mi: Bugfix: FreeCursor ignores negative refcounts.

mieq:   Bugfix: Motion notifies did overwrite DeviceMotionNotifies

3 files changed, 14 insertions, 2 deletions

diff --git a/Changelog b/Changelog
index 5482251c4..a9989ebf1 100644
--- a/Changelog
+++ b/Changelog
@@ -1,4 +1,13 @@
 MPX Changelog file
+== 28.11.06 ==
+mi:     Bugfix: FreeCursor ignores negative refcounts.
+
+mieq:   Bugfix: Motion notifies did overwrite DeviceMotionNotifies
+
+Files:
+	dix/cursor.c
+	mi/mieq.c
+
 == 27.11.06 ==
 mi:     free allocated memory in miDCCloseScreen and in miDCInitialize in case
 	of errors.
diff --git a/dix/cursor.c b/dix/cursor.c
index 92297b923..6da763b44 100644
--- a/dix/cursor.c
+++ b/dix/cursor.c
@@ -117,7 +117,10 @@ FreeCursor(pointer value, XID cid)
     ScreenPtr	pscr;
     DeviceIntPtr pDev; 
 
-    if ( --pCurs->refcnt > 0)
+    /* FIXME: MPX: When FreeClientRessources is called, it calls FreeCursor
+     * too often. Refcnt gots < 0 and FreeCursorBits segfaults because the
+     * memory is already freed. */
+    if ( --pCurs->refcnt != 0)
 	return(Success);
 
     pDev = inputInfo.pointer;
diff --git a/mi/mieq.c b/mi/mieq.c
index 40a3a52c5..b40944ee1 100644
--- a/mi/mieq.c
+++ b/mi/mieq.c
@@ -119,7 +119,7 @@ mieqEnqueue(DeviceIntPtr pDev, xEvent *e)
     if (e->u.u.type == MotionNotify)
         isMotion = inputInfo.pointer->id;
     else if (e->u.u.type == DeviceMotionNotify)
-        isMotion = pDev->id;
+        isMotion = pDev->id | (1 << 8); /* flag to indicate DeviceMotion */
 
     /* We silently steal valuator events: just tack them on to the last
      * motion event they need to be attached to.  Sigh. */