In PictureCreateDefaultFormats()an array of formats is build from the
information in the visuals:
PictureCreateDefaultFormats()
{
// snipped some code
for( v=0; v<numVisuals; v++)
{
switch (TypeFromVisual)
{
case DirectColor:
case TrueColor:
// works fine
break;
case StaticColor:
case PseudoColor:
// The v is the problem here:
format = PICT_FORMAT (bpp, PICT_TYPE_COLOR, v, 0, 0, 0);
nformats = addFormat (formats, nformats, format,
depth);
break;
case StaticGray:
case GrayScale:
// The v is the problem here:
format = PICT_FORMAT (bpp, PICT_TYPE_GRAY, v, 0, 0,
0);
nformats = addFormat (formats, nformats, format,
depth);
break;
}
}
}
If you look at the macro:
#define PICT_FORMAT(bpp,type,a,r,g,b) (((bpp) << 24) | \
((type) << 16) | \
((a) << 12) | \
((r) << 8) | \
((g) << 4) | \
((b)))
it is obvious that if a > 0xF it will wrap into the type field. If your DDX
HW driver provides a lot of visuals this might happen and it will crash the
XServer later because of an illegal type field.
The wrapping can be fixed easily by adding masks to the macro, but what I do
not understand in the first place is why v (simply a loop index) is used as
an parameter for PICT_FORMAT(). This looks pretty much like a type to me.
Johannes
_______________________________________________
Xpert mailing list
[EMAIL PROTECTED]
http://XFree86.Org/mailman/listinfo/xpert
