalEvent *events, DeviceIntPtr pDev, int type,
     }
 #endif
 
+    BUG_RETURN_VAL(buttons >= MAX_BUTTONS, 0);
+
     /* refuse events from disabled devices */
     if (!pDev->enabled)
         return 0;
diff --git a/dix/inpututils.c b/dix/inpututils.c
index a10a7c761..e5bcc31f7 100644
--- a/dix/inpututils.c
+++ b/dix/inpututils.c
@@ -60,7 +60,8 @@ check_butmap_change(DeviceIntPtr dev, CARD8 *map, int len, CARD32 *errval_out,
     }
 
     for (i = 0; i < len; i++) {
-        if (dev->button->map[i + 1] != map[i] && dev->button->down[i + 1])
+        if (dev->button->map[i + 1] != map[i] &&
+            button_is_down(dev, i + 1, BUTTON_PROCESSED))
             return MappingBusy;
     }
 
diff --git a/glx/glxdricommon.c b/glx/glxdricommon.c
index 191130056..822e4c3c9 100644
--- a/glx/glxdricommon.c
+++ b/glx/glxdricommon.c
@@ -132,7 +132,7 @@ createModeFromConfig(const __DRIcoreExtension * core,
     unsigned int attrib, value;
     int i;
 
-    config = malloc(sizeof *config);
+    config = calloc(1, sizeof *config);
 
     config->driConfig = driConfig;
 
diff --git a/hw/kdrive/ephyr/hostx.c b/hw/kdrive/ephyr/hostx.c
index d78b405aa..57e7dc292 100644
--- a/hw/kdrive/ephyr/hostx.c
+++ b/hw/kdrive/ephyr/hostx.c
@@ -696,8 +696,8 @@ hostx_screen_init(KdScreenInfo *screen,
     }
 
     {
-        const uint32_t mask = XCB_CONFIG_WINDOW_WIDTH | XCB_CONFIG_WINDOW_HEIGHT;
-        const uint32_t values[] = { width, height };
+        uint32_t mask = XCB_CONFIG_WINDOW_WIDTH | XCB_CONFIG_WINDOW_HEIGHT;
+        uint32_t values[2] = {width, height};
         xcb_configure_window(HostX.conn, scrpriv->win, mask, values);
     }
 
diff --git a/hw/xfree86/common/xf86Helper.c b/hw/xfree86/common/xf86Helper.c
index f1e6783a7..676cc8062 100644
--- a/hw/xfree86/common/xf86Helper.c
+++ b/hw/xfree86/common/xf86Helper.c
@@ -217,6 +217,10 @@ xf86DeleteScreen(ScrnInfoPtr pScrn)
     int i;
     int scrnIndex;
     Bool is_gpu = FALSE;
+
+    if (!pScrn)
+        return;
+
     if (pScrn->is_gpu) {
         /* First check if the screen is valid */
         if (xf86NumGPUScreens == 0 || xf86GPUScreens == NULL)
@@ -228,9 +232,6 @@ xf86DeleteScreen(ScrnInfoPtr pScrn)
             return;
     }
 
-    if (!pScrn)
-        return;
-
     scrnIndex = pScrn->scrnIndex;
     /* If a FreeScreen function is defined, call it here */
     if (pScrn->FreeScreen != NULL)
diff --git a/hw/xquartz/GL/indirect.c b/hw/xquartz/GL/indirect.c
index 8dabda14d..19b7d86e7 100644
--- a/hw/xquartz/GL/indirect.c
+++ b/hw/xquartz/GL/indirect.c
@@ -643,10 +643,10 @@ __glFloorLog2(GLuint val)
 
 static void *opengl_framework_handle;
 
-static glx_gpa_proc
+static glx_func_ptr
 get_proc_address(const char *sym)
 {
-    return (glx_gpa_proc) dlsym(opengl_framework_handle, sym);
+    return (glx_func_ptr) dlsym(opengl_framework_handle, sym);
 }
 
 static void
diff --git a/hw/xquartz/X11Application.m b/hw/xquartz/X11Application.m
index 1f9b05dd1..2efbd658b 100644
--- a/hw/xquartz/X11Application.m
+++ b/hw/xquartz/X11Application.m
@@ -70,6 +70,18 @@ xpbproxy_run(void);
 static dispatch_queue_t eventTranslationQueue;
 #endif
 
