(#204362) Security bump. Bump for 1.3 series coming a bit later.

(Portage version: 2.1.4)

9 files changed, 1209 insertions, 2 deletions

diff --git a/x11-base/xorg-server/ChangeLog b/x11-base/xorg-server/ChangeLog
index 031c17fc7b1e..3cb0c6602719 100644
--- a/x11-base/xorg-server/ChangeLog
+++ b/x11-base/xorg-server/ChangeLog
@@ -1,6 +1,18 @@
 # ChangeLog for x11-base/xorg-server
-# Copyright 1999-2007 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/x11-base/xorg-server/ChangeLog,v 1.305 2007/12/16 23:30:23 dberkholz Exp $
+# Copyright 1999-2008 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/x11-base/xorg-server/ChangeLog,v 1.306 2008/01/17 20:52:28 dberkholz Exp $
+
+*xorg-server-1.4.0.90-r1 (17 Jan 2008)
+
+  17 Jan 2008; Donnie Berkholz <dberkholz@gentoo.org>;
+  +files/1.4-0001-Fix-for-CVE-2007-5760-XFree86-Misc-extension-out-o.patch,
+  +files/1.4-0002-Fix-for-CVE-2007-6428-TOG-cup-extension-memory-cor.patch,
+  +files/1.4-0003-Fix-for-CVE-2007-6427-Xinput-extension-memory-corr.patch,
+  +files/1.4-0004-Fix-for-CVE-2007-6429-MIT-SHM-and-EVI-extensions-i.patch,
+  +files/1.4-0005-Fix-for-CVE-2008-0006-PCF-Font-parser-buffer-overf.patch,
+  +files/1.4-0006-Fix-for-CVE-2007-5958-File-existence-disclosure.patch,
+  +xorg-server-1.4.0.90-r1.ebuild:
+  (#204362) Security bump. Bump for 1.3 series coming in a couple hours.
 
   16 Dec 2007; Donnie Berkholz <dberkholz@gentoo.org>;
   xorg-server-1.4.0.90.ebuild:
diff --git a/x11-base/xorg-server/files/1.4-0001-Fix-for-CVE-2007-5760-XFree86-Misc-extension-out-o.patch b/x11-base/xorg-server/files/1.4-0001-Fix-for-CVE-2007-5760-XFree86-Misc-extension-out-o.patch
new file mode 100644
index 000000000000..54dead0ef7f4
--- /dev/null
+++ b/x11-base/xorg-server/files/1.4-0001-Fix-for-CVE-2007-5760-XFree86-Misc-extension-out-o.patch
@@ -0,0 +1,27 @@
+From 59a3b83922c810316a374a19484b24901c7437ae Mon Sep 17 00:00:00 2001
+From: Matthieu Herrb <matthieu@bluenote.herrb.com>
+Date: Thu, 17 Jan 2008 15:26:41 +0100
+Subject: [PATCH] Fix for CVE-2007-5760 - XFree86 Misc extension out of bounds array index
+
+---
+ hw/xfree86/common/xf86MiscExt.c |    4 ++++
+ 1 files changed, 4 insertions(+), 0 deletions(-)
+
+diff --git a/hw/xfree86/common/xf86MiscExt.c b/hw/xfree86/common/xf86MiscExt.c
+index c1b9c60..40c196a 100644
+--- a/hw/xfree86/common/xf86MiscExt.c
++++ b/hw/xfree86/common/xf86MiscExt.c
+@@ -548,6 +548,10 @@ MiscExtPassMessage(int scrnIndex, const char *msgtype, const char *msgval,
+ {
+     ScrnInfoPtr pScr = xf86Screens[scrnIndex];
+ 
++    /* should check this in the protocol, but xf86NumScreens isn't exported */
++    if (scrnIndex >= xf86NumScreens)
++	return BadValue;
++
+     if (*pScr->HandleMessage == NULL)
+ 	    return BadImplementation;
+     return (*pScr->HandleMessage)(scrnIndex, msgtype, msgval, retstr);
+-- 
+1.5.3.5
+
diff --git a/x11-base/xorg-server/files/1.4-0002-Fix-for-CVE-2007-6428-TOG-cup-extension-memory-cor.patch b/x11-base/xorg-server/files/1.4-0002-Fix-for-CVE-2007-6428-TOG-cup-extension-memory-cor.patch
new file mode 100644
index 000000000000..a72ce3c3ce21
--- /dev/null
+++ b/x11-base/xorg-server/files/1.4-0002-Fix-for-CVE-2007-6428-TOG-cup-extension-memory-cor.patch
@@ -0,0 +1,26 @@
+From 4848d49d05a318559afe7a17a19ba055947ee1f5 Mon Sep 17 00:00:00 2001
+From: Matthieu Herrb <matthieu@bluenote.herrb.com>
+Date: Thu, 17 Jan 2008 15:28:03 +0100
+Subject: [PATCH] Fix for CVE-2007-6428 - TOG-cup extension memory corruption.
+
+---
+ Xext/cup.c |    3 +++
+ 1 files changed, 3 insertions(+), 0 deletions(-)
+
+diff --git a/Xext/cup.c b/Xext/cup.c
+index 6bfa278..781b9ce 100644
+--- a/Xext/cup.c
++++ b/Xext/cup.c
+@@ -196,6 +196,9 @@ int ProcGetReservedColormapEntries(
+ 
+     REQUEST_SIZE_MATCH (xXcupGetReservedColormapEntriesReq);
+ 
++    if (stuff->screen >= screenInfo.numScreens)
++	return BadValue;
++
+ #ifndef HAVE_SPECIAL_DESKTOP_COLORS
+     citems[CUP_BLACK_PIXEL].pixel = 
+ 	screenInfo.screens[stuff->screen]->blackPixel;
+-- 
+1.5.3.5
+
diff --git a/x11-base/xorg-server/files/1.4-0003-Fix-for-CVE-2007-6427-Xinput-extension-memory-corr.patch b/x11-base/xorg-server/files/1.4-0003-Fix-for-CVE-2007-6427-Xinput-extension-memory-corr.patch
new file mode 100644
index 000000000000..ffbf8ac4dff0
--- /dev/null
+++ b/x11-base/xorg-server/files/1.4-0003-Fix-for-CVE-2007-6427-Xinput-extension-memory-corr.patch
@@ -0,0 +1,262 @@
+From d244c8272e0ac47c41a9416e37293903b842a78b Mon Sep 17 00:00:00 2001
+From: Matthieu Herrb <matthieu@bluenote.herrb.com>
+Date: Thu, 17 Jan 2008 15:27:34 +0100
+Subject: [PATCH] Fix for CVE-2007-6427 - Xinput extension memory corruption.
