Merge branch 'master' of ssh://vparabola/home/parabola/abslibre-pre-mips64el

Conflicts:
	community/luaposix/PKGBUILD
	extra/mesa/PKGBUILD

16 files changed, 2494 insertions, 39 deletions

diff --git a/extra/efilinux-efi/PKGBUILD b/extra/efilinux-efi/PKGBUILD
new file mode 100644
index 000000000..bd75029c5
--- /dev/null
+++ b/extra/efilinux-efi/PKGBUILD
@@ -0,0 +1,62 @@
+# Contributor : Keshav Padram <(the.ridikulus.rat) (aatt) (gemmaeiil) (ddoott) (ccoomm)>
+
+_gitroot="git://git.kernel.org/pub/scm/boot/efilinux/efilinux.git"
+_gitname="efilinux"
+_gitbranch="master"
+
+pkgname="efilinux-efi"
+pkgver="1.0"
+pkgrel="8"
+pkgdesc="Simple UEFI Linux bootloader - Precursor to EFISTUB"
+url="https://github.com/mfleming/efilinux"
+arch=('x86_64' 'i686')
+license=('GPL')
+makedepends=('gnu-efi-libs')
+depends=('dosfstools' 'efibootmgr')
+options=('!strip')
+install="${pkgname}.install"
+
+source=("${_gitname}::git+${_gitroot}#branch=${_gitbranch}")
+sha1sums=('SKIP')
+
+[[ "${CARCH}" == "x86_64" ]] && _EFI_ARCH="x86_64"
+[[ "${CARCH}" == "i686" ]] && _EFI_ARCH="ia32"
+
+[[ "${CARCH}" == "x86_64" ]] && _EFI_S_ARCH="x64"
+[[ "${CARCH}" == "i686" ]] && _EFI_S_ARCH="ia32"
+
+build() {
+	
+	rm -rf "${srcdir}/efilinux-${pkgver}/" || true
+	cp -r "${srcdir}/${_gitname}" "${srcdir}/efilinux-${pkgver}"
+	
+	cd "${srcdir}/efilinux-${pkgver}/"
+	
+	## Add "-fno-strict-aliasing -fno-stack-protector -fno-stack-check -mno-sse -mno-mmx" to CFLAGS
+	sed 's|-DEFI_FUNCTION_WRAPPER|-fno-strict-aliasing -fno-stack-protector -fno-stack-check -mno-sse -mno-mmx -DEFI_FUNCTION_WRAPPER|g' -i "${srcdir}/efilinux-${pkgver}/Makefile"
+	
+	## Add -DGNU_EFI_USE_MS_ABI to CFLAGS
+	sed 's|-DEFI_FUNCTION_WRAPPER|-DEFI_FUNCTION_WRAPPER -DGNU_EFI_USE_MS_ABI|g' -i "${srcdir}/efilinux-${pkgver}/Makefile"
+	
+	## Add -m64 for x86_64 build
+	sed 's|CFLAGS += -mno-red-zone|CFLAGS += -m64 -mno-red-zone|g' -i "${srcdir}/efilinux-${pkgver}/Makefile"
+	
+	## Unset all compiler FLAGS
+	unset CFLAGS
+	unset CPPFLAGS
+	unset CXXFLAGS
+	unset LDFLAGS
+	unset MAKEFLAGS
+	
+	make CRT0="/usr/lib/crt0-efi-${_EFI_ARCH}.o" LDSCRIPT="/usr/lib/elf_${_EFI_ARCH}_efi.lds"
+	
+}
+
+package() {
+	
+	cd "${srcdir}/efilinux-${pkgver}/"
+	
+	install -d "${pkgdir}/usr/lib/efilinux/"
+	install -D -m0644 "${srcdir}/efilinux-${pkgver}/efilinux.efi" "${pkgdir}/usr/lib/efilinux/efilinux${_EFI_S_ARCH}.efi"
+	
+}
diff --git a/extra/efilinux-efi/efilinux-efi.install b/extra/efilinux-efi/efilinux-efi.install
new file mode 100644
index 000000000..6d6e817c5
--- /dev/null
+++ b/extra/efilinux-efi/efilinux-efi.install
@@ -0,0 +1,23 @@
+post_install() {
+	
+	cat << EOF 
+
+efilinux has been installed at /usr/lib/efilinux/*.efi
+
+Copy the efi application for your UEFI ARCH to a sub-directory of
+<EFISYS>/EFI/ and add an entry to firmware boot menu using efibootmgr
+or mactel-boot (for Macs)
+
+Usage instructions at http://thread.gmane.org/gmane.linux.kernel/1172645 
+and http://article.gmane.org/gmane.linux.kernel/1175060
+
+EOF
+	
+}
+
+post_upgrade() {
+	
+	post_install
+	
+}
+
diff --git a/extra/libseccomp/PKGBUILD b/extra/libseccomp/PKGBUILD
index 9bdaee4fc..ccca4c4b5 100644
--- a/extra/libseccomp/PKGBUILD
+++ b/extra/libseccomp/PKGBUILD
@@ -2,15 +2,14 @@
 # Contributor: Patryk Kowalczyk < patryk at kowalczyk dot ws>
 
 pkgname=libseccomp
-pkgver=2.0.0
-pkgrel=2
+pkgver=2.1.0
+pkgrel=1
 pkgdesc='Enhanced seccomp library'
 arch=('i686' 'x86_64')
 license=('LGPL2.1')
 url="http://sourceforge.net/projects/libseccomp/"
 depends=('glibc')
 source=("http://downloads.sourceforge.net/project/$pkgname/$pkgname-$pkgver.tar.gz")
-md5sums=('f988feac6a3425f2c918f32b28df1caa')
 
 build() {
   cd $pkgname-$pkgver
@@ -22,3 +21,4 @@ package() {
   cd $pkgname-$pkgver
   make DESTDIR="$pkgdir" install
 }
+md5sums=('3961103c1234c13a810f6a12e60c797f')
diff --git a/extra/libxi/PKGBUILD b/extra/libxi/PKGBUILD
index 1c9e25068..3405d40a2 100644
--- a/extra/libxi/PKGBUILD
+++ b/extra/libxi/PKGBUILD
@@ -1,28 +1,42 @@
