Index: xc/ChangeLog
===================================================================
RCS file: /cvs/xorg/xc/ChangeLog,v
retrieving revision 1.602
diff -u -2 -0 -r1.602 ChangeLog
--- xc/ChangeLog	13 Dec 2004 02:13:32 -0000	1.602
+++ xc/ChangeLog	13 Dec 2004 03:39:01 -0000
@@ -1,21 +1,29 @@
 2004-12-12 Roland Mainz <roland.mainz@nrubsig.org>
+	* xc/programs/Xserver/Xext/saver.c
+	Bugzilla #1695 (https://bugs.freedesktop.org/show_bug.cgi?id=1695)
+	attachment #1230 (https://bugs.freedesktop.org/attachment.cgi?id=1230):       
+	Fix crash in Xscreensaver code which allowed any authentificated X client
+        to crash the Xserver using |XScreenSaverUnsetAttributes()|.
+        Patch by ajax@nwnk.net
+
+2004-12-12 Roland Mainz <roland.mainz@nrubsig.org>
 	* xc/programs/Xserver/hw/xfree86/common/xf86Xinput.c
 	Bugzilla #1688 (https://bugs.freedesktop.org/show_bug.cgi?id=1688)
 	attachment #1530 (https://bugs.freedesktop.org/attachment.cgi?id=1530):       
 	Fix the current implementation to make it possible to slow down the
 	mouse pointer or use arbitrary fractions (without running into
 	rounding error issues). The change is using the same method of
 	preserving rounding errors that the exponential method is already
 	using.
 	Patch by Jan Brunner <Jan_B@gmx.ch>.
 
 2004-12-12  Kristian Høgsberg  <krh@redhat.com>
 
 	* programs/Xserver/Xext/xf86vmode.c:
 	Lower default verbosity for Xvidmode log messages to stop the
 	extension from writing non critical info to the log, thus keeping
 	the disk busy.
 	https://bugs.freedesktop.org/show_bug.cgi?id=1552
 
 	* programs/Xserver/hw/xfree86/os-support/bus/460gxPCI.c
 	Add fix for bus scanning SEGV on ia64 with 460gx bus.
Index: xc/programs/Xserver/Xext/saver.c
===================================================================
RCS file: /cvs/xorg/xc/programs/Xserver/Xext/saver.c,v
retrieving revision 1.4
diff -u -2 -0 -r1.4 saver.c
--- xc/programs/Xserver/Xext/saver.c	1 Nov 2004 16:05:27 -0000	1.4
+++ xc/programs/Xserver/Xext/saver.c	13 Dec 2004 03:39:16 -0000
@@ -193,41 +193,41 @@
     int /* state */,
     Bool /* forced */
 );
 
 typedef struct _ScreenSaverScreenPrivate {
     ScreenSaverEventPtr	    events;
     ScreenSaverAttrPtr	    attr;
     Bool		    hasWindow;
     Colormap		    installedMap;
 } ScreenSaverScreenPrivateRec, *ScreenSaverScreenPrivatePtr;
 
 static ScreenSaverScreenPrivatePtr
 MakeScreenPrivate (
 	ScreenPtr /* pScreen */
 	);
 
 static int ScreenPrivateIndex;
 
 #define GetScreenPrivate(s) ((ScreenSaverScreenPrivatePtr)(s)->devPrivates[ScreenPrivateIndex].ptr)
 #define SetScreenPrivate(s,v) ((s)->devPrivates[ScreenPrivateIndex].ptr = (pointer) v);
-#define SetupScreen(s)	ScreenSaverScreenPrivatePtr pPriv = GetScreenPrivate(s)
+#define SetupScreen(s)	ScreenSaverScreenPrivatePtr pPriv = (s ? GetScreenPrivate(s) : NULL)
 
 #define New(t)	((t *) xalloc (sizeof (t)))
 
 /****************
  * ScreenSaverExtensionInit
  *
  * Called from InitExtensions in main() or from QueryExtension() if the
  * extension is dynamically loaded.
  *
  ****************/
 
 void
 ScreenSaverExtensionInit(INITARGS)
 {
     ExtensionEntry *extEntry;
     int		    i;
     ScreenPtr	    pScreen;
 
     AttrType = CreateNewResourceType(ScreenSaverFreeAttr);
     EventType = CreateNewResourceType(ScreenSaverFreeEvents);