+#ifndef __has_feature
+#define __has_feature(x) 0
+#endif
+
+#ifndef CF_RETURNS_RETAINED
+#if __has_feature(attribute_cf_returns_retained)
+#define CF_RETURNS_RETAINED __attribute__((cf_returns_retained))
+#else
+#define CF_RETURNS_RETAINED
+#endif
+#endif
+
 extern Bool noTestExtensions;
 extern Bool noRenderExtension;
 extern BOOL serverRunning;
@@ -526,6 +538,7 @@ cfrelease(CFAllocatorRef a, const void *b)
     CFRelease(b);
 }
 
+CF_RETURNS_RETAINED
 static CFMutableArrayRef
 nsarray_to_cfarray(NSArray *in)
 {
diff --git a/hw/xquartz/X11Controller.m b/hw/xquartz/X11Controller.m
index 752bda35c..5445c6f3a 100644
--- a/hw/xquartz/X11Controller.m
+++ b/hw/xquartz/X11Controller.m
@@ -934,7 +934,7 @@ extern char *bundle_id_prefix;
             == NSAlertDefaultReturn) ? NSTerminateNow : NSTerminateCancel;
 }
 
-- (void) applicationWillTerminate:(NSNotification *)aNotification
+- (void) applicationWillTerminate:(NSNotification *)aNotification _X_NORETURN
 {
     int remain;
     [X11App prefs_synchronize];
diff --git a/hw/xquartz/applewm.c b/hw/xquartz/applewm.c
index aea0a45f2..0d734bd88 100644
--- a/hw/xquartz/applewm.c
+++ b/hw/xquartz/applewm.c
@@ -378,6 +378,13 @@ ProcAppleWMSetWindowMenu(register ClientPtr client)
     items = malloc(sizeof(char *) * nitems);
     shortcuts = malloc(sizeof(char) * nitems);
 
+    if (!items || !shortcuts) {
+        free(items);
+        free(shortcuts);
+
+        return BadAlloc;
+    }
+
     max_len = (stuff->length << 2) - sizeof(xAppleWMSetWindowMenuReq);
     bytes = (char *)&stuff[1];
 
@@ -391,6 +398,15 @@ ProcAppleWMSetWindowMenu(register ClientPtr client)
                 break;
         }
     }
+
+    /* Check if we bailed out of the above loop due to a request that was too long */
+    if (j < nitems) {
+        free(items);
+        free(shortcuts);
+
+        return BadRequest;
+    }
+
     X11ApplicationSetWindowMenu(nitems, items, shortcuts);
     free(items);
     free(shortcuts);
diff --git a/hw/xquartz/darwinfb.h b/hw/xquartz/darwinfb.h
index 5de360d75..541128b8e 100644
--- a/hw/xquartz/darwinfb.h
+++ b/hw/xquartz/darwinfb.h
@@ -26,7 +26,7 @@
  */
 
 #ifndef _DARWIN_FB_H
-#define _DARWIN_DB_H
+#define _DARWIN_FB_H
 
 #include "scrnintstr.h"
 
diff --git a/hw/xquartz/mach-startup/stub.c b/hw/xquartz/mach-startup/stub.c
index b5a3168ca..756e4ef2d 100644
--- a/hw/xquartz/mach-startup/stub.c
+++ b/hw/xquartz/mach-startup/stub.c
@@ -353,6 +353,10 @@ main(int argc, char **argv, char **envp)
     newenvp = (string_array_t)calloc((1 + envpc), sizeof(string_t));
 
     if (!newargv || !newenvp) {
+        /* Silence the clang static analyzer */
+        free(newargv);
+        free(newenvp);
+
         asl_log(aslc, NULL, ASL_LEVEL_ERR,
                 "Xquartz: Memory allocation failure");
         return EXIT_FAILURE;
diff --git a/hw/xquartz/quartz.c b/hw/xquartz/quartz.c
index 1a493e178..2a87cd112 100644
--- a/hw/xquartz/quartz.c
+++ b/hw/xquartz/quartz.c
@@ -109,11 +109,14 @@ Bool
 QuartzAddScreen(int index,
                 ScreenPtr pScreen)
 {
+    // The clang static analyzer thinks we leak displayInfo here
+#ifndef __clang_analyzer__
     // allocate space for private per screen Quartz specific storage
     QuartzScreenPtr displayInfo = calloc(sizeof(QuartzScreenRec), 1);
 