-# $Id: PKGBUILD 182037 2013-04-05 19:09:17Z andyrtr $
+# $Id: PKGBUILD 188841 2013-06-22 12:22:10Z lcarlier $
 # Maintainer: AndyRTR <andyrtr@archlinux.org>
 # Maintainer: Jan de Groot <jgc@archlinux.org>
 
 pkgname=libxi
 pkgver=1.7.1
-pkgrel=1
+pkgrel=2
 pkgdesc="X11 Input extension library"
 arch=('i686' 'x86_64' 'mips64el')
 url="http://xorg.freedesktop.org"
 depends=('libxext' 'inputproto')
-makedepends=('pkgconfig' 'xorg-util-macros' 'libxfixes')
+makedepends=('pkgconfig' 'xorg-util-macros' 'libxfixes' 'automake')
 options=(!libtool)
 license=('custom')
-source=(${url}/releases/individual/lib/libXi-${pkgver}.tar.bz2)
-sha256sums=('e92adb6b69c53c51e05c1e65db97e23751b935a693000fb0606c11b88c0066c5')
+source=(${url}/releases/individual/lib/libXi-${pkgver}.tar.bz2
+        git-fixes.diff)
+sha256sums=('e92adb6b69c53c51e05c1e65db97e23751b935a693000fb0606c11b88c0066c5'
+            '23e10f8a8a078dd109acbd5a66fe62a45233d3a2368649d5114107a790594c07')
+
+prepare() {
+  cd "${srcdir}/libXi-${pkgver}"
+
+  # fix CVE-2013-1998 CVE-2013-1984 CVE-2013-1995 merged upstream
+  patch -Np1 -i ${srcdir}/git-fixes.diff
+
+  # a patch change configure.ac
+  autoreconf -fiv
+}
 
 build() {
   cd "${srcdir}/libXi-${pkgver}"
+
   ./configure --prefix=/usr --sysconfdir=/etc --disable-static
   make
 }
 
 package() {
   cd "${srcdir}/libXi-${pkgver}"
+
   make DESTDIR="${pkgdir}" install
 
   install -m755 -d "${pkgdir}/usr/share/licenses/${pkgname}"
diff --git a/extra/libxi/git-fixes.diff b/extra/libxi/git-fixes.diff
new file mode 100644
index 000000000..4c542d980
--- /dev/null
+++ b/extra/libxi/git-fixes.diff
@@ -0,0 +1,1352 @@
+From bb82c72a1d69eaf60b7586570faf797df967f661 Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Mon, 29 Apr 2013 18:39:34 -0700
+Subject: [PATCH 01/15] Expand comment on the memory vs. reply ordering in
+ XIGetSelectedEvents()
+
+Unpacking from the wire involves un-interleaving the structs & masks,
+which wasn't obvious to me the first time I read it, so make notes
+before I forget again.
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+---
+ src/XISelEv.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/src/XISelEv.c b/src/XISelEv.c
+index fa7eb54..f871222 100644
+--- a/src/XISelEv.c
++++ b/src/XISelEv.c
+@@ -135,8 +135,14 @@ XIGetSelectedEvents(Display* dpy, Window win, int *num_masks_return)
+ 
+     _XRead(dpy, (char*)mask_in, reply.length * 4);
+ 
+-    /* Memory layout of the XIEventMask for a 3 mask reply:
+-     * [struct a][struct b][struct c][masks a][masks b][masks c]
++    /*
++     * This function takes interleaved xXIEventMask structs & masks off
++     * the wire, such as this 3 mask reply:
++     *   [struct a][masks a][struct b][masks b][struct c][masks c]
++     * And generates a memory buffer to be returned to callers in which
++     * they are not interleaved, so that callers can treat the returned
++     * pointer as a simple array of XIEventMask structs, such as:
++     *   [struct a][struct b][struct c][masks a][masks b][masks c]
+      */
+     len = reply.num_masks * sizeof(XIEventMask);
+ 
+-- 
+1.8.3.1
+
+
+From 5d43d4914dcabb6de69859567061e99300e56ef4 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Fri, 17 May 2013 09:07:44 +1000
+Subject: [PATCH 02/15] Copy the sequence number into the target event too
+ (#64687)
+
+X.Org Bug 64687 <http://bugs.freedesktop.org/show_bug.cgi?id=64687>
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+Reviewed-by: Jasper St. Pierre <jstpierre@mecheye.net>
+---
+ src/XExtInt.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/src/XExtInt.c b/src/XExtInt.c
+index 507573b..8e19b97 100644
+--- a/src/XExtInt.c
++++ b/src/XExtInt.c
+@@ -915,6 +915,7 @@ static void xge_copy_to_cookie(xGenericEvent* ev,
+     cookie->type = ev->type;
+     cookie->evtype = ev->evtype;
+     cookie->extension = ev->extension;
++    cookie->serial = ev->sequenceNumber;
+ }
+ 
+ static Bool
+@@ -1521,6 +1522,7 @@ wireToDeviceEvent(xXIDeviceEvent *in, XGenericEventCookie* cookie)