+
+---
+ Xi/chgfctl.c  |    7 +------
+ Xi/chgkmap.c  |   13 ++++++-------
+ Xi/chgprop.c  |   10 +++-------
+ Xi/grabdev.c  |   12 +++++-------
+ Xi/grabdevb.c |   10 +++-------
+ Xi/grabdevk.c |    9 ++-------
+ Xi/selectev.c |   11 ++++-------
+ Xi/sendexev.c |   14 ++++++++------
+ 8 files changed, 32 insertions(+), 54 deletions(-)
+
+diff --git a/Xi/chgfctl.c b/Xi/chgfctl.c
+index 2e0e13c..235d659 100644
+--- a/Xi/chgfctl.c
++++ b/Xi/chgfctl.c
+@@ -327,18 +327,13 @@ ChangeStringFeedback(ClientPtr client, DeviceIntPtr dev,
+ 		     xStringFeedbackCtl * f)
+ {
+     char n;
+-    long *p;
+     int i, j;
+     KeySym *syms, *sup_syms;
+ 
+     syms = (KeySym *) (f + 1);
+     if (client->swapped) {
+ 	swaps(&f->length, n);	/* swapped num_keysyms in calling proc */
+-	p = (long *)(syms);
+-	for (i = 0; i < f->num_keysyms; i++) {
+-	    swapl(p, n);
+-	    p++;
+-	}
++	SwapLongs((CARD32 *) syms, f->num_keysyms);
+     }
+ 
+     if (f->num_keysyms > s->ctrl.max_symbols) {
+diff --git a/Xi/chgkmap.c b/Xi/chgkmap.c
+index eac520f..f8f85bc 100644
+--- a/Xi/chgkmap.c
++++ b/Xi/chgkmap.c
+@@ -79,18 +79,14 @@ int
+ SProcXChangeDeviceKeyMapping(ClientPtr client)
+ {
+     char n;
+-    long *p;
+-    int i, count;
++    unsigned int count;
+ 
+     REQUEST(xChangeDeviceKeyMappingReq);
+     swaps(&stuff->length, n);
+     REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq);
+-    p = (long *)&stuff[1];
+     count = stuff->keyCodes * stuff->keySymsPerKeyCode;
+-    for (i = 0; i < count; i++) {
+-	swapl(p, n);
+-	p++;
+-    }
++    REQUEST_FIXED_SIZE(xChangeDeviceKeyMappingReq, count * sizeof(CARD32));
++    SwapLongs((CARD32 *) (&stuff[1]), count);
+     return (ProcXChangeDeviceKeyMapping(client));
+ }
+ 
+@@ -106,10 +102,13 @@ ProcXChangeDeviceKeyMapping(ClientPtr client)
+     int ret;
+     unsigned len;
+     DeviceIntPtr dev;
++    unsigned int count;
+ 
+     REQUEST(xChangeDeviceKeyMappingReq);
+     REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq);
+ 
++    count = stuff->keyCodes * stuff->keySymsPerKeyCode;
++    REQUEST_FIXED_SIZE(xChangeDeviceKeyMappingReq, count * sizeof(CARD32));
+     dev = LookupDeviceIntRec(stuff->deviceid);
+     if (dev == NULL) {
+ 	SendErrorToClient(client, IReqCode, X_ChangeDeviceKeyMapping, 0,
+diff --git a/Xi/chgprop.c b/Xi/chgprop.c
+index 59a93c6..21bda5b 100644
+--- a/Xi/chgprop.c
++++ b/Xi/chgprop.c
+@@ -81,19 +81,15 @@ int
+ SProcXChangeDeviceDontPropagateList(ClientPtr client)
+ {
+     char n;
+-    long *p;
+-    int i;
+ 
+     REQUEST(xChangeDeviceDontPropagateListReq);
+     swaps(&stuff->length, n);
+     REQUEST_AT_LEAST_SIZE(xChangeDeviceDontPropagateListReq);
+     swapl(&stuff->window, n);
+     swaps(&stuff->count, n);
+-    p = (long *)&stuff[1];
+-    for (i = 0; i < stuff->count; i++) {
+-	swapl(p, n);
+-	p++;
+-    }
++    REQUEST_FIXED_SIZE(xChangeDeviceDontPropagateListReq,
++                      stuff->count * sizeof(CARD32));
++    SwapLongs((CARD32 *) (&stuff[1]), stuff->count);
+     return (ProcXChangeDeviceDontPropagateList(client));
+ }
+ 
+diff --git a/Xi/grabdev.c b/Xi/grabdev.c
+index e2809ef..d0b4ae7 100644
+--- a/Xi/grabdev.c
++++ b/Xi/grabdev.c
+@@ -82,8 +82,6 @@ int
+ SProcXGrabDevice(ClientPtr client)
+ {
+     char n;
+-    long *p;
+-    int i;
+ 
+     REQUEST(xGrabDeviceReq);
+     swaps(&stuff->length, n);
+@@ -91,11 +89,11 @@ SProcXGrabDevice(ClientPtr client)
+     swapl(&stuff->grabWindow, n);
+     swapl(&stuff->time, n);
+     swaps(&stuff->event_count, n);
+-    p = (long *)&stuff[1];
+-    for (i = 0; i < stuff->event_count; i++) {
+-	swapl(p, n);
+-	p++;
+-    }
++
++    if (stuff->length != (sizeof(xGrabDeviceReq) >> 2) + stuff->event_count)
++       return BadLength;
++    
++    SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);
+ 
+     return (ProcXGrabDevice(client));
+ }
+diff --git a/Xi/grabdevb.c b/Xi/grabdevb.c
+index df62d0c..18db1f7 100644
+--- a/Xi/grabdevb.c
++++ b/Xi/grabdevb.c
+@@ -80,8 +80,6 @@ int
+ SProcXGrabDeviceButton(ClientPtr client)
+ {
+     char n;
+-    long *p;
+-    int i;
+ 
+     REQUEST(xGrabDeviceButtonReq);
+     swaps(&stuff->length, n);
+@@ -89,11 +87,9 @@ SProcXGrabDeviceButton(ClientPtr client)
+     swapl(&stuff->grabWindow, n);
+     swaps(&stuff->modifiers, n);
+     swaps(&stuff->event_count, n);
+-    p = (long *)&stuff[1];
+-    for (i = 0; i < stuff->event_count; i++) {
+-	swapl(p, n);
+-	p++;
+-    }
++    REQUEST_FIXED_SIZE(xGrabDeviceButtonReq,
++                      stuff->event_count * sizeof(CARD32));
++    SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);
+ 
+     return (ProcXGrabDeviceButton(client));
+ }
+diff --git a/Xi/grabdevk.c b/Xi/grabdevk.c
+index b74592f..429b2f7 100644
+--- a/Xi/grabdevk.c
++++ b/Xi/grabdevk.c
+@@ -80,8 +80,6 @@ int
+ SProcXGrabDeviceKey(ClientPtr client)
+ {
+     char n;
+-    long *p;
+-    int i;
+ 
+     REQUEST(xGrabDeviceKeyReq);
+     swaps(&stuff->length, n);
+@@ -89,11 +87,8 @@ SProcXGrabDeviceKey(ClientPtr client)
+     swapl(&stuff->grabWindow, n);
+     swaps(&stuff->modifiers, n);
+     swaps(&stuff->event_count, n);
+-    p = (long *)&stuff[1];
+-    for (i = 0; i < stuff->event_count; i++) {
+-	swapl(p, n);
+-	p++;
+-    }
++    REQUEST_FIXED_SIZE(xGrabDeviceKeyReq, stuff->event_count * sizeof(CARD32));
++    SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);
+     return (ProcXGrabDeviceKey(client));
+ }
+ 
+diff --git a/Xi/selectev.c b/Xi/selectev.c
+index d52db1b..19415c5 100644
+--- a/Xi/selectev.c
++++ b/Xi/selectev.c
+@@ -131,19 +131,16 @@ int
