Merge branch 'master' into mpx

Conflicts:

	XTrap/xtrapddmi.c
	Xext/security.c
	Xext/xprint.c
	Xext/xtest.c
	Xext/xvdisp.c
	Xi/exevents.c
	Xi/grabdevb.c
	Xi/grabdevk.c
	Xi/opendev.c
	Xi/ungrdev.c
	Xi/ungrdevb.c
	Xi/ungrdevk.c
	dix/cursor.c
	dix/devices.c
	dix/dixutils.c
	dix/events.c
	dix/getevents.c
	dix/main.c
	dix/window.c
	hw/xfree86/ramdac/xf86Cursor.c
	include/dix.h
	include/input.h
	include/inputstr.h
	mi/midispcur.c
	mi/miinitext.c
	mi/misprite.c
	render/animcur.c
	xfixes/cursor.c
	xkb/xkbAccessX.c

6 files changed, 78 insertions, 55 deletions

diff --git a/xfixes/cursor.c b/xfixes/cursor.c
index 0c2b0d282..a804a8963 100755
--- a/xfixes/cursor.c
+++ b/xfixes/cursor.c
@@ -51,12 +51,12 @@
 #include "servermd.h"
 #include "inputstr.h"
 #include "windowstr.h"
+#include "xace.h"
 
 static RESTYPE		CursorClientType;
 static RESTYPE		CursorHideCountType;
 static RESTYPE		CursorWindowType;
-static int		CursorScreenPrivateIndex = -1;
-static int		CursorGeneration;
+static DevPrivateKey	CursorScreenPrivateKey = &CursorScreenPrivateKey;
 static CursorPtr	CursorCurrent;
 static CursorPtr        pInvisibleCursor = NULL;
 
@@ -113,9 +113,9 @@ typedef struct _CursorScreen {
     CursorHideCountPtr          pCursorHideCounts;
 } CursorScreenRec, *CursorScreenPtr;
 
-#define GetCursorScreen(s)	((CursorScreenPtr) ((s)->devPrivates[CursorScreenPrivateIndex].ptr))
-#define GetCursorScreenIfSet(s) ((CursorScreenPrivateIndex != -1) ? GetCursorScreen(s) : NULL)
-#define SetCursorScreen(s,p)	((s)->devPrivates[CursorScreenPrivateIndex].ptr = (pointer) (p))
+#define GetCursorScreen(s) ((CursorScreenPtr)dixLookupPrivate(&(s)->devPrivates, CursorScreenPrivateKey))
+#define GetCursorScreenIfSet(s) GetCursorScreen(s)
+#define SetCursorScreen(s,p) dixSetPrivate(&(s)->devPrivates, CursorScreenPrivateKey, p)
 #define Wrap(as,s,elt,func)	(((as)->elt = (s)->elt), (s)->elt = func)
 #define Unwrap(as,s,elt)	((s)->elt = (as)->elt)
 
@@ -172,8 +172,6 @@ CursorCloseScreen (int index, ScreenPtr pScreen)
     deleteCursorHideCountsForScreen(pScreen);
     ret = (*pScreen->CloseScreen) (index, pScreen);
     xfree (cs);
-    if (index == 0)
-	CursorScreenPrivateIndex = -1;
     return ret;
 }
 
@@ -242,7 +240,7 @@ ProcXFixesSelectCursorInput (ClientPtr client)
     int		rc;
 
     REQUEST_SIZE_MATCH (xXFixesSelectCursorInputReq);
-    rc = dixLookupWindow(&pWin, stuff->window, client, DixReadAccess);
+    rc = dixLookupWindow(&pWin, stuff->window, client, DixGetAttrAccess);
     if (rc != Success)
         return rc;
     if (stuff->eventMask & ~CursorAllEvents)
@@ -347,14 +345,16 @@ ProcXFixesGetCursorImage (ClientPtr client)
     xXFixesGetCursorImageReply	*rep;
     CursorPtr			pCursor;
     CARD32			*image;
-    int				npixels;
-    int				width, height;
-    int				x, y;
+    int				npixels, width, height, rc, x, y;
 