+     out = next_block(&ptr_lib, sizeof(XIDeviceEvent));
+     out->display = cookie->display;
+     out->type = in->type;
++    out->serial = in->sequenceNumber;
+     out->extension = in->extension;
+     out->evtype = in->evtype;
+     out->send_event = ((in->type & 0x80) != 0);
+@@ -1793,6 +1795,7 @@ wireToDeviceChangedEvent(xXIDeviceChangedEvent *in, XGenericEventCookie *cookie)
+     cookie->data = out = malloc(sizeof(XIDeviceChangedEvent) + len);
+ 
+     out->type = in->type;
++    out->serial = in->sequenceNumber;
+     out->display = cookie->display;
+     out->extension = in->extension;
+     out->evtype = in->evtype;
+@@ -1825,6 +1828,7 @@ wireToHierarchyChangedEvent(xXIHierarchyEvent *in, XGenericEventCookie *cookie)
+     out->info           = (XIHierarchyInfo*)&out[1];
+     out->display        = cookie->display;
+     out->type           = in->type;
++    out->serial         = in->sequenceNumber;
+     out->extension      = in->extension;
+     out->evtype         = in->evtype;
+     out->send_event = ((in->type & 0x80) != 0);
+@@ -1865,6 +1869,7 @@ wireToRawEvent(XExtDisplayInfo *info, xXIRawEvent *in, XGenericEventCookie *cook
+ 
+     out = next_block(&ptr, sizeof(XIRawEvent));
+     out->type           = in->type;
++    out->serial         = in->sequenceNumber;
+     out->display        = cookie->display;
+     out->extension      = in->extension;
+     out->evtype         = in->evtype;
+@@ -1915,6 +1920,7 @@ wireToEnterLeave(xXIEnterEvent *in, XGenericEventCookie *cookie)
+     out->buttons.mask = (unsigned char*)&out[1];
+ 
+     out->type           = in->type;
++    out->serial         = in->sequenceNumber;
+     out->display        = cookie->display;
+     out->extension      = in->extension;
+     out->evtype         = in->evtype;
+@@ -1957,6 +1963,7 @@ wireToPropertyEvent(xXIPropertyEvent *in, XGenericEventCookie *cookie)
+     cookie->data = out;
+ 
+     out->type           = in->type;
++    out->serial         = in->sequenceNumber;
+     out->extension      = in->extension;
+     out->evtype         = in->evtype;
+     out->send_event = ((in->type & 0x80) != 0);
+@@ -1977,6 +1984,7 @@ wireToTouchOwnershipEvent(xXITouchOwnershipEvent *in,
+     cookie->data = out;
+ 
+     out->type           = in->type;
++    out->serial         = in->sequenceNumber;
+     out->display        = cookie->display;
+     out->extension      = in->extension;
+     out->evtype         = in->evtype;
+@@ -2004,6 +2012,7 @@ wireToBarrierEvent(xXIBarrierEvent *in, XGenericEventCookie *cookie)
+ 
+     out->display    = cookie->display;
+     out->type       = in->type;
++    out->serial     = in->sequenceNumber;
+     out->extension  = in->extension;
+     out->evtype     = in->evtype;
+     out->send_event = ((in->type & 0x80) != 0);
+-- 
+1.8.3.1
+
+
+From 59b8e1388a687f871831ac5a9e0ac11de75e2516 Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Wed, 1 May 2013 23:58:39 -0700
+Subject: [PATCH 03/15] Use _XEatDataWords to avoid overflow of rep.length bit
+ shifting
+
+rep.length is a CARD32, so rep.length << 2 could overflow in 32-bit builds
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+---
+ configure.ac       |  6 ++++++
+ src/XGMotion.c     |  2 +-
+ src/XGetDCtl.c     |  2 +-
+ src/XGetDProp.c    |  5 ++---
+ src/XGetFCtl.c     |  2 +-
+ src/XGetKMap.c     |  2 +-
+ src/XGetMMap.c     |  2 +-
+ src/XGetProp.c     |  4 +---
+ src/XGtSelect.c    |  2 +-
+ src/XIProperties.c |  7 +++----
+ src/XIint.h        | 14 ++++++++++++++
+ src/XListDProp.c   |  2 +-
+ src/XListDev.c     |  2 +-
+ src/XOpenDev.c     |  2 +-
+ src/XQueryDv.c     |  2 +-
+ 15 files changed, 36 insertions(+), 20 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index 8dbca38..f5ef1e2 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -31,6 +31,12 @@ PKG_CHECK_MODULES(XI, [xproto >= 7.0.13] [x11 >= 1.4.99.1] [xextproto >= 7.0.3]
+ # CFLAGS only for PointerBarrier typedef
+ PKG_CHECK_MODULES(XFIXES, [xfixes >= 5])
+ 
