Another X memory access bug

There is another memory access bug in the X server that can
potentially crash it.  I'm not absulutely sure whether this can be
triggered in the wild, but I can surely trigger this one by using a
seperate test program linked directly against libfb.a.  And the
pattern is very similar to the earlier bugs.  Looks like this one can
be fixed in a much more elegant way though.

Please test, even if you no longer see any X crashes.  I can't say I
fully know what I'am doing here, so this might cause artifacts.  If
there are artifacts, they're likely to be at the left side of pixmaps,
or cause the pixmaps to be shifted to the right by one or more pixels.

Mark


Index: fbblt.c
===================================================================
RCS file: /cvs/XF4/xc/programs/Xserver/fb/fbblt.c,v
retrieving revision 1.2
diff -u -p -r1.2 fbblt.c
--- fbblt.c 3 Nov 2004 00:07:51 -0000 1.2
+++ fbblt.c 26 Aug 2005 14:10:09 -0000
@@ -267,8 +267,11 @@ fbBlt (FbBits   *srcLine,
 		if (startmask)
 		{
 		    bits = FbScrLeft(bits1, leftShift); 
-		    bits1 = *src++;
-		    bits |= FbScrRight(bits1, rightShift);
+		    if (FbScrLeft(startmask, rightShift))
+		    {
+			bits1 = *src++;
+			bits |= FbScrRight(bits1, rightShift);
+		    }
 		    FbDoLeftMaskByteMergeRop (dst, bits, startbyte, startmask);
 		    dst++;
 		}