     REQUEST_SIZE_MATCH(xXFixesGetCursorImageReq);
     pCursor = CursorCurrent;
     if (!pCursor)
 	return BadCursor;
+    rc = XaceHook(XACE_RESOURCE_ACCESS, client, pCursor->id, RT_CURSOR,
+		  pCursor, RT_NONE, NULL, DixReadAccess);
+    if (rc != Success)
+	return rc;
     GetSpritePosition (inputInfo.pointer, &x, &y);
     width = pCursor->bits->width;
     height = pCursor->bits->height;
@@ -415,7 +415,7 @@ ProcXFixesSetCursorName (ClientPtr client)
     Atom atom;
 
     REQUEST_AT_LEAST_SIZE(xXFixesSetCursorNameReq);
-    VERIFY_CURSOR(pCursor, stuff->cursor, client, DixWriteAccess);
+    VERIFY_CURSOR(pCursor, stuff->cursor, client, DixSetAttrAccess);
     tchar = (char *) &stuff[1];
     atom = MakeAtom (tchar, stuff->nbytes, TRUE);
     if (atom == BAD_RESOURCE)
@@ -448,7 +448,7 @@ ProcXFixesGetCursorName (ClientPtr client)
     int len;
 
     REQUEST_SIZE_MATCH(xXFixesGetCursorNameReq);
-    VERIFY_CURSOR(pCursor, stuff->cursor, client, DixReadAccess);
+    VERIFY_CURSOR(pCursor, stuff->cursor, client, DixGetAttrAccess);
     if (pCursor->name)
 	str = NameForAtom (pCursor->name);
     else
@@ -497,12 +497,16 @@ ProcXFixesGetCursorImageAndName (ClientPtr client)
     char			*name;
     int				nbytes, nbytesRound;
     int				width, height;
-    int				x, y;
+    int				rc, x, y;
 
     REQUEST_SIZE_MATCH(xXFixesGetCursorImageAndNameReq);
     pCursor = CursorCurrent;
     if (!pCursor)
 	return BadCursor;
+    rc = XaceHook(XACE_RESOURCE_ACCESS, client, pCursor->id, RT_CURSOR,
+		  pCursor, RT_NONE, NULL, DixReadAccess|DixGetAttrAccess);
+    if (rc != Success)
+	return rc;
     GetSpritePosition (inputInfo.pointer, &x, &y);
     width = pCursor->bits->width;
     height = pCursor->bits->height;
@@ -679,8 +683,10 @@ ProcXFixesChangeCursor (ClientPtr client)
     REQUEST(xXFixesChangeCursorReq);
 
     REQUEST_SIZE_MATCH(xXFixesChangeCursorReq);
-    VERIFY_CURSOR (pSource, stuff->source, client, DixReadAccess);
-    VERIFY_CURSOR (pDestination, stuff->destination, client, DixWriteAccess);
+    VERIFY_CURSOR (pSource, stuff->source, client,
+		   DixReadAccess|DixGetAttrAccess);
+    VERIFY_CURSOR (pDestination, stuff->destination, client,
+		   DixWriteAccess|DixSetAttrAccess);
 
     ReplaceCursor (pSource, TestForCursor, (pointer) pDestination);
     return (client->noClientException);
@@ -714,7 +720,8 @@ ProcXFixesChangeCursorByName (ClientPtr client)
     REQUEST(xXFixesChangeCursorByNameReq);
 
     REQUEST_FIXED_SIZE(xXFixesChangeCursorByNameReq, stuff->nbytes);
-    VERIFY_CURSOR(pSource, stuff->source, client, DixReadAccess);
+    VERIFY_CURSOR(pSource, stuff->source, client,
+		  DixReadAccess|DixGetAttrAccess);
     tchar = (char *) &stuff[1];
     name = MakeAtom (tchar, stuff->nbytes, FALSE);
     if (name)
@@ -842,10 +849,11 @@ ProcXFixesHideCursor (ClientPtr client)
 
     REQUEST_SIZE_MATCH (xXFixesHideCursorReq);
 
-    pWin = (WindowPtr) LookupIDByType (stuff->window, RT_WINDOW);
-    if (!pWin) {
+    ret = dixLookupResource((pointer *)&pWin, stuff->window, RT_WINDOW,
+			    client, DixGetAttrAccess);
+    if (ret != Success) {
 	client->errorValue = stuff->window;
-	return BadWindow;
+	return (ret == BadValue) ? BadWindow : ret;
     }
 