++# Check for _XEatDataWords function that may be patched into older Xlib releases
++SAVE_LIBS="$LIBS"
++LIBS="$XI_LIBS"
++AC_CHECK_FUNCS([_XEatDataWords])
++LIBS="$SAVE_LIBS"
++
+ # Check for xmlto and asciidoc for man page conversion
+ # (only needed by people building tarballs)
+ if test "$have_xmlto" = yes && test "$have_asciidoc" = yes; then
+diff --git a/src/XGMotion.c b/src/XGMotion.c
+index 99b1c44..5feac85 100644
+--- a/src/XGMotion.c
++++ b/src/XGMotion.c
+@@ -112,7 +112,7 @@ XGetDeviceMotionEvents(
+ 	Xfree(bufp);
+ 	Xfree(savp);
+ 	*nEvents = 0;
+-	_XEatData(dpy, (unsigned long)size);
++	_XEatDataWords(dpy, rep.length);
+ 	UnlockDisplay(dpy);
+ 	SyncHandle();
+ 	return (NULL);
+diff --git a/src/XGetDCtl.c b/src/XGetDCtl.c
+index c66212d..f73a4e8 100644
+--- a/src/XGetDCtl.c
++++ b/src/XGetDCtl.c
+@@ -95,7 +95,7 @@ XGetDeviceControl(
+ 	nbytes = (long)rep.length << 2;
+ 	d = (xDeviceState *) Xmalloc((unsigned)nbytes);
+ 	if (!d) {
+-	    _XEatData(dpy, (unsigned long)nbytes);
++	    _XEatDataWords(dpy, rep.length);
+ 	    goto out;
+ 	}
+ 	sav = d;
+diff --git a/src/XGetDProp.c b/src/XGetDProp.c
+index 5d44f91..f9e8f0c 100644
+--- a/src/XGetDProp.c
++++ b/src/XGetDProp.c
+@@ -112,14 +112,13 @@ XGetDeviceProperty(Display* dpy, XDevice* dev,
+ 	     * This part of the code should never be reached.  If it is,
+ 	     * the server sent back a property with an invalid format.
+ 	     */
+-	    nbytes = rep.length << 2;
+-	    _XEatData(dpy, (unsigned long) nbytes);
++	    _XEatDataWords(dpy, rep.length);
+ 	    UnlockDisplay(dpy);
+ 	    SyncHandle();
+ 	    return(BadImplementation);
+ 	}
+ 	if (! *prop) {
+-	    _XEatData(dpy, (unsigned long) nbytes);
++	    _XEatDataWords(dpy, rep.length);
+ 	    UnlockDisplay(dpy);
+ 	    SyncHandle();
+ 	    return(BadAlloc);
+diff --git a/src/XGetFCtl.c b/src/XGetFCtl.c
+index 43afa00..28fab4d 100644
+--- a/src/XGetFCtl.c
++++ b/src/XGetFCtl.c
+@@ -95,7 +95,7 @@ XGetFeedbackControl(
+ 	nbytes = (long)rep.length << 2;
+ 	f = (xFeedbackState *) Xmalloc((unsigned)nbytes);
+ 	if (!f) {
+-	    _XEatData(dpy, (unsigned long)nbytes);
++	    _XEatDataWords(dpy, rep.length);
+ 	    goto out;
+ 	}
+ 	sav = f;
+diff --git a/src/XGetKMap.c b/src/XGetKMap.c
+index 9431fbb..00dde06 100644
+--- a/src/XGetKMap.c
++++ b/src/XGetKMap.c
+@@ -99,7 +99,7 @@ XGetDeviceKeyMapping(register Display * dpy, XDevice * dev,
+ 	if (mapping)
+ 	    _XRead(dpy, (char *)mapping, nbytes);
+ 	else
+-	    _XEatData(dpy, (unsigned long)nbytes);
++	    _XEatDataWords(dpy, rep.length);
+     }
+ 
+     UnlockDisplay(dpy);
+diff --git a/src/XGetMMap.c b/src/XGetMMap.c
+index 8a1cdb2..ce10c2d 100644
+--- a/src/XGetMMap.c
++++ b/src/XGetMMap.c
+@@ -92,7 +92,7 @@ XGetDeviceModifierMapping(
+ 	if (res->modifiermap)
+ 	    _XReadPad(dpy, (char *)res->modifiermap, nbytes);
+ 	else
+-	    _XEatData(dpy, (unsigned long)nbytes);
++	    _XEatDataWords(dpy, rep.length);
+ 	res->max_keypermod = rep.numKeyPerModifier;
+     }
+ 
+diff --git a/src/XGetProp.c b/src/XGetProp.c
+index c5d088b..34bc581 100644
+--- a/src/XGetProp.c
++++ b/src/XGetProp.c
+@@ -68,7 +68,6 @@ XGetDeviceDontPropagateList(
+     int			*count)
+ {
+     XEventClass *list = NULL;
+-    int rlen;
+     xGetDeviceDontPropagateListReq *req;
+     xGetDeviceDontPropagateListReply rep;
+     XExtDisplayInfo *info = XInput_find_display(dpy);
+@@ -90,7 +89,6 @@ XGetDeviceDontPropagateList(
+     *count = rep.count;
+ 
+     if (*count) {
+-	rlen = rep.length << 2;
+ 	list = (XEventClass *) Xmalloc(rep.length * sizeof(XEventClass));
+ 	if (list) {
+ 	    int i;
+@@ -105,7 +103,7 @@ XGetDeviceDontPropagateList(
+ 		list[i] = (XEventClass) ec;
+ 	    }
+ 	} else
+-	    _XEatData(dpy, (unsigned long)rlen);
++	    _XEatDataWords(dpy, rep.length);
+     }
+ 
+     UnlockDisplay(dpy);
+diff --git a/src/XGtSelect.c b/src/XGtSelect.c
+index f890db7..5c0f812 100644
+--- a/src/XGtSelect.c
++++ b/src/XGtSelect.c
+@@ -104,7 +104,7 @@ XGetSelectedExtensionEvents(