+ SProcXSelectExtensionEvent(ClientPtr client)
+ {
+     char n;
+-    long *p;
+-    int i;
+ 
+     REQUEST(xSelectExtensionEventReq);
+     swaps(&stuff->length, n);
+     REQUEST_AT_LEAST_SIZE(xSelectExtensionEventReq);
+     swapl(&stuff->window, n);
+     swaps(&stuff->count, n);
+-    p = (long *)&stuff[1];
+-    for (i = 0; i < stuff->count; i++) {
+-	swapl(p, n);
+-	p++;
+-    }
++    REQUEST_FIXED_SIZE(xSelectExtensionEventReq,
++                      stuff->count * sizeof(CARD32));
++    SwapLongs((CARD32 *) (&stuff[1]), stuff->count);
++
+     return (ProcXSelectExtensionEvent(client));
+ }
+ 
+diff --git a/Xi/sendexev.c b/Xi/sendexev.c
+index eac9abe..9803cf3 100644
+--- a/Xi/sendexev.c
++++ b/Xi/sendexev.c
+@@ -83,7 +83,7 @@ int
+ SProcXSendExtensionEvent(ClientPtr client)
+ {
+     char n;
+-    long *p;
++    CARD32 *p;
+     int i;
+     xEvent eventT;
+     xEvent *eventP;
+@@ -94,6 +94,11 @@ SProcXSendExtensionEvent(ClientPtr client)
+     REQUEST_AT_LEAST_SIZE(xSendExtensionEventReq);
+     swapl(&stuff->destination, n);
+     swaps(&stuff->count, n);
++
++    if (stuff->length != (sizeof(xSendExtensionEventReq) >> 2) + stuff->count +
++       (stuff->num_events * (sizeof(xEvent) >> 2)))
++       return BadLength;
++
+     eventP = (xEvent *) & stuff[1];
+     for (i = 0; i < stuff->num_events; i++, eventP++) {
+ 	proc = EventSwapVector[eventP->u.u.type & 0177];
+@@ -103,11 +108,8 @@ SProcXSendExtensionEvent(ClientPtr client)
+ 	*eventP = eventT;
+     }
+ 
+-    p = (long *)(((xEvent *) & stuff[1]) + stuff->num_events);
+-    for (i = 0; i < stuff->count; i++) {
+-	swapl(p, n);
+-	p++;
+-    }
++    p = (CARD32 *)(((xEvent *) & stuff[1]) + stuff->num_events);
++    SwapLongs(p, stuff->count);
+     return (ProcXSendExtensionEvent(client));
+ }
+ 
+-- 
+1.5.3.5
+
diff --git a/x11-base/xorg-server/files/1.4-0004-Fix-for-CVE-2007-6429-MIT-SHM-and-EVI-extensions-i.patch b/x11-base/xorg-server/files/1.4-0004-Fix-for-CVE-2007-6429-MIT-SHM-and-EVI-extensions-i.patch
new file mode 100644
index 000000000000..ac66b4de8f62
--- /dev/null
+++ b/x11-base/xorg-server/files/1.4-0004-Fix-for-CVE-2007-6429-MIT-SHM-and-EVI-extensions-i.patch
@@ -0,0 +1,210 @@
+From 8b14f7b74284900b95a319ec80c4333e63af2296 Mon Sep 17 00:00:00 2001
+From: Matthieu Herrb <matthieu@bluenote.herrb.com>
+Date: Thu, 17 Jan 2008 15:28:42 +0100
+Subject: [PATCH] Fix for CVE-2007-6429 - MIT-SHM and EVI extensions integer overflows.
+
+---
+ Xext/EVI.c       |   15 ++++++++++++++-
+ Xext/sampleEVI.c |   29 ++++++++++++++++++++++++-----
+ Xext/shm.c       |   46 ++++++++++++++++++++++++++++++++++++++--------
+ 3 files changed, 76 insertions(+), 14 deletions(-)
+
+diff --git a/Xext/EVI.c b/Xext/EVI.c
+index 8fe3481..13bd32a 100644
+--- a/Xext/EVI.c
++++ b/Xext/EVI.c
+@@ -34,6 +34,7 @@ THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ #include <X11/extensions/XEVIstr.h>
+ #include "EVIstruct.h"
+ #include "modinit.h"
++#include "scrnintstr.h"
+ 
+ #if 0
+ static unsigned char XEVIReqCode = 0;
+@@ -87,10 +88,22 @@ ProcEVIGetVisualInfo(ClientPtr client)
+ {
+     REQUEST(xEVIGetVisualInfoReq);
+     xEVIGetVisualInfoReply rep;
+-    int n, n_conflict, n_info, sz_info, sz_conflict;
++    int i, n, n_conflict, n_info, sz_info, sz_conflict;
+     VisualID32 *conflict;
++    unsigned int total_visuals = 0;
+     xExtendedVisualInfo *eviInfo;
+     int status;
++
++    /*
++     * do this first, otherwise REQUEST_FIXED_SIZE can overflow.  we assume
++     * here that you don't have more than 2^32 visuals over all your screens;
++     * this seems like a safe assumption.
++     */
++    for (i = 0; i < screenInfo.numScreens; i++)
++	total_visuals += screenInfo.screens[i]->numVisuals;
++    if (stuff->n_visual > total_visuals)
++	return BadValue;
++
+     REQUEST_FIXED_SIZE(xEVIGetVisualInfoReq, stuff->n_visual * sz_VisualID32);
+     status = eviPriv->getVisualInfo((VisualID32 *)&stuff[1], (int)stuff->n_visual,
+ 		&eviInfo, &n_info, &conflict, &n_conflict);
+diff --git a/Xext/sampleEVI.c b/Xext/sampleEVI.c
+index 7508aa7..b871bfd 100644
+--- a/Xext/sampleEVI.c
++++ b/Xext/sampleEVI.c
+@@ -34,6 +34,13 @@ THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ #include <X11/extensions/XEVIstr.h>
+ #include "EVIstruct.h"
+ #include "scrnintstr.h"
++
++#if HAVE_STDINT_H
++#include <stdint.h>
++#elif !defined(UINT32_MAX)
++#define UINT32_MAX 0xffffffffU
++#endif
++
+ static int sampleGetVisualInfo(
+     VisualID32 *visual,
+     int n_visual,
+@@ -42,24 +49,36 @@ static int sampleGetVisualInfo(
+     VisualID32 **conflict_rn,
+     int *n_conflict_rn)
+ {
+-    int max_sz_evi = n_visual * sz_xExtendedVisualInfo * screenInfo.numScreens;
++    unsigned int max_sz_evi;
+     VisualID32 *temp_conflict;
+     xExtendedVisualInfo *evi;
+-    int max_visuals = 0, max_sz_conflict, sz_conflict = 0;
++    unsigned int max_visuals = 0, max_sz_conflict, sz_conflict = 0;
+     register int visualI, scrI, sz_evi = 0, conflictI, n_conflict;
+-    *evi_rn = evi = (xExtendedVisualInfo *)xalloc(max_sz_evi);
+-    if (!*evi_rn)
+-         return BadAlloc;
++
++    if (n_visual > UINT32_MAX/(sz_xExtendedVisualInfo * screenInfo.numScreens))
++	return BadAlloc;
++    max_sz_evi = n_visual * sz_xExtendedVisualInfo * screenInfo.numScreens;
++    
+     for (scrI = 0; scrI < screenInfo.numScreens; scrI++) {
+         if (screenInfo.screens[scrI]->numVisuals > max_visuals)
+             max_visuals = screenInfo.screens[scrI]->numVisuals;
+     }
++
++    if (n_visual > UINT32_MAX/(sz_VisualID32 * screenInfo.numScreens 
++			       * max_visuals)) 
++	return BadAlloc;