     /* 
@@ -863,6 +871,11 @@ ProcXFixesHideCursor (ClientPtr client)
      * This is the first time this client has hid the cursor 
      * for this screen.
      */
+    ret = XaceHook(XACE_SCREEN_ACCESS, client, pWin->drawable.pScreen,
+		   DixHideAccess);
+    if (ret != Success)
+	return ret;
+
     ret = createCursorHideCount(client, pWin->drawable.pScreen);
 
     if (ret == Success) {
@@ -889,14 +902,16 @@ ProcXFixesShowCursor (ClientPtr client)
 {
     WindowPtr pWin;
     CursorHideCountPtr pChc;
+    int rc;
     REQUEST(xXFixesShowCursorReq);
 
     REQUEST_SIZE_MATCH (xXFixesShowCursorReq);
 
-    pWin = (WindowPtr) LookupIDByType (stuff->window, RT_WINDOW);
-    if (!pWin) {
+    rc = dixLookupResource((pointer *)&pWin, stuff->window, RT_WINDOW,
+			   client, DixGetAttrAccess);
+    if (rc != Success) {
 	client->errorValue = stuff->window;
-	return BadWindow;
+	return (rc == BadValue) ? BadWindow : rc;
     }
 
     /* 
@@ -908,6 +923,11 @@ ProcXFixesShowCursor (ClientPtr client)
 	return BadMatch;
     }
 
+    rc = XaceHook(XACE_SCREEN_ACCESS, client, pWin->drawable.pScreen,
+		  DixShowAccess);
+    if (rc != Success)
+	return rc;
+
     pChc->hideCount--;
     if (pChc->hideCount <= 0) {
 	FreeResource(pChc->resource, 0);
@@ -981,6 +1001,7 @@ createInvisibleCursor (void)
     CursorPtr pCursor;
     static unsigned int *psrcbits, *pmaskbits;
     CursorMetricRec cm;
+    int rc;
 
     psrcbits = (unsigned int *) xalloc(4);
     pmaskbits = (unsigned int *) xalloc(4);
@@ -995,12 +1016,13 @@ createInvisibleCursor (void)
     cm.xhot = 0;
     cm.yhot = 0;
 
-    pCursor = AllocCursor(
+    rc = AllocARGBCursor(
 	        (unsigned char *)psrcbits,
 		(unsigned char *)pmaskbits,
-		&cm,
+		NULL, &cm,
+		0, 0, 0,
 		0, 0, 0,
-		0, 0, 0);
+		&pCursor, serverClient, (XID)0);
 
     return pCursor;
 }
@@ -1010,13 +1032,6 @@ XFixesCursorInit (void)
 {
     int	i;
     
-    if (CursorGeneration != serverGeneration)
-    {
-	CursorScreenPrivateIndex = AllocateScreenPrivateIndex ();
-	if (CursorScreenPrivateIndex < 0)
-	    return FALSE;
-	CursorGeneration = serverGeneration;
-    }
     for (i = 0; i < screenInfo.numScreens; i++)
     {
 	ScreenPtr	pScreen = screenInfo.screens[i];
diff --git a/xfixes/region.c b/xfixes/region.c
index d4316be78..d90b1e0ff 100755
--- a/xfixes/region.c
+++ b/xfixes/region.c
@@ -109,18 +109,18 @@ ProcXFixesCreateRegionFromBitmap (ClientPtr client)
 {
     RegionPtr	pRegion;
     PixmapPtr	pPixmap;
+    int rc;
     REQUEST (xXFixesCreateRegionFromBitmapReq);
 
     REQUEST_SIZE_MATCH (xXFixesCreateRegionFromBitmapReq);
     LEGAL_NEW_RESOURCE (stuff->region, client);
 
