From a5e2c313721615d40ebf328f3619286a88dae238 Mon Sep 17 00:00:00 2001
From: Adam Jackson <ajax@redhat.com>
Date: Wed, 17 May 2017 14:17:01 -0400
Subject: [PATCH xserver] xfixes: Remove the CursorCurrent array

We're not wrapping all the ways a cursor can be destroyed, so this array
ends up with stale data. Rather than try harder to wrap more code paths,
just look up the cursor when we need it.

Signed-off-by: Adam Jackson <ajax@redhat.com>
---
 xfixes/cursor.c | 28 +++++++++++++++++++++-------
 1 file changed, 21 insertions(+), 7 deletions(-)

diff --git a/xfixes/cursor.c b/xfixes/cursor.c
index c1ab3beda..b7c47bc00 100644
--- a/xfixes/cursor.c
+++ b/xfixes/cursor.c
@@ -61,7 +61,6 @@
 static RESTYPE CursorClientType;
 static RESTYPE CursorHideCountType;
 static RESTYPE CursorWindowType;
-static CursorPtr CursorCurrent[MAXDEVICES];
 
 static DevPrivateKeyRec CursorScreenPrivateKeyRec;
 
@@ -132,10 +131,26 @@ typedef struct _CursorScreen {
 Bool CursorVisible = FALSE;
 Bool EnableCursor = TRUE;
 
+static CursorPtr
+CursorForDevice(DeviceIntPtr pDev)
+{
+    if (pDev && pDev->spriteInfo && pDev->spriteInfo->sprite)
+        return pDev->spriteInfo->sprite->current;
+
+    return NULL;
+}
+
+static CursorPtr
+CursorForClient(ClientPtr client)
+{
+    return CursorForDevice(PickPointer(client));
+}
+
 static Bool
 CursorDisplayCursor(DeviceIntPtr pDev, ScreenPtr pScreen, CursorPtr pCursor)
 {
     CursorScreenPtr cs = GetCursorScreen(pScreen);
+    CursorPtr pOldCursor = CursorForDevice(pDev);
     Bool ret;
     DisplayCursorProcPtr backupProc;
 
@@ -150,11 +165,10 @@ CursorDisplayCursor(DeviceIntPtr pDev, ScreenPtr pScreen, CursorPtr pCursor)
         ret = (*pScreen->DisplayCursor) (pDev, pScreen, pCursor);
     }
 
-    if (pCursor != CursorCurrent[pDev->id]) {
+    if (pCursor != pOldCursor) {
         CursorEventPtr e;
 
         UpdateCurrentTimeIf();
-        CursorCurrent[pDev->id] = pCursor;
         for (e = cursorEvents; e; e = e->next) {
             if ((e->eventMask & XFixesDisplayCursorNotifyMask)) {
                 xXFixesCursorNotifyEvent ev = {
@@ -350,7 +364,7 @@ ProcXFixesGetCursorImage(ClientPtr client)
     int npixels, width, height, rc, x, y;
 
     REQUEST_SIZE_MATCH(xXFixesGetCursorImageReq);
-    pCursor = CursorCurrent[PickPointer(client)->id];
+    pCursor = CursorForClient(client);
     if (!pCursor)
         return BadCursor;
     rc = XaceHook(XACE_RESOURCE_ACCESS, client, pCursor->id, RT_CURSOR,
@@ -499,7 +513,7 @@ ProcXFixesGetCursorImageAndName(ClientPtr client)
     int rc, x, y;
 
     REQUEST_SIZE_MATCH(xXFixesGetCursorImageAndNameReq);
-    pCursor = CursorCurrent[PickPointer(client)->id];
+    pCursor = CursorForClient(client);
     if (!pCursor)
         return BadCursor;
     rc = XaceHook(XACE_RESOURCE_ACCESS, client, pCursor->id, RT_CURSOR,
@@ -873,7 +887,7 @@ ProcXFixesHideCursor(ClientPtr client)
         for (dev = inputInfo.devices; dev; dev = dev->next) {
             if (IsMaster(dev) && IsPointerDevice(dev))
                 CursorDisplayCursor(dev, pWin->drawable.pScreen,
-                                    CursorCurrent[dev->id]);
+                                    CursorForDevice(dev));
         }
     }
 
@@ -968,7 +982,7 @@ CursorFreeHideCount(void *data, XID id)
     deleteCursorHideCount(pChc, pChc->pScreen);
     for (dev = inputInfo.devices; dev; dev = dev->next) {
         if (IsMaster(dev) && IsPointerDevice(dev))
-            CursorDisplayCursor(dev, pScreen, CursorCurrent[dev->id]);
+            CursorDisplayCursor(dev, pScreen, CursorForDevice(dev));
     }
 
     return 1;
-- 
2.13.0