Add two bug fixes from GIT (see patch headings for more info).
Bump rev.


(bjs)

$NetBSD: patch-aa,v 1.3 2008/01/29 03:45:36 bjs Exp $

Coverity #743/744: Returned without freeing storage bufp/savp
 
If either bufp or savp failed to malloc, we returned without freeing 
the other.  (from GIT)

--- src/XGMotion.c.orig	2007-09-05 12:41:58.000000000 -0400
+++ src/XGMotion.c
@@ -115,6 +115,8 @@ Time stop;
     savp = readp = (int *)Xmalloc(size);
     bufp = (int *)Xmalloc(size2);
     if (!bufp || !savp) {
+	Xfree(bufp);
+	Xfree(savp);
 	*nEvents = 0;
 	_XEatData(dpy, (unsigned long)size);
 	UnlockDisplay(dpy);

$NetBSD: patch-ab,v 1.1 2008/01/29 03:45:36 bjs Exp $

GetDeviceControl: calculate the length field correctly.
 
Length field should indicate the length of the struct in bytes, 
not the length of the pointer to the struct. (from GIT)

--- src/XGetDCtl.c.orig	2007-09-05 12:41:58.000000000 -0400
+++ src/XGetDCtl.c
@@ -104,6 +104,12 @@ XGetDeviceControl(dpy, dev, control)
 	sav = d;
 	_XRead(dpy, (char *)d, nbytes);
 
+        /* In theory, we should just be able to use d->length to get the size.
+         * Turns out that a number of X servers (up to and including server
+         * 1.4) sent the wrong length value down the wire. So to not break
+         * apps that run against older servers, we have to calculate the size
+         * manually.
+         */
 	switch (d->control) {
 	case DEVICE_RESOLUTION:
 	{
@@ -170,7 +176,7 @@ XGetDeviceControl(dpy, dev, control)
             XDeviceAbsCalibState *C = (XDeviceAbsCalibState *) Device;
 
             C->control = DEVICE_ABS_CALIB;
-            C->length = sizeof(C);
+            C->length = sizeof(XDeviceAbsCalibState);
             C->min_x = c->min_x;
             C->max_x = c->max_x;
             C->min_y = c->min_y;
@@ -188,7 +194,7 @@ XGetDeviceControl(dpy, dev, control)
             XDeviceAbsAreaState *A = (XDeviceAbsAreaState *) Device;
 
             A->control = DEVICE_ABS_AREA;
-            A->length = sizeof(A);
+            A->length = sizeof(XDeviceAbsAreaState);
             A->offset_x = a->offset_x;
             A->offset_y = a->offset_y;
             A->width = a->width;
@@ -204,7 +210,7 @@ XGetDeviceControl(dpy, dev, control)
             XDeviceCoreState *C = (XDeviceCoreState *) Device;
 
             C->control = DEVICE_CORE;
-            C->length = sizeof(C);
+            C->length = sizeof(XDeviceCoreState);
             C->status = c->status;
             C->iscore = c->iscore;