-    pPixmap = (PixmapPtr) SecurityLookupIDByType (client, stuff->bitmap,
-						  RT_PIXMAP,
-						  DixReadAccess);
-    if (!pPixmap)
+    rc = dixLookupResource((pointer *)&pPixmap, stuff->bitmap, RT_PIXMAP,
+			   client, DixReadAccess);
+    if (rc != Success)
     {
 	client->errorValue = stuff->bitmap;
-	return BadPixmap;
+	return (rc == BadValue) ? BadPixmap : rc;
     }
     if (pPixmap->drawable.depth != 1)
 	return BadMatch;
@@ -155,15 +155,17 @@ ProcXFixesCreateRegionFromWindow (ClientPtr client)
     RegionPtr	pRegion;
     Bool	copy = TRUE;
     WindowPtr	pWin;
+    int rc;
     REQUEST (xXFixesCreateRegionFromWindowReq);
     
     REQUEST_SIZE_MATCH (xXFixesCreateRegionFromWindowReq);
     LEGAL_NEW_RESOURCE (stuff->region, client);
-    pWin = (WindowPtr) LookupIDByType (stuff->window, RT_WINDOW);
-    if (!pWin)
+    rc = dixLookupResource((pointer *)&pWin, stuff->window, RT_WINDOW,
+			   client, DixGetAttrAccess);
+    if (rc != Success)
     {
 	client->errorValue = stuff->window;
-	return BadWindow;
+	return (rc == BadValue) ? BadWindow : rc;
     }
     switch (stuff->kind) {
     case WindowRegionBounding:
@@ -224,7 +226,7 @@ ProcXFixesCreateRegionFromGC (ClientPtr client)
     REQUEST_SIZE_MATCH (xXFixesCreateRegionFromGCReq);
     LEGAL_NEW_RESOURCE (stuff->region, client);
 
-    rc = dixLookupGC(&pGC, stuff->gc, client, DixReadAccess);
+    rc = dixLookupGC(&pGC, stuff->gc, client, DixGetAttrAccess);
     if (rc != Success)
 	return rc;
     
@@ -274,7 +276,7 @@ ProcXFixesCreateRegionFromPicture (ClientPtr client)
     REQUEST_SIZE_MATCH (xXFixesCreateRegionFromPictureReq);
     LEGAL_NEW_RESOURCE (stuff->region, client);
 
-    VERIFY_PICTURE(pPicture, stuff->picture, client, DixReadAccess,
+    VERIFY_PICTURE(pPicture, stuff->picture, client, DixGetAttrAccess,
 		   RenderErrBase + BadPicture);
     
     switch (pPicture->clientClipType) {
@@ -635,7 +637,7 @@ ProcXFixesSetGCClipRegion (ClientPtr client)
     REQUEST(xXFixesSetGCClipRegionReq);
     REQUEST_SIZE_MATCH(xXFixesSetGCClipRegionReq);
 
-    rc = dixLookupGC(&pGC, stuff->gc, client, DixWriteAccess);
+    rc = dixLookupGC(&pGC, stuff->gc, client, DixSetAttrAccess);
     if (rc != Success)
 	return rc;
 
@@ -681,14 +683,16 @@ ProcXFixesSetWindowShapeRegion (ClientPtr client)
     ScreenPtr	    pScreen;
     RegionPtr	    pRegion;
     RegionPtr	    *pDestRegion;
+    int rc;
     REQUEST(xXFixesSetWindowShapeRegionReq);
 
     REQUEST_SIZE_MATCH(xXFixesSetWindowShapeRegionReq);
-    pWin = (WindowPtr) LookupIDByType (stuff->dest, RT_WINDOW);
-    if (!pWin)
+    rc = dixLookupResource((pointer *)&pWin, stuff->dest, RT_WINDOW,
+			   client, DixSetAttrAccess);
+    if (rc != Success)
     {
 	client->errorValue = stuff->dest;
-	return BadWindow;
+	return (rc == BadValue) ? BadWindow : rc;
     }
     VERIFY_REGION_OR_NONE(pRegion, stuff->region, client, DixWriteAccess);
     pScreen = pWin->drawable.pScreen;
@@ -780,7 +784,7 @@ ProcXFixesSetPictureClipRegion (ClientPtr client)
     REQUEST(xXFixesSetPictureClipRegionReq);
     