+     max_sz_conflict = n_visual * sz_VisualID32 * screenInfo.numScreens * max_visuals;
++
++    *evi_rn = evi = (xExtendedVisualInfo *)xalloc(max_sz_evi);
++    if (!*evi_rn)
++         return BadAlloc;
++
+     temp_conflict = (VisualID32 *)xalloc(max_sz_conflict);
+     if (!temp_conflict) {
+         xfree(*evi_rn);
+         return BadAlloc;
+     }
++
+     for (scrI = 0; scrI < screenInfo.numScreens; scrI++) {
+         for (visualI = 0; visualI < n_visual; visualI++) {
+ 	    evi[sz_evi].core_visual_id = visual[visualI];
+diff --git a/Xext/shm.c b/Xext/shm.c
+index ac587be..5633be9 100644
+--- a/Xext/shm.c
++++ b/Xext/shm.c
+@@ -711,6 +711,8 @@ ProcPanoramiXShmCreatePixmap(
+     int i, j, result, rc;
+     ShmDescPtr shmdesc;
+     REQUEST(xShmCreatePixmapReq);
++    unsigned int width, height, depth;
++    unsigned long size;
+     PanoramiXRes *newPix;
+ 
+     REQUEST_SIZE_MATCH(xShmCreatePixmapReq);
+@@ -724,11 +726,26 @@ ProcPanoramiXShmCreatePixmap(
+ 	return rc;
+ 
+     VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client);
+-    if (!stuff->width || !stuff->height)
++
++    width = stuff->width;
++    height = stuff->height;
++    depth = stuff->depth;
++    if (!width || !height || !depth)
+     {
+ 	client->errorValue = 0;
+         return BadValue;
+     }
++    if (width > 32767 || height > 32767)
++        return BadAlloc;
++    size = PixmapBytePad(width, depth) * height;
++    if (sizeof(size) == 4) {
++        if (size < width * height)
++            return BadAlloc;
++        /* thankfully, offset is unsigned */
++        if (stuff->offset + size < size)
++            return BadAlloc;
++    }
++
+     if (stuff->depth != 1)
+     {
+         pDepth = pDraw->pScreen->allowedDepths;
+@@ -739,9 +756,7 @@ ProcPanoramiXShmCreatePixmap(
+         return BadValue;
+     }
+ CreatePmap:
+-    VERIFY_SHMSIZE(shmdesc, stuff->offset,
+-		   PixmapBytePad(stuff->width, stuff->depth) * stuff->height,
+-		   client);
++    VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
+ 
+     if(!(newPix = (PanoramiXRes *) xalloc(sizeof(PanoramiXRes))))
+ 	return BadAlloc;
+@@ -1040,6 +1055,8 @@ ProcShmCreatePixmap(client)
+     register int i, rc;
+     ShmDescPtr shmdesc;
+     REQUEST(xShmCreatePixmapReq);
++    unsigned int width, height, depth;
++    unsigned long size;
+ 
+     REQUEST_SIZE_MATCH(xShmCreatePixmapReq);
+     client->errorValue = stuff->pid;
+@@ -1052,11 +1069,26 @@ ProcShmCreatePixmap(client)
+ 	return rc;
+ 
+     VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client);
+-    if (!stuff->width || !stuff->height)
++    
++    width = stuff->width;
++    height = stuff->height;
++    depth = stuff->depth;
++    if (!width || !height || !depth)
+     {
+ 	client->errorValue = 0;
+         return BadValue;
+     }
++    if (width > 32767 || height > 32767)
++	return BadAlloc;
++    size = PixmapBytePad(width, depth) * height;
++    if (sizeof(size) == 4) {
++	if (size < width * height)
++	    return BadAlloc;
++	/* thankfully, offset is unsigned */
++	if (stuff->offset + size < size)
++	    return BadAlloc;
++    }
++
+     if (stuff->depth != 1)
+     {
+         pDepth = pDraw->pScreen->allowedDepths;
+@@ -1067,9 +1099,7 @@ ProcShmCreatePixmap(client)
+         return BadValue;
+     }
+ CreatePmap:
+-    VERIFY_SHMSIZE(shmdesc, stuff->offset,
+-		   PixmapBytePad(stuff->width, stuff->depth) * stuff->height,
+-		   client);
++    VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
+     pMap = (*shmFuncs[pDraw->pScreen->myNum]->CreatePixmap)(
+ 			    pDraw->pScreen, stuff->width,
+ 			    stuff->height, stuff->depth,
+-- 
+1.5.3.5
+
diff --git a/x11-base/xorg-server/files/1.4-0005-Fix-for-CVE-2008-0006-PCF-Font-parser-buffer-overf.patch b/x11-base/xorg-server/files/1.4-0005-Fix-for-CVE-2008-0006-PCF-Font-parser-buffer-overf.patch
new file mode 100644
index 000000000000..bb09eb8368f6
--- /dev/null
+++ b/x11-base/xorg-server/files/1.4-0005-Fix-for-CVE-2008-0006-PCF-Font-parser-buffer-overf.patch
@@ -0,0 +1,30 @@
+From f09b8007e7f6e60e0b9c9665ec632b578ae08b6f Mon Sep 17 00:00:00 2001
+From: Matthieu Herrb <matthieu@bluenote.herrb.com>
+Date: Thu, 17 Jan 2008 15:29:06 +0100
+Subject: [PATCH] Fix for CVE-2008-0006 - PCF Font parser buffer overflow.
+
+---
+ dix/dixfonts.c |    7 +++++++
+ 1 files changed, 7 insertions(+), 0 deletions(-)
+
+diff --git a/dix/dixfonts.c b/dix/dixfonts.c
+index c21b3ec..7bb2404 100644
+--- a/dix/dixfonts.c
++++ b/dix/dixfonts.c
+@@ -325,6 +325,13 @@ doOpenFont(ClientPtr client, OFclosurePtr c)
+ 	err = BadFontName;
+ 	goto bail;
+     }
++    /* check values for firstCol, lastCol, firstRow, and lastRow */
++    if (pfont->info.firstCol > pfont->info.lastCol ||
++       pfont->info.firstRow > pfont->info.lastRow ||
++       pfont->info.lastCol - pfont->info.firstCol > 255) {
++       err = AllocError;
++       goto bail;
++    }
+     if (!pfont->fpe)
+ 	pfont->fpe = fpe;
+     pfont->refcnt++;
+-- 
+1.5.3.5
+
diff --git a/x11-base/xorg-server/files/1.4-0006-Fix-for-CVE-2007-5958-File-existence-disclosure.patch b/x11-base/xorg-server/files/1.4-0006-Fix-for-CVE-2007-5958-File-existence-disclosure.patch
new file mode 100644
index 000000000000..61cc4da755d8
--- /dev/null
+++ b/x11-base/xorg-server/files/1.4-0006-Fix-for-CVE-2007-5958-File-existence-disclosure.patch
@@ -0,0 +1,34 @@
+From 19b95cdd1d14a1e7d1abba1880ab023c96f19bf5 Mon Sep 17 00:00:00 2001
+From: Matthieu Herrb <matthieu@bluenote.herrb.com>
+Date: Thu, 17 Jan 2008 17:03:39 +0100
+Subject: [PATCH] Fix for CVE-2007-5958 - File existence disclosure.