+ 		(XEventClass *) Xmalloc(*this_client_count *
+ 					sizeof(XEventClass));
+ 	    if (!*this_client_list) {
+-		_XEatData(dpy, (unsigned long)tlen + alen);
++		_XEatDataWords(dpy, rep.length);
+                 UnlockDisplay(dpy);
+                 SyncHandle();
+ 		return (Success);
+diff --git a/src/XIProperties.c b/src/XIProperties.c
+index 83a7a68..5e58fb6 100644
+--- a/src/XIProperties.c
++++ b/src/XIProperties.c
+@@ -64,7 +64,7 @@ XIListProperties(Display* dpy, int deviceid, int *num_props_return)
+         props = (Atom*)Xmalloc(rep.num_properties * sizeof(Atom));
+         if (!props)
+         {
+-            _XEatData(dpy, rep.num_properties << 2);
++            _XEatDataWords(dpy, rep.length);
+             goto cleanup;
+         }
+ 
+@@ -203,8 +203,7 @@ XIGetProperty(Display* dpy, int deviceid, Atom property, long offset,
+ 	     * This part of the code should never be reached.  If it is,
+ 	     * the server sent back a property with an invalid format.
+ 	     */
+-	    nbytes = rep.length << 2;
+-	    _XEatData(dpy, nbytes);
++	    _XEatDataWords(dpy, rep.length);
+ 	    UnlockDisplay(dpy);
+ 	    SyncHandle();
+ 	    return(BadImplementation);
+@@ -222,7 +221,7 @@ XIGetProperty(Display* dpy, int deviceid, Atom property, long offset,
+         *data = Xmalloc(rbytes);
+ 
+ 	if (!(*data)) {
+-	    _XEatData(dpy, nbytes);
++	    _XEatDataWords(dpy, rep.length);
+ 	    UnlockDisplay(dpy);
+ 	    SyncHandle();
+ 	    return(BadAlloc);
+diff --git a/src/XIint.h b/src/XIint.h
+index 571bb23..3ddc3c5 100644
+--- a/src/XIint.h
++++ b/src/XIint.h
+@@ -83,4 +83,18 @@ next_block(void **ptr, int size) {
+     return ret;
+ }
+ 
++#ifndef HAVE__XEATDATAWORDS
++#include <X11/Xmd.h>  /* for LONG64 on 64-bit platforms */
++#include <limits.h>
++
++static inline void _XEatDataWords(Display *dpy, unsigned long n)
++{
++# ifndef LONG64
++    if (n >= (ULONG_MAX >> 2))
++        _XIOError(dpy);
++# endif
++    _XEatData (dpy, n << 2);
++}
++#endif
++
+ #endif
+diff --git a/src/XListDProp.c b/src/XListDProp.c
+index 8667350..bde6cb5 100644
+--- a/src/XListDProp.c
++++ b/src/XListDProp.c
+@@ -65,7 +65,7 @@ XListDeviceProperties(Display* dpy, XDevice* dev, int *nprops_return)
+         props = (Atom*)Xmalloc(rep.nAtoms * sizeof(Atom));
+         if (!props)
+         {
+-            _XEatData(dpy, rep.nAtoms << 2);
++            _XEatDataWords(dpy, rep.length);
+             goto cleanup;
+         }
+ 
+diff --git a/src/XListDev.c b/src/XListDev.c
+index bd6e70a..1fa4747 100644
+--- a/src/XListDev.c
++++ b/src/XListDev.c
+@@ -202,7 +202,7 @@ XListInputDevices(
+ 	list = (xDeviceInfo *) Xmalloc(rlen);
+ 	slist = list;
+ 	if (!slist) {
+-	    _XEatData(dpy, (unsigned long)rlen);
++	    _XEatDataWords(dpy, rep.length);
+ 	    UnlockDisplay(dpy);
+ 	    SyncHandle();
+ 	    return (XDeviceInfo *) NULL;
+diff --git a/src/XOpenDev.c b/src/XOpenDev.c
+index 74f18ac..e784f8b 100644
+--- a/src/XOpenDev.c
++++ b/src/XOpenDev.c
+@@ -101,7 +101,7 @@ XOpenDevice(
+ 	if (rlen - dlen > 0)
+ 	    _XEatData(dpy, (unsigned long)rlen - dlen);
+     } else
+-	_XEatData(dpy, (unsigned long)rlen);
++	_XEatDataWords(dpy, rep.length);
+ 
+     UnlockDisplay(dpy);
+     SyncHandle();
+diff --git a/src/XQueryDv.c b/src/XQueryDv.c
+index 24d4e4e..69c285b 100644
+--- a/src/XQueryDv.c
++++ b/src/XQueryDv.c
+@@ -91,7 +91,7 @@ XQueryDeviceState(
+     if (rlen > 0) {
+ 	data = Xmalloc(rlen);
+ 	if (!data) {
+-	    _XEatData(dpy, (unsigned long)rlen);
++	    _XEatDataWords(dpy, rep.length);
+ 	    goto out;
+ 	}
+ 	_XRead(dpy, data, rlen);
+-- 
+1.8.3.1
+
+
+From f3e08e4fbe40016484ba795feecf1a742170ffc1 Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sat, 9 Mar 2013 22:26:52 -0800
+Subject: [PATCH 04/15] Stack buffer overflow in XGetDeviceButtonMapping()
+ [CVE-2013-1998 1/3]
+
+We copy the entire reply sent by the server into the fixed size
+mapping[] array on the stack, even if the server says it's a larger
+size than the mapping array can hold.  HULK SMASH STACK!