     REQUEST_SIZE_MATCH (xXFixesSetPictureClipRegionReq);
-    VERIFY_PICTURE(pPicture, stuff->picture, client, DixWriteAccess,
+    VERIFY_PICTURE(pPicture, stuff->picture, client, DixSetAttrAccess,
 		   RenderErrBase + BadPicture);
     pScreen = pPicture->pDrawable->pScreen;
     ps = GetPictureScreen (pScreen);
diff --git a/xfixes/saveset.c b/xfixes/saveset.c
index 8d66843d9..e6e297638 100755
--- a/xfixes/saveset.c
+++ b/xfixes/saveset.c
@@ -35,7 +35,7 @@ ProcXFixesChangeSaveSet(ClientPtr client)
     REQUEST(xXFixesChangeSaveSetReq);
 		  
     REQUEST_SIZE_MATCH(xXFixesChangeSaveSetReq);
-    result = dixLookupWindow(&pWin, stuff->window, client, DixReadAccess);
+    result = dixLookupWindow(&pWin, stuff->window, client, DixManageAccess);
     if (result != Success)
         return result;
     if (client->clientAsMask == (CLIENT_BITS(pWin->drawable.id)))
diff --git a/xfixes/select.c b/xfixes/select.c
index c0076801d..415257ec1 100755
--- a/xfixes/select.c
+++ b/xfixes/select.c
@@ -25,6 +25,7 @@
 #endif
 
 #include "xfixesint.h"
+#include "xace.h"
 
 static RESTYPE		SelectionClientType, SelectionWindowType;
 static Bool		SelectionCallbackRegistered = FALSE;
@@ -131,8 +132,13 @@ XFixesSelectSelectionInput (ClientPtr	pClient,
 			    WindowPtr	pWindow,
 			    CARD32	eventMask)
 {
+    int rc;
     SelectionEventPtr	*prev, e;
 
+    rc = XaceHook(XACE_SELECTION_ACCESS, pClient, selection, DixGetAttrAccess);
+    if (rc != Success)
+	return rc;
+
     for (prev = &selectionEvents; (e = *prev); prev = &e->next)
     {
 	if (e->selection == selection &&
@@ -196,7 +202,7 @@ ProcXFixesSelectSelectionInput (ClientPtr client)
     int		rc;
 
     REQUEST_SIZE_MATCH (xXFixesSelectSelectionInputReq);
-    rc = dixLookupWindow(&pWin, stuff->window, client, DixReadAccess);
+    rc = dixLookupWindow(&pWin, stuff->window, client, DixGetAttrAccess);
     if (rc != Success)
         return rc;
     if (stuff->eventMask & ~SelectionAllEvents)
diff --git a/xfixes/xfixes.c b/xfixes/xfixes.c
index 32dee8a18..0db49895e 100755
--- a/xfixes/xfixes.c
+++ b/xfixes/xfixes.c
@@ -56,7 +56,7 @@
 static unsigned char	XFixesReqCode;
 int		XFixesEventBase;
 int		XFixesErrorBase;
-static int	XFixesClientPrivateIndex;
+static DevPrivateKey XFixesClientPrivateKey = &XFixesClientPrivateKey;
 
 static int
 ProcXFixesQueryVersion(ClientPtr client)
@@ -239,9 +239,7 @@ XFixesExtensionInit(void)
 {
     ExtensionEntry *extEntry;
 
-    XFixesClientPrivateIndex = AllocateClientPrivateIndex ();
-    if (!AllocateClientPrivate (XFixesClientPrivateIndex, 
-				sizeof (XFixesClientRec)))
+    if (!dixRequestPrivate(XFixesClientPrivateKey, sizeof (XFixesClientRec)))
 	return;
     if (!AddCallback (&ClientStateCallback, XFixesClientCallback, 0))
 	return;
diff --git a/xfixes/xfixesint.h b/xfixes/xfixesint.h
index 48927ae0f..33a3205ed 100755
--- a/xfixes/xfixesint.h
+++ b/xfixes/xfixesint.h
@@ -66,7 +66,7 @@ typedef struct _XFixesClient {
     CARD32	minor_version;
 } XFixesClientRec, *XFixesClientPtr;
 
-#define GetXFixesClient(pClient)    ((XFixesClientPtr) (pClient)->devPrivates[XFixesClientPrivateIndex].ptr)
+#define GetXFixesClient(pClient) ((XFixesClientPtr)dixLookupPrivate(&(pClient)->devPrivates, XFixesClientPrivateKey))
 
 extern int	(*ProcXFixesVector[XFixesNumberRequests])(ClientPtr);