+
+---
+ Xext/security.c |    4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/Xext/security.c b/Xext/security.c
+index ba057de..e9d48c9 100644
+--- a/Xext/security.c
++++ b/Xext/security.c
+@@ -1563,7 +1563,7 @@ SecurityLoadPropertyAccessList(void)
+     if (!SecurityPolicyFile)
+ 	return;
+ 
+-    f = fopen(SecurityPolicyFile, "r");
++    f = Fopen(SecurityPolicyFile, "r");
+     if (!f)
+     {
+ 	ErrorF("error opening security policy file %s\n",
+@@ -1646,7 +1646,7 @@ SecurityLoadPropertyAccessList(void)
+     }
+ #endif /* PROPDEBUG */
+ 
+-    fclose(f);
++    Fclose(f);
+ } /* SecurityLoadPropertyAccessList */
+ 
+ 
+-- 
+1.5.3.5
+
diff --git a/x11-base/xorg-server/files/digest-xorg-server-1.4.0.90-r1 b/x11-base/xorg-server/files/digest-xorg-server-1.4.0.90-r1
new file mode 100644
index 000000000000..dba77fdbaad4
--- /dev/null
+++ b/x11-base/xorg-server/files/digest-xorg-server-1.4.0.90-r1
@@ -0,0 +1,6 @@
+MD5 93e6ed7924ff069a4f883b4fce5349dc MesaLib-7.0.2.tar.bz2 3353217
+RMD160 3d471062b60889baef48a1a4596de6e32e1530cf MesaLib-7.0.2.tar.bz2 3353217
+SHA256 9d4707b556960f6aef14480f91fcd4f868720f64321947ab1b2fd20e85ce7f9e MesaLib-7.0.2.tar.bz2 3353217
+MD5 bb16e969850dbb5d3805cb88d35656d0 xorg-server-1.4.0.90.tar.bz2 6315011
+RMD160 181b3c682710265df3c6ed30e164be9290f1f39e xorg-server-1.4.0.90.tar.bz2 6315011
+SHA256 b89f2d17be5ba71e3cc25379e18155c55ea36ba94ac1abae953214f13c020ffe xorg-server-1.4.0.90.tar.bz2 6315011
diff --git a/x11-base/xorg-server/xorg-server-1.4.0.90-r1.ebuild b/x11-base/xorg-server/xorg-server-1.4.0.90-r1.ebuild
new file mode 100644
index 000000000000..c290f83c714f
--- /dev/null
+++ b/x11-base/xorg-server/xorg-server-1.4.0.90-r1.ebuild
@@ -0,0 +1,600 @@
+# Copyright 1999-2008 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/x11-base/xorg-server/xorg-server-1.4.0.90-r1.ebuild,v 1.1 2008/01/17 20:52:28 dberkholz Exp $
+
+# Must be before x-modular eclass is inherited
+#SNAPSHOT="yes"
+
+inherit x-modular multilib
+
+OPENGL_DIR="xorg-x11"
+
+MESA_PN="Mesa"
+MESA_PV="7.0.2"
+MESA_P="${MESA_PN}-${MESA_PV}"
+MESA_SRC_P="${MESA_PN}Lib-${MESA_PV}"
+
+SRC_URI="${SRC_URI}
+	mirror://sourceforge/mesa3d/${MESA_SRC_P}.tar.bz2
+	http://xorg.freedesktop.org/releases/individual/xserver/${P}.tar.bz2"
+DESCRIPTION="X.Org X servers"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~sh ~sparc ~x86 ~x86-fbsd"
+IUSE_INPUT_DEVICES="
+	input_devices_acecad
+	input_devices_aiptek
+	input_devices_calcomp
+	input_devices_citron
+	input_devices_digitaledge
+	input_devices_dmc
+	input_devices_dynapro
+	input_devices_elo2300
+	input_devices_elographics
+	input_devices_evdev
+	input_devices_fpit
+	input_devices_hyperpen
+	input_devices_jamstudio
+	input_devices_joystick
+	input_devices_keyboard
+	input_devices_magellan
+	input_devices_microtouch
+	input_devices_mouse
+	input_devices_mutouch
+	input_devices_palmax
+	input_devices_penmount
+	input_devices_spaceorb
+	input_devices_summa
+	input_devices_tek4957
+	input_devices_ur98
+	input_devices_vmmouse
+	input_devices_void
+
+	input_devices_synaptics
+	input_devices_wacom"
+IUSE_VIDEO_CARDS="
+	video_cards_amd
+	video_cards_apm
+	video_cards_ark
+	video_cards_chips
+	video_cards_cirrus
+	video_cards_cyrix
+	video_cards_dummy
+	video_cards_epson
+	video_cards_fbdev
+	video_cards_glint
+	video_cards_i128
+	video_cards_i740
+	video_cards_i810
+	video_cards_impact
+	video_cards_imstt
+	video_cards_mach64
+	video_cards_mga
+	video_cards_neomagic
+	video_cards_newport
+	video_cards_nsc
+	video_cards_nv
+	video_cards_r128
+	video_cards_radeon
+	video_cards_rendition
+	video_cards_s3
+	video_cards_s3virge
+	video_cards_savage
+	video_cards_siliconmotion
+	video_cards_sis
+	video_cards_sisusb
+	video_cards_sunbw2
+	video_cards_suncg14
+	video_cards_suncg3
+	video_cards_suncg6
+	video_cards_sunffb
+	video_cards_sunleo
+	video_cards_suntcx
+	video_cards_tdfx
+	video_cards_tga
+	video_cards_trident
+	video_cards_tseng
+	video_cards_v4l
+	video_cards_vermilion
+	video_cards_vesa
+	video_cards_vga
+	video_cards_via
+	video_cards_vmware
+	video_cards_voodoo
+	video_cards_xgi
+	video_cards_fglrx
+	video_cards_nvidia"
+IUSE_SERVERS="dmx kdrive xorg"
+IUSE="${IUSE_VIDEO_CARDS}
+	${IUSE_INPUT_DEVICES}
+	${IUSE_SERVERS}
+	3dfx
+	dri hal ipv6 minimal nptl sdl xprint"
+RDEPEND="hal? ( sys-apps/hal )
+	>=x11-libs/libXfont-1.3.1
+	>=x11-libs/xtrans-1.0.4
+	>=x11-libs/libXau-1.0.3
+	>=x11-libs/libXext-1.0.2
+	>=x11-libs/libX11-1.1.3
+	>=x11-libs/libxkbfile-1.0.4
+	>=x11-libs/libXdmcp-1.0.2
+	>=x11-libs/libXmu-1.0.3
+	>=x11-libs/libXrender-0.9.4
+	>=x11-libs/libXi-1.1.3
+	>=x11-libs/pixman-0.9.5
+	media-libs/freetype
+	>=media-libs/mesa-7.0.1
+	media-fonts/font-adobe-75dpi
+	media-fonts/font-misc-misc
+	media-fonts/font-cursor-misc
+	>=x11-misc/xbitmaps-1.0.1
+	>=x11-misc/xkeyboard-config-0.9
+	>=x11-apps/iceauth-1.0.2
+	>=x11-apps/rgb-1.0.1
+	>=x11-apps/xauth-1.0.2
+	>=x11-apps/xinit-1.0.5
+	app-admin/eselect-opengl
+	>=x11-libs/libXaw-1.0.4
+	>=x11-libs/libXpm-3.5.7
+	>=x11-libs/libXxf86misc-1.0.1
+	>=x11-libs/libXxf86vm-1.0.1
+	dmx? ( >=x11-libs/libdmx-1.0.2
+			>=x11-libs/libXfixes-4.0.3 )
+	!minimal? ( >=x11-libs/libXtst-1.0.3
+		>=x11-libs/libXres-1.0.3 )
+	>=x11-libs/libxkbui-1.0.2
+	>=x11-libs/liblbxutil-1.0.1
+	kdrive? ( sdl? ( media-libs/libsdl ) )"
+	# Xres is dmx-dependent, xkbui is xorgcfg-dependent
+	# Xaw is dmx- and xorgcfg-dependent
+	# Xpm is dmx- and xorgcfg-dependent, pulls in Xt
+	# Xxf86misc and Xxf86vm are xorgcfg-dependent
+	# liblbxutil is lbx- dependent
+DEPEND="${RDEPEND}
+	!net-dialup/dtrace
+	>=x11-proto/randrproto-1.2.1
+	>=x11-proto/renderproto-0.9.3
+	>=x11-proto/fixesproto-4
+	>=x11-proto/damageproto-1.1
+	>=x11-proto/xextproto-7.0.2
+	>=x11-proto/xproto-7.0.10
+	>=x11-proto/xf86dgaproto-2.0.3
+	>=x11-proto/xf86miscproto-0.9.2
+	>=x11-proto/xf86rushproto-1.1.2
+	>=x11-proto/xf86vidmodeproto-2.2.2
+	>=x11-proto/xf86bigfontproto-1.1.2
+	>=x11-proto/compositeproto-0.4
+	>=x11-proto/recordproto-1.13.2
+	>=x11-proto/resourceproto-1.0.2
+	>=x11-proto/videoproto-2.2.2
+	>=x11-proto/scrnsaverproto-1.1.0
+	>=x11-proto/evieext-1.0.2
+	>=x11-proto/trapproto-3.4.3
+	>=x11-proto/xineramaproto-1.1-r1
+	>=x11-proto/fontsproto-2.0.2
+	>=x11-proto/kbproto-1.0.3
+	>=x11-proto/inputproto-1.4.2.1
+	>=x11-proto/bigreqsproto-1.0.2
+	>=x11-proto/xcmiscproto-1.1.2
+	>=x11-proto/glproto-1.4.8
+	dmx? ( >=x11-proto/dmxproto-2.2.2 )
+	dri? ( >=x11-proto/xf86driproto-2.0.3
+		>=x11-libs/libdrm-2.3 )
+	xprint? ( >=x11-proto/printproto-1.0.3
+		>=x11-apps/mkfontdir-1.0.3
+		>=x11-apps/mkfontscale-1.0.3
+		>=x11-apps/xplsprinters-1.0.1 )"
+
+# Drivers
+PDEPEND="
+	xorg? (
+		input_devices_acecad? ( >=x11-drivers/xf86-input-acecad-1.1.0 )
+		input_devices_aiptek? ( >=x11-drivers/xf86-input-aiptek-1.0.1 )
+		input_devices_calcomp? ( >=x11-drivers/xf86-input-calcomp-1.1.1 )
+		input_devices_citron? ( >=x11-drivers/xf86-input-citron-2.2.1 )
+		input_devices_digitaledge? ( >=x11-drivers/xf86-input-digitaledge-1.1.0 )
+		input_devices_dmc? ( >=x11-drivers/xf86-input-dmc-1.1.0 )
+		input_devices_dynapro? ( >=x11-drivers/xf86-input-dynapro-1.1.1 )
+		input_devices_elo2300? ( >=x11-drivers/xf86-input-elo2300-1.1.1 )
+		input_devices_elographics? ( >=x11-drivers/xf86-input-elographics-1.1.0 )
+		input_devices_evdev? ( >=x11-drivers/xf86-input-evdev-1.1.1 )
+		input_devices_fpit? ( >=x11-drivers/xf86-input-fpit-1.1.0 )
+		input_devices_hyperpen? ( >=x11-drivers/xf86-input-hyperpen-1.1.0 )
+		input_devices_jamstudio? ( >=x11-drivers/xf86-input-jamstudio-1.1.0 )
+		input_devices_joystick? ( >=x11-drivers/xf86-input-joystick-1.1.0 )
+		input_devices_keyboard? ( >=x11-drivers/xf86-input-keyboard-1.2.0 )
+		input_devices_magellan? ( >=x11-drivers/xf86-input-magellan-1.1.1 )
+		input_devices_microtouch? ( >=x11-drivers/xf86-input-microtouch-1.1.1 )
+		input_devices_mouse? ( >=x11-drivers/xf86-input-mouse-1.1.0 )
+		input_devices_mutouch? ( >=x11-drivers/xf86-input-mutouch-1.1.0 )
+		input_devices_palmax? ( >=x11-drivers/xf86-input-palmax-1.1.0 )
+		input_devices_penmount? ( >=x11-drivers/xf86-input-penmount-1.2.1 )
+		input_devices_spaceorb? ( >=x11-drivers/xf86-input-spaceorb-1.1.1 )
+		input_devices_summa? ( >=x11-drivers/xf86-input-summa-1.1.0 )
+		input_devices_tek4957? ( >=x11-drivers/xf86-input-tek4957-1.1.0 )
+		input_devices_ur98? ( >=x11-drivers/xf86-input-ur98-1.1.0 )
+		input_devices_vmmouse? ( >=x11-drivers/xf86-input-vmmouse-12.4.2 )
+		input_devices_void? ( >=x11-drivers/xf86-input-void-1.1.0 )
+
+		input_devices_synaptics? ( x11-drivers/synaptics )
+		input_devices_wacom? ( x11-drivers/linuxwacom )
+
+		video_cards_amd? ( >=x11-drivers/xf86-video-amd-2.7.7.0 )
+		video_cards_apm? ( >=x11-drivers/xf86-video-apm-1.1.1 )
+		video_cards_ark? ( >=x11-drivers/xf86-video-ark-0.6.0 )
+		video_cards_chips? ( >=x11-drivers/xf86-video-chips-1.1.1 )
+		video_cards_cirrus? ( >=x11-drivers/xf86-video-cirrus-1.1.0 )
+		video_cards_cyrix? ( >=x11-drivers/xf86-video-cyrix-1.1.0 )
+		video_cards_dummy? ( >=x11-drivers/xf86-video-dummy-0.2.0 )
+		video_cards_fbdev? ( >=x11-drivers/xf86-video-fbdev-0.2.0 )
+		video_cards_glint? ( >=x11-drivers/xf86-video-glint-1.1.1 )
+		video_cards_i128? ( >=x11-drivers/xf86-video-i128-1.2.0 )
+		video_cards_i740? ( >=x11-drivers/xf86-video-i740-1.1.0 )
+		video_cards_i810? ( >=x11-drivers/xf86-video-i810-1.6.0 )
+		video_cards_impact? ( >=x11-drivers/xf86-video-impact-0.2.0 )
+		video_cards_imstt? ( >=x11-drivers/xf86-video-imstt-1.1.0 )
+		video_cards_mach64? ( >=x11-drivers/xf86-video-ati-6.6.0 )
+		video_cards_mga? ( >=x11-drivers/xf86-video-mga-1.4.1 )
+		video_cards_neomagic? ( >=x11-drivers/xf86-video-neomagic-1.1.1 )
+		video_cards_newport? ( >=x11-drivers/xf86-video-newport-0.2.0 )
+		video_cards_nsc? ( >=x11-drivers/xf86-video-nsc-2.8.1 )
+		video_cards_nv? ( >=x11-drivers/xf86-video-nv-1.1.1 )
+		video_cards_r128? ( >=x11-drivers/xf86-video-ati-6.6.0 )
+		video_cards_radeon? ( >=x11-drivers/xf86-video-ati-6.6.0 )
+		video_cards_rendition? ( >=x11-drivers/xf86-video-rendition-4.1.0 )
+		video_cards_s3? ( >=x11-drivers/xf86-video-s3-0.4.1 )
+		video_cards_s3virge? ( >=x11-drivers/xf86-video-s3virge-1.9.1 )
+		video_cards_savage? ( >=x11-drivers/xf86-video-savage-2.1.1 )
+		video_cards_siliconmotion? ( >=x11-drivers/xf86-video-siliconmotion-1.4.1 )
+		video_cards_sis? ( >=x11-drivers/xf86-video-sis-0.9.1 )
+		video_cards_sisusb? ( >=x11-drivers/xf86-video-sisusb-0.8.1 )
+		video_cards_sunbw2? ( >=x11-drivers/xf86-video-sunbw2-1.1.0 )
+		video_cards_suncg14? ( >=x11-drivers/xf86-video-suncg14-1.1.0 )
+		video_cards_suncg3? ( >=x11-drivers/xf86-video-suncg3-1.1.0 )
+		video_cards_suncg6? ( >=x11-drivers/xf86-video-suncg6-1.1.0 )
+		video_cards_sunffb? ( >=x11-drivers/xf86-video-sunffb-1.1.0 )
+		video_cards_sunleo? ( >=x11-drivers/xf86-video-sunleo-1.1.0 )
+		video_cards_suntcx? ( >=x11-drivers/xf86-video-suntcx-1.1.0 )
