I am trying to compile RealVNC 4.0beta5 against Xorg, and although I get an Xvnc
binary it segfaults on start.

The crash is in REGION_INIT(pScreen, reg, NullBox, 0) -- in VNC code -- although
in xc/program/Xserver/include/regionstr.h it appears that using NullBox here is
okay:

#ifndef REGION_NULL
#define REGION_NULL(_pScreen, _pReg) \
    REGION_INIT(_pScreen, _pReg, NullBox, 1)
#endif

However, REGION_INIT picks up this definition:

#define REGION_INIT(_pScreen, _pReg, _rect, _size) \
{ \
    REGION_SCREEN(_pScreen); \
    (_pReg)->extents = *(_rect); \
    (_pReg)->data = (RegDataPtr)NULL; \
}

and (NullBox being NULL) the dereference of _rect seems to be what's causing the
problem.

In XFree86-4.3.0 the REGION_INIT definition was:

#define REGION_INIT(_pScreen, _pReg, _rect, _size) \
{ \
    if (_rect) \
    { \
        (_pReg)->extents = *(_rect); \
        (_pReg)->data = (RegDataPtr)NULL; \
    } \
    else \
    { \
        (_pReg)->extents = miEmptyBox; \
        if (((_size) > 1) && ((_pReg)->data = \
                             (RegDataPtr)xalloc(REGION_SZOF(_size)))) \
        { \
            (_pReg)->data->size = (_size); \
            (_pReg)->data->numRects = 0; \
        } \
        else \
            (_pReg)->data = &miEmptyData; \
    } \
}

and so my question is: why don't we check whether _rect can be dereferenced any
more?  Is this a bug in REGION_INIT?