     // QUARTZ_PRIV(pScreen) = displayInfo;
     dixSetPrivate(&pScreen->devPrivates, quartzScreenKey, displayInfo);
+#endif /* __clang_analyzer__ */
 
     // do Quartz mode specific initialization
     return quartzProcs->AddScreen(index, pScreen);
diff --git a/hw/xquartz/xpr/appledri.c b/hw/xquartz/xpr/appledri.c
index 9aac07240..77574655b 100644
--- a/hw/xquartz/xpr/appledri.c
+++ b/hw/xquartz/xpr/appledri.c
@@ -123,6 +123,10 @@ ProcAppleDRIQueryDirectRenderingCapable(register ClientPtr client)
     rep.length = 0;
     rep.sequenceNumber = client->sequence;
 
+    if (stuff->screen >= screenInfo.numScreens) {
+        return BadValue;
+    }
+
     if (!DRIQueryDirectRenderingCapable(screenInfo.screens[stuff->screen],
                                         &isCapable)) {
         return BadValue;
@@ -402,6 +406,7 @@ SProcAppleDRIQueryDirectRenderingCapable(register ClientPtr client)
 {
     REQUEST(xAppleDRIQueryDirectRenderingCapableReq);
     swaps(&stuff->length);
+    REQUEST_SIZE_MATCH(xAppleDRIQueryDirectRenderingCapableReq);
     swapl(&stuff->screen);
     return ProcAppleDRIQueryDirectRenderingCapable(client);
 }
@@ -411,6 +416,7 @@ SProcAppleDRIAuthConnection(register ClientPtr client)
 {
     REQUEST(xAppleDRIAuthConnectionReq);
     swaps(&stuff->length);
+    REQUEST_SIZE_MATCH(xAppleDRIAuthConnectionReq);
     swapl(&stuff->screen);
     swapl(&stuff->magic);
     return ProcAppleDRIAuthConnection(client);
@@ -421,6 +427,7 @@ SProcAppleDRICreateSurface(register ClientPtr client)
 {
     REQUEST(xAppleDRICreateSurfaceReq);
     swaps(&stuff->length);
+    REQUEST_SIZE_MATCH(xAppleDRICreateSurfaceReq);
     swapl(&stuff->screen);
     swapl(&stuff->drawable);
     swapl(&stuff->client_id);
@@ -432,6 +439,7 @@ SProcAppleDRIDestroySurface(register ClientPtr client)
 {
     REQUEST(xAppleDRIDestroySurfaceReq);
     swaps(&stuff->length);
+    REQUEST_SIZE_MATCH(xAppleDRIDestroySurfaceReq);
     swapl(&stuff->screen);
     swapl(&stuff->drawable);
     return ProcAppleDRIDestroySurface(client);
@@ -442,6 +450,7 @@ SProcAppleDRICreatePixmap(register ClientPtr client)
 {
     REQUEST(xAppleDRICreatePixmapReq);
     swaps(&stuff->length);
+    REQUEST_SIZE_MATCH(xAppleDRICreatePixmapReq);
     swapl(&stuff->screen);
     swapl(&stuff->drawable);
     return ProcAppleDRICreatePixmap(client);
@@ -452,6 +461,7 @@ SProcAppleDRIDestroyPixmap(register ClientPtr client)
 {
     REQUEST(xAppleDRIDestroyPixmapReq);
     swaps(&stuff->length);
+    REQUEST_SIZE_MATCH(xAppleDRIDestroyPixmapReq);
     swapl(&stuff->drawable);
     return ProcAppleDRIDestroyPixmap(client);
 }
diff --git a/hw/xquartz/xpr/x-hook.c b/hw/xquartz/xpr/x-hook.c
index b5d8ab90e..3922bb86c 100644
--- a/hw/xquartz/xpr/x-hook.c
+++ b/hw/xquartz/xpr/x-hook.c
@@ -70,34 +70,19 @@ X_PFX(hook_remove) (x_list * lst, x_hook_function * fun, void *data) {
 