+		video_cards_tdfx? ( >=x11-drivers/xf86-video-tdfx-1.2.1 )
+		video_cards_tga? ( >=x11-drivers/xf86-video-tga-1.1.0 )
+		video_cards_trident? ( >=x11-drivers/xf86-video-trident-1.2.1 )
+		video_cards_tseng? ( >=x11-drivers/xf86-video-tseng-1.1.0 )
+		video_cards_v4l? ( >=x11-drivers/xf86-video-v4l-0.1.1 )
+		video_cards_vermilion? ( >=x11-drivers/xf86-video-vermilion-1.0.0 )
+		video_cards_vesa? ( >=x11-drivers/xf86-video-vesa-1.1.0 )
+		video_cards_vga? ( >=x11-drivers/xf86-video-vga-4.1.0 )
+		video_cards_via? ( >=x11-drivers/xf86-video-via-0.2.1 )
+		video_cards_vmware? ( >=x11-drivers/xf86-video-vmware-10.13.0 )
+		video_cards_voodoo? ( >=x11-drivers/xf86-video-voodoo-1.1.0 )
+		video_cards_xgi? ( >=x11-drivers/xf86-video-xgi-1.5.0 )
+		video_cards_tdfx? ( 3dfx? ( >=media-libs/glide-v3-3.10 ) )
+		video_cards_fglrx? ( >=x11-drivers/ati-drivers-8.433 )
+		video_cards_nvidia? ( >=x11-drivers/nvidia-drivers-71.86.01 )
+	)"
+LICENSE="${LICENSE} MIT"
+
+PATCHES="
+	${FILESDIR}/1.4-ia64.patch
+	${FILESDIR}/1.3.0.0-use-proc-instead-of-sys.patch
+	${FILESDIR}/1.4-fpic-libxf86config.patch
+	${FILESDIR}/1.4-document-new-font-catalogs.patch
+	${FILESDIR}/1.4-fix-dmx-build.patch
+	${FILESDIR}/1.4-fix-dmx-link.patch
+	${FILESDIR}/1.4-fix-xephyr-link.patch
+	${FILESDIR}/1.4-fix-xprint-build.patch
+	${FILESDIR}/1.4-fix-xprint-link.patch
+	${FILESDIR}/1.4-fix-kdrive-automake.patch
+	${FILESDIR}/1.4-dont-hang-openoffice.patch
+	${FILESDIR}/${PV}-clean-generated-files.patch
+	${FILESDIR}/1.4-0001-Fix-for-CVE-2007-5760-XFree86-Misc-extension-out-o.patch
+	${FILESDIR}/1.4-0002-Fix-for-CVE-2007-6428-TOG-cup-extension-memory-cor.patch
+	${FILESDIR}/1.4-0003-Fix-for-CVE-2007-6427-Xinput-extension-memory-corr.patch
+	${FILESDIR}/1.4-0004-Fix-for-CVE-2007-6429-MIT-SHM-and-EVI-extensions-i.patch
+	${FILESDIR}/1.4-0005-Fix-for-CVE-2008-0006-PCF-Font-parser-buffer-overf.patch
+	${FILESDIR}/1.4-0006-Fix-for-CVE-2007-5958-File-existence-disclosure.patch
+	"
+
+pkg_setup() {
+	use minimal || ensure_a_server_is_building
+
+	# SDL only available in kdrive build
+	if use kdrive && use sdl; then
+		conf_opts="${conf_opts} --enable-xsdl"
+	else
+		conf_opts="${conf_opts} --disable-xsdl"
+	fi
+
+	# Only Xorg and Xgl support this, and we won't build Xgl
+	# until it merges to trunk
+	if use xorg; then
+		conf_opts="${conf_opts} --with-mesa-source=${WORKDIR}/${MESA_P}"
+	fi
+
+	# localstatedir is used for the log location; we need to override the default
+	# from ebuild.sh
+	# sysconfdir is used for the xorg.conf location; same applies
+	# --enable-install-setuid needed because sparcs default off
+	CONFIGURE_OPTIONS="
+		$(use_enable ipv6)
+		$(use_enable dmx)
+		$(use_enable kdrive)
+		$(use_enable !minimal xvfb)
+		$(use_enable !minimal xnest)
+		$(use_enable !minimal install-libxf86config)
+		$(use_enable dri)
+		$(use_enable xorg)
+		$(use_enable xprint)
+		$(use_enable nptl glx-tls)
+		$(use_enable !minimal xorgcfg)
+		$(use_enable hal config-dbus)
+		$(use_enable hal config-hal)
+		--sysconfdir=/etc/X11
+		--localstatedir=/var
+		--enable-install-setuid
+		--with-fontdir=/usr/share/fonts
+		--with-xkb-output=/var/lib/xkb
+		${conf_opts}"
+
+	local diemsg="You must build xorg-server and mesa with the same nptl USE setting."
+	if built_with_use media-libs/mesa nptl; then
+		use nptl || die "${diemsg}"
+	else
+		use nptl && die "${diemsg}"
+	fi
+
+	# (#121394) Causes window corruption
+	filter-flags -fweb
+
+	# Nothing else provides new enough glxtokens.h
+	ewarn "Forcing on xorg-x11 for new enough glxtokens.h..."
+	OLD_IMPLEM="$(eselect opengl show)"
+	eselect opengl set --impl-headers ${OPENGL_DIR}
+}
+
+src_unpack() {
+	x-modular_specs_check
+	x-modular_dri_check
+	x-modular_unpack_source
+	x-modular_patch_source
+
+	# Clean up for ${PV}-clean-generated-files.patch
+	pushd hw/xprint >/dev/null
+	rm -f *-wrapper.c || die
+	popd >/dev/null
+
+	# Set up kdrive servers to build
+	if use kdrive; then
+		kdrive_setup
+	fi
+
+	# Make sure eautoreconf gets run if we need the autoconf/make
+	# changes.
+	if [[ ${SNAPSHOT} != "yes" ]]; then
+		if use kdrive || use dmx || use xprint; then
+			SNAPSHOT="yes"
+		fi
+	fi
+
+	if use hal; then
+		sed -i \
+			-e "s:^\(dbusconfigdir = \).*\(dbus-1.*\):\1/etc/\2:g" \
+			"${S}"/config/Makefile.am \
+			|| die "failed to fix DBUS config directory"
+		SNAPSHOT="yes"
+	fi
+
+	x-modular_reconf_source
+	#do not install xprint's Xsession.d files, we'll do it later
+	if use xprint; then
+		sed -e "s:install-data-am\: install-dist_xpcDATA:install-data-am\::g" \
+		    -i "${S}"/hw/xprint/etc/Xsession.d/Makefile.in \
+		    || die "sed of Xsession.d makefile failed"
+	fi
+}
+
+src_install() {
+	x-modular_src_install
+
+	dynamic_libgl_install
+
+	server_based_install
+
+	# Install video mode files for system-config-display
+	insinto /usr/share/xorg
+	doins hw/xfree86/common/{extra,vesa}modes \
+		|| die "couldn't install extra modes"
+
+	# Bug #151421 - this file is not built with USE="minimal"
+	# Bug #151670 - this file is also not build if USE="-xorg"
+	if ! use minimal &&	use xorg; then
+		# Install xorg.conf.example
+		insinto /etc/X11
+		doins hw/xfree86/xorg.conf.example \
+			|| die "couldn't install xorg.conf.example"
+	fi
+}
+
+pkg_postinst() {
+	switch_opengl_implem
+
+	# Bug #135544
+	ewarn "Users of reduced blanking now need:"
+	ewarn "   Option \"ReducedBlanking\""
+	ewarn "In the relevant Monitor section(s)."