+
+Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+---
+ src/XGetBMap.c | 21 +++++++++++++--------
+ 1 file changed, 13 insertions(+), 8 deletions(-)
+
+diff --git a/src/XGetBMap.c b/src/XGetBMap.c
+index 211c9ca..002daba 100644
+--- a/src/XGetBMap.c
++++ b/src/XGetBMap.c
+@@ -60,6 +60,7 @@ SOFTWARE.
+ #include <X11/extensions/XInput.h>
+ #include <X11/extensions/extutil.h>
+ #include "XIint.h"
++#include <limits.h>
+ 
+ #ifdef MIN	/* some systems define this in <sys/param.h> */
+ #undef MIN
+@@ -75,7 +76,6 @@ XGetDeviceButtonMapping(
+ {
+     int status = 0;
+     unsigned char mapping[256];	/* known fixed size */
+-    long nbytes;
+     XExtDisplayInfo *info = XInput_find_display(dpy);
+ 
+     register xGetDeviceButtonMappingReq *req;
+@@ -92,13 +92,18 @@ XGetDeviceButtonMapping(
+ 
+     status = _XReply(dpy, (xReply *) & rep, 0, xFalse);
+     if (status == 1) {
+-	nbytes = (long)rep.length << 2;
+-	_XRead(dpy, (char *)mapping, nbytes);
+-
+-	/* don't return more data than the user asked for. */
+-	if (rep.nElts)
+-	    memcpy((char *)map, (char *)mapping, MIN((int)rep.nElts, nmap));
+-	status = rep.nElts;
++	if (rep.length <= (sizeof(mapping) >> 2)) {
++	    unsigned long nbytes = rep.length << 2;
++	    _XRead(dpy, (char *)mapping, nbytes);
++
++	    /* don't return more data than the user asked for. */
++	    if (rep.nElts)
++		memcpy(map, mapping, MIN((int)rep.nElts, nmap));
++	    status = rep.nElts;
++	} else {
++	    _XEatDataWords(dpy, rep.length);
++	    status = 0;
++	}
+     } else
+ 	status = 0;
+     UnlockDisplay(dpy);
+-- 
+1.8.3.1
+
+
+From 91434737f592e8f5cc1762383882a582b55fc03a Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sat, 9 Mar 2013 23:37:23 -0800
+Subject: [PATCH 05/15] memory corruption in _XIPassiveGrabDevice()
+ [CVE-2013-1998 2/3]
+
+If the server returned more modifiers than the caller asked for,
+we'd just keep copying past the end of the array provided by the
+caller, writing over who-knows-what happened to be there.
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+---
+ src/XIPassiveGrab.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/XIPassiveGrab.c b/src/XIPassiveGrab.c
+index ac17c01..53b4084 100644
+--- a/src/XIPassiveGrab.c
++++ b/src/XIPassiveGrab.c
+@@ -88,7 +88,7 @@ _XIPassiveGrabDevice(Display* dpy, int deviceid, int grabtype, int detail,
+         return -1;
+     _XRead(dpy, (char*)failed_mods, reply.num_modifiers * sizeof(xXIGrabModifierInfo));
+ 
+-    for (i = 0; i < reply.num_modifiers; i++)
++    for (i = 0; i < reply.num_modifiers && i < num_modifiers; i++)
+     {
+         modifiers_inout[i].status = failed_mods[i].status;
+         modifiers_inout[i].modifiers = failed_mods[i].modifiers;
+-- 
+1.8.3.1
+
+
+From 5398ac0797f7516f2c9b8f2869a6c6d071437352 Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Fri, 26 Apr 2013 22:48:36 -0700
+Subject: [PATCH 06/15] unvalidated lengths in XQueryDeviceState()
+ [CVE-2013-1998 3/3]
+
+If the lengths given for each class state in the reply add up to more
+than the rep.length, we could read past the end of the buffer allocated
+to hold the data read from the server.
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+---
+ src/XQueryDv.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+diff --git a/src/XQueryDv.c b/src/XQueryDv.c
+index 69c285b..3836777 100644
+--- a/src/XQueryDv.c
++++ b/src/XQueryDv.c
+@@ -59,6 +59,7 @@ SOFTWARE.