 X_EXTERN void
 X_PFX(hook_run) (x_list * lst, void *arg) {
-    x_list *node, *cell;
-    x_hook_function **fun;
-    void **data;
-    int length, i;
+    x_list *node;
 
     if (!lst)
         return;
 
-    length = X_PFX(list_length) (lst);
-    fun = malloc(sizeof(x_hook_function *) * length);
-    data = malloc(sizeof(void *) * length);
-
-    if (!fun || !data) {
-        FatalError("Failed to allocate memory in %s\n", __func__);
-    }
+    for (node = lst; node != NULL; node = node->next) {
+        x_list *cell = node->data;
 
-    for (i = 0, node = lst; node != NULL; node = node->next, i++) {
-        cell = node->data;
-        fun[i] = CELL_FUN(cell);
-        data[i] = CELL_DATA(cell);
-    }
+        x_hook_function *fun = CELL_FUN(cell);
+        void *data = CELL_DATA(cell);
 
-    for (i = 0; i < length; i++) {
-        (*fun[i])(arg, data[i]);
+        (*fun)(arg, data);
     }
-
-    free(fun);
-    free(data);
 }
 
 X_EXTERN void
diff --git a/os/utils.c b/os/utils.c
index d3391215b..26a7fcc77 100644
--- a/os/utils.c
+++ b/os/utils.c
@@ -603,6 +603,10 @@ UseMsg(void)
 static int
 VerifyDisplayName(const char *d)
 {
+    int i;
+    int period_found = FALSE;
+    int after_period = 0;
+
     if (d == (char *) 0)
         return 0;               /*  null  */
     if (*d == '\0')
@@ -613,6 +617,29 @@ VerifyDisplayName(const char *d)
         return 0;               /*  must not equal "." or ".."  */
     if (strchr(d, '/') != (char *) 0)
         return 0;               /*  very important!!!  */
+
+    /* Since we run atoi() on the display later, only allow
+       for digits, or exception of :0.0 and similar (two decimal points max)
+       */
+    for (i = 0; i < strlen(d); i++) {
+        if (!isdigit(d[i])) {
+            if (d[i] != '.' || period_found)
+                return 0;
+            period_found = TRUE;
+        } else if (period_found)
+            after_period++;
+
+        if (after_period > 2)
+            return 0;
+    }
+
+    /* don't allow for :0. */
+    if (period_found && after_period == 0)
+        return 0;
+
+    if (atol(d) > INT_MAX)
+        return 0;
+
     return 1;
 }
 
diff --git a/test/xi2/protocol-xipassivegrabdevice.c b/test/xi2/protocol-xipassivegrabdevice.c
index 84b386bf3..dd51757ff 100644
--- a/test/xi2/protocol-xipassivegrabdevice.c
+++ b/test/xi2/protocol-xipassivegrabdevice.c
@@ -137,6 +137,7 @@ request_XIPassiveGrabDevice(ClientPtr client, xXIPassiveGrabDeviceReq * req,
 {
     int rc;
     int modifiers;
+    int mask_len;
 
     rc = ProcXIPassiveGrabDevice(&client_request);
     assert(rc == error);
@@ -153,10 +154,11 @@ request_XIPassiveGrabDevice(ClientPtr client, xXIPassiveGrabDeviceReq * req,
     swaps(&req->deviceid);
     modifiers = req->num_modifiers;
     swaps(&req->num_modifiers);
+    mask_len = req->mask_len;
     swaps(&req->mask_len);
 
     while (modifiers--) {
-        CARD32 *mod = ((CARD32 *) (req + 1)) + modifiers;
+        CARD32 *mod = ((CARD32 *) (req + 1)) + mask_len + modifiers;
 
         swapl(mod);
     }
@@ -228,6 +230,11 @@ test_XIPassiveGrabDevice(void)
     request->detail = XIAnyButton;
     request_XIPassiveGrabDevice(&client_request, request, Success, 0);
 
+    /* Set a few random masks to make sure we handle modifiers correctly */
+    SetBit(mask, XI_ButtonPress);
+    SetBit(mask, XI_KeyPress);
+    SetBit(mask, XI_Enter);
+
     /* some modifiers */
     request->num_modifiers = N_MODS;
     request->length += N_MODS;