+	ewarn "Make sure your reduced blanking modelines are safe!"
+
+	echo
+	ewarn "You must rebuild all drivers if upgrading from xorg-server 1.3"
+	ewarn "or earlier, because the ABI changed. If you cannot start X because"
+	ewarn "of module version mismatch errors, this is your problem."
+
+	ewarn "Here's a list of installed X drivers to emerge:"
+	print_installed x11-drivers/
+
+	echo
+	ewarn "You can generate a similar list at any point using this command:"
+	ewarn "emerge portage-utils; qlist -I -C x11-drivers/"
+
+	ebeep 5
+	epause 10
+}
+
+pkg_postrm() {
+	# Get rid of module dir to ensure opengl-update works properly
+	if ! has_version x11-base/xorg-server; then
+		if [[ -e ${ROOT}/usr/$(get_libdir)/xorg/modules ]]; then
+			rm -rf "${ROOT}"/usr/$(get_libdir)/xorg/modules
+		fi
+	fi
+}
+
+kdrive_setup() {
+	local card real_card disable_card kdrive_fbdev kdrive_vesa
+
+	einfo "Removing unused kdrive drivers ..."
+
+	# Some kdrive servers require fbdev and vesa
+	kdrive_fbdev="radeon neomagic sis siliconmotion"
+	# Some kdrive servers require just vesa
+	kdrive_vesa="chips mach64 mga nv glint r128 via"
+
+	for card in ${IUSE_VIDEO_CARDS}; do
+		real_card=${card#video_cards_}
+
+		# Differences between VIDEO_CARDS name and kdrive server name
+		real_card=${real_card/glint/pm2}
+		real_card=${real_card/radeon/ati}
+		real_card=${real_card/%nv/nvidia}
+		real_card=${real_card/siliconmotion/smi}
+		real_card=${real_card/%sis/sis300}
+
+		disable_card=0
+
+		# Check whether it's a valid kdrive server before we waste time
+		# on the rest of this
+		if ! grep -q -o "\b${real_card}\b" "${S}"/hw/kdrive/Makefile.am; then
+			continue
+		fi
+
+		if ! use ${card}; then
+			if use x86; then
+				# Some kdrive servers require fbdev and vesa
+				for i in ${kdrive_fbdev}; do
+					if use video_cards_${i}; then
+						if [[ ${real_card} = fbdev ]] \
+							|| [[ ${real_card} = vesa ]]; then
+							continue 2 # Don't disable
+						fi
+						fi
+				done
+
+				# Some kdrive servers require just vesa
+				for i in ${kdrive_vesa}; do
+					if use video_cards_${i}; then
+						if [[ ${real_card} = vesa ]]; then
+							continue 2 # Don't disable
+						fi
+					fi
+				done
+			fi
+			disable_card=1
+		# Bug #150052
+		# fbdev is the only VIDEO_CARDS setting that works on non-x86
+		elif ! use x86 \
+			&& [[ ${real_card} != fbdev ]]; then
+			ewarn "  $real_card does not work on your architecture; disabling."
+			disable_card=1
+		fi
+
+		if [[ $disable_card = 1 ]]; then
+			ebegin "  ${real_card}"
+			sed -i \
+				-e "s:\b${real_card}\b::g" \
+				"${S}"/hw/kdrive/Makefile.am \
+				|| die "sed of ${real_card} failed"
+			eend
+		fi
+
+	done
+}
+
+dynamic_libgl_install() {
+	# next section is to setup the dynamic libGL stuff
+	ebegin "Moving GL files for dynamic switching"
+		dodir /usr/$(get_libdir)/opengl/${OPENGL_DIR}/extensions
+		local x=""
+		for x in "${D}"/usr/$(get_libdir)/xorg/modules/extensions/libglx*; do
+			if [ -f ${x} -o -L ${x} ]; then
+				mv -f ${x} "${D}"/usr/$(get_libdir)/opengl/${OPENGL_DIR}/extensions
+			fi
+		done
+	eend 0
+}
+
+server_based_install() {
+	use xprint && xprint_src_install
+
+	if ! use xorg; then
+		rm "${D}"/usr/share/man/man1/Xserver.1x \
+			"${D}"/usr/$(get_libdir)/xserver/SecurityPolicy \
+			"${D}"/usr/$(get_libdir)/pkgconfig/xorg-server.pc \
+			"${D}"/usr/share/man/man1/Xserver.1x
+	fi
+}
+
+switch_opengl_implem() {
+		# Switch to the xorg implementation.
+		# Use new opengl-update that will not reset user selected
+		# OpenGL interface ...
+		echo
+#		eselect opengl set --use-old ${OPENGL_DIR}
+		eselect opengl set ${OLD_IMPLEM}
+}
+
+print_installed() {
+	local command line token=$1
+
+	if $(type -P qlist >/dev/null 2>&1); then
+		command="qlist -I -C ${token}"
+	elif $(type -P equery >/dev/null 2>&1); then
+		command="equery -q -C list ${token} | grep -o '${token}[[:alnum:].-]*'"
+	elif $(type -P epm >/dev/null 2>&1); then
+		command="epm -qaG | grep ${token}"
+	else
+		local dir
+		command="true"
+		for dir in "${PORTDIR}"/${token}*; do
+			command="${command} ; best_version ${dir#${PORTDIR}/}"
+		done
+	fi
+	while read line; do
+		ewarn "${line}"
+	done < <(eval ${command})
+}
+
+xprint_src_install() {
+	# RH-style init script, we provide a wrapper
+	exeinto /usr/$(get_libdir)/misc
+	doexe "${S}"/hw/xprint/etc/init.d/xprint
+	# Install the wrapper
+	newinitd "${FILESDIR}"/xprint.init xprint
+	# Install profile scripts
+	insinto /etc/profile.d
+	doins "${S}"/hw/xprint/etc/profile.d/xprint*
+	exeinto /etc/X11/xinit/xinitrc.d
+	doexe "${S}"/hw/xprint/etc/Xsession.d/92xprint-xpserverlist
+	# Patch profile scripts
+	sed -e "s:/etc/init.*get_xpserverlist:/usr/$(get_libdir)/misc/xprint \
+		get_xpserverlist:g" -i "${D}"/etc/profile.d/xprint* \
+		"${D}"/etc/X11/xinit/xinitrc.d/92xprint-xpserverlist
+	# Move profile scripts, we can't touch /etc/profile.d/ in Gentoo
+	dodoc "${D}"/etc/profile.d/xprint*
+	rm -f "${D}"/etc/profile.d/xprint*
+}
+
+ensure_a_server_is_building() {
+	for server in ${IUSE_SERVERS}; do
+		use ${server} && return;
+	done
+	eerror "You need to specify at least one server to build."
+	eerror "Valid servers are: ${IUSE_SERVERS}."
+	die "No servers were specified to build."
+}