+ #include <X11/extensions/XInput.h>
+ #include <X11/extensions/extutil.h>
+ #include "XIint.h"
++#include <limits.h>
+ 
+ XDeviceState *
+ XQueryDeviceState(
+@@ -66,8 +67,8 @@ XQueryDeviceState(
+     XDevice		*dev)
+ {
+     int i, j;
+-    int rlen;
+-    int size = 0;
++    unsigned long rlen;
++    size_t size = 0;
+     xQueryDeviceStateReq *req;
+     xQueryDeviceStateReply rep;
+     XDeviceState *state = NULL;
+@@ -87,9 +88,11 @@ XQueryDeviceState(
+     if (!_XReply(dpy, (xReply *) & rep, 0, xFalse))
+         goto out;
+ 
+-    rlen = rep.length << 2;
+-    if (rlen > 0) {
+-	data = Xmalloc(rlen);
++    if (rep.length > 0) {
++	if (rep.length < (INT_MAX >> 2)) {
++	    rlen = (unsigned long) rep.length << 2;
++	    data = Xmalloc(rlen);
++	}
+ 	if (!data) {
+ 	    _XEatDataWords(dpy, rep.length);
+ 	    goto out;
+@@ -97,6 +100,10 @@ XQueryDeviceState(
+ 	_XRead(dpy, data, rlen);
+ 
+ 	for (i = 0, any = (XInputClass *) data; i < (int)rep.num_classes; i++) {
++	    if (any->length > rlen)
++		goto out;
++	    rlen -= any->length;
++
+ 	    switch (any->class) {
+ 	    case KeyClass:
+ 		size += sizeof(XKeyState);
+-- 
+1.8.3.1
+
+
+From b0b13c12a8079a5a0e7f43b2b8983699057b2cec Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sat, 9 Mar 2013 22:55:23 -0800
+Subject: [PATCH 07/15] integer overflow in XGetDeviceControl() [CVE-2013-1984
+ 1/8]
+
+If the number of valuators reported by the server is large enough that
+it overflows when multiplied by the size of the appropriate struct, then
+memory corruption can occur when more bytes are copied from the X server
+reply than the size of the buffer we allocated to hold them.
+
+v2: check that reply size fits inside the data read from the server, so
+we don't read out of bounds either
+
+Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+---
+ src/XGetDCtl.c | 31 ++++++++++++++++++++++++-------
+ 1 file changed, 24 insertions(+), 7 deletions(-)
+
+diff --git a/src/XGetDCtl.c b/src/XGetDCtl.c
+index f73a4e8..51ed0ae 100644
+--- a/src/XGetDCtl.c
++++ b/src/XGetDCtl.c
+@@ -61,6 +61,7 @@ SOFTWARE.
+ #include <X11/extensions/XInput.h>
+ #include <X11/extensions/extutil.h>
+ #include "XIint.h"
++#include <limits.h>
+ 
+ XDeviceControl *
+ XGetDeviceControl(
+@@ -68,8 +69,6 @@ XGetDeviceControl(
+     XDevice		*dev,
+     int			 control)
+ {
+-    int size = 0;
+-    int nbytes, i;
+     XDeviceControl *Device = NULL;
+     XDeviceControl *Sav = NULL;
+     xDeviceState *d = NULL;
+@@ -92,8 +91,12 @@ XGetDeviceControl(
+ 	goto out;
+ 
+     if (rep.length > 0) {
+-	nbytes = (long)rep.length << 2;
+-	d = (xDeviceState *) Xmalloc((unsigned)nbytes);
++	unsigned long nbytes;
++	size_t size = 0;
++	if (rep.length < (INT_MAX >> 2)) {
++	    nbytes = (unsigned long) rep.length << 2;
++	    d = Xmalloc(nbytes);
++	}
+ 	if (!d) {
+ 	    _XEatDataWords(dpy, rep.length);
+ 	    goto out;
+@@ -111,33 +114,46 @@ XGetDeviceControl(
+ 	case DEVICE_RESOLUTION:
+ 	{
+ 	    xDeviceResolutionState *r;
++	    size_t val_size;
+ 
+ 	    r = (xDeviceResolutionState *) d;
+-	    size += sizeof(XDeviceResolutionState) +
+-		(3 * sizeof(int) * r->num_valuators);
++	    if (r->num_valuators >= (INT_MAX / (3 * sizeof(int))))
++		goto out;
++	    val_size = 3 * sizeof(int) * r->num_valuators;
++	    if ((sizeof(xDeviceResolutionState) + val_size) > nbytes)
++		goto out;
++	    size += sizeof(XDeviceResolutionState) + val_size;
+ 	    break;
+ 	}
+         case DEVICE_ABS_CALIB:
+         {
++            if (sizeof(xDeviceAbsCalibState) > nbytes)
++                goto out;
+             size += sizeof(XDeviceAbsCalibState);
+             break;
+         }
+         case DEVICE_ABS_AREA:
+         {
++            if (sizeof(xDeviceAbsAreaState) > nbytes)
++                goto out;
+             size += sizeof(XDeviceAbsAreaState);
+             break;
+         }
+         case DEVICE_CORE:
+         {
++            if (sizeof(xDeviceCoreState) > nbytes)
++                goto out;
+             size += sizeof(XDeviceCoreState);
+             break;
+         }
+ 	default:
++	    if (d->length > nbytes)
++		goto out;
+ 	    size += d->length;
+ 	    break;
+ 	}
+ 
+-	Device = (XDeviceControl *) Xmalloc((unsigned)size);
++	Device = Xmalloc(size);
+ 	if (!Device)
+ 	    goto out;
+ 
+@@ -150,6 +166,7 @@ XGetDeviceControl(
+ 	    int *iptr, *iptr2;
+ 	    xDeviceResolutionState *r;
+ 	    XDeviceResolutionState *R;
++	    unsigned int i;
+ 
+ 	    r = (xDeviceResolutionState *) d;
+ 	    R = (XDeviceResolutionState *) Device;
+-- 
+1.8.3.1
+
+
+From 322ee3576789380222d4403366e4fd12fb24cb6a Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sat, 9 Mar 2013 22:55:23 -0800
+Subject: [PATCH 08/15] integer overflow in XGetFeedbackControl()
+ [CVE-2013-1984 2/8]
+
+If the number of feedbacks reported by the server is large enough that
+it overflows when multiplied by the size of the appropriate struct, or
+if the total size of all the feedback structures overflows when added
+together, then memory corruption can occur when more bytes are copied from
+the X server reply than the size of the buffer we allocated to hold them.
