--- xorg-x11-6.8.2/xc/programs/Xserver/dix/colormap.c.org	2006-12-05 00:49:56.000000000 +0900
+++ xorg-x11-6.8.2/xc/programs/Xserver/dix/colormap.c	2006-12-05 00:58:02.000000000 +0900
@@ -830,6 +830,7 @@
     VisualPtr	pVisual;
     int		npix;
     Pixel	*ppix;
+    int         initialPixels = pmap->numPixelsRed[client];
 
     pVisual = pmap->pVisual;
     (*pmap->pScreen->ResolveColor) (pred, pgreen, pblue, pVisual);
@@ -989,8 +990,15 @@
 	}
 	pcr->mid = pmap->mid;
 	pcr->client = client;
-	if (!AddResource(FakeClientID(client), RT_CMAPENTRY, (pointer)pcr))
-	    return (BadAlloc);
+        if (class == PseudoColor) {
+            if (initialPixels == 0) {
+	        if (!AddResource(FakeClientID(client), RT_CMAPENTRY, (pointer)pcr))
+	            return (BadAlloc);
+            }
+        } else {
+	    if (!AddResource(FakeClientID(client), RT_CMAPENTRY, (pointer)pcr))
+	        return (BadAlloc);
+        }
     }
     return (Success);
 }
@@ -1281,6 +1281,8 @@
     int		npix, count, *nump = NULL;
     Pixel	**pixp = NULL, *ppix;
     xColorItem	def;
+    Bool	matched = FALSE;
+    int		i;
 
     foundFree = FALSE;
 
@@ -1294,7 +1296,7 @@
     	    if ((*comp) (pent, prgb))
 	    {
 		if (client >= 0)
-		    pent->refcnt++;
+		    matched = TRUE;
 		*pPixel = pixel;
 		switch(channel)
 		{
@@ -1394,8 +1396,12 @@
     *pPixel = def.pixel;
 
 gotit:
-    if (pmap->flags & BeingCreated || client == -1)
+    if (pmap->flags & BeingCreated || client == -1) {
+        if (matched == TRUE) {
+            pent->refcnt++;
+        }
 	return(Success);
+    }
     /* Now remember the pixel, for freeing later */
     switch (channel)
     {
@@ -1416,6 +1426,16 @@
 	break;
     }
     npix = nump[client];
+    if (matched == TRUE) {
+        /* !! ppix shoud be uniq array to avoid refcnt overflow !! */
+        ppix = pixp[client];
+        for (i = 0; i < npix; i++) {
+            if (ppix[i] == pixel) {
+                return(Success);
+            }
+        }
+        pent->refcnt++;
+    }
     ppix = (Pixel *) xrealloc (pixp[client], (npix + 1) * sizeof(Pixel));
     if (!ppix)
     {