+
+v2: check that reply size fits inside the data read from the server, so
+    we don't read out of bounds either
+
+Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+---
+ src/XGetFCtl.c | 24 +++++++++++++++++++-----
+ 1 file changed, 19 insertions(+), 5 deletions(-)
+
+diff --git a/src/XGetFCtl.c b/src/XGetFCtl.c
+index 28fab4d..bb50bf3 100644
+--- a/src/XGetFCtl.c
++++ b/src/XGetFCtl.c
+@@ -61,6 +61,7 @@ SOFTWARE.
+ #include <X11/extensions/XInput.h>
+ #include <X11/extensions/extutil.h>
+ #include "XIint.h"
++#include <limits.h>
+ 
+ XFeedbackState *
+ XGetFeedbackControl(
+@@ -68,8 +69,6 @@ XGetFeedbackControl(
+     XDevice		*dev,
+     int			*num_feedbacks)
+ {
+-    int size = 0;
+-    int nbytes, i;
+     XFeedbackState *Feedback = NULL;
+     XFeedbackState *Sav = NULL;
+     xFeedbackState *f = NULL;
+@@ -91,9 +90,16 @@ XGetFeedbackControl(
+ 	goto out;
+ 
+     if (rep.length > 0) {
++	unsigned long nbytes;
++	size_t size = 0;
++	int i;
++
+ 	*num_feedbacks = rep.num_feedbacks;
+-	nbytes = (long)rep.length << 2;
+-	f = (xFeedbackState *) Xmalloc((unsigned)nbytes);
++
++	if (rep.length < (INT_MAX >> 2)) {
++	    nbytes = rep.length << 2;
++	    f = Xmalloc(nbytes);
++	}
+ 	if (!f) {
+ 	    _XEatDataWords(dpy, rep.length);
+ 	    goto out;
+@@ -102,6 +108,10 @@ XGetFeedbackControl(
+ 	_XRead(dpy, (char *)f, nbytes);
+ 
+ 	for (i = 0; i < *num_feedbacks; i++) {
++	    if (f->length > nbytes)
++		goto out;
++	    nbytes -= f->length;
++
+ 	    switch (f->class) {
+ 	    case KbdFeedbackClass:
+ 		size += sizeof(XKbdFeedbackState);
+@@ -116,6 +126,8 @@ XGetFeedbackControl(
+ 	    {
+ 		xStringFeedbackState *strf = (xStringFeedbackState *) f;
+ 
++		if (strf->num_syms_supported >= (INT_MAX / sizeof(KeySym)))
++		    goto out;
+ 		size += sizeof(XStringFeedbackState) +
+ 		    (strf->num_syms_supported * sizeof(KeySym));
+ 	    }
+@@ -130,10 +142,12 @@ XGetFeedbackControl(
+ 		size += f->length;
+ 		break;
+ 	    }
++	    if (size > INT_MAX)
++		goto out;
+ 	    f = (xFeedbackState *) ((char *)f + f->length);
+ 	}
+ 
+-	Feedback = (XFeedbackState *) Xmalloc((unsigned)size);
++	Feedback = Xmalloc(size);
+ 	if (!Feedback)
+ 	    goto out;
+ 
+-- 
+1.8.3.1
+
+
+From 6dd6dc51a2935c72774be81e5cc2ba2c30e9feff Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sat, 9 Mar 2013 22:55:23 -0800
+Subject: [PATCH 09/15] integer overflow in XGetDeviceDontPropagateList()
+ [CVE-2013-1984 3/8]
+
+If the number of event classes reported by the server is large enough
+that it overflows when multiplied by the size of the appropriate struct,
+then memory corruption can occur when more bytes are copied from the
+X server reply than the size of the buffer we allocated to hold them.
+
+V2: EatData if count is 0 but length is > 0 to avoid XIOErrors
+
+Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+---
+ src/XGetProp.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/src/XGetProp.c b/src/XGetProp.c
+index 34bc581..b49328c 100644
+--- a/src/XGetProp.c
++++ b/src/XGetProp.c
+@@ -60,6 +60,7 @@ SOFTWARE.
+ #include <X11/extensions/XInput.h>
+ #include <X11/extensions/extutil.h>
+ #include "XIint.h"
++#include <limits.h>
+ 
+ XEventClass *
+ XGetDeviceDontPropagateList(
+@@ -88,10 +89,11 @@ XGetDeviceDontPropagateList(
+     }
+     *count = rep.count;
+ 
+-    if (*count) {
+-	list = (XEventClass *) Xmalloc(rep.length * sizeof(XEventClass));
++    if (rep.length != 0) {
++	if ((rep.count != 0) && (rep.length < (INT_MAX / sizeof(XEventClass))))
++	    list = Xmalloc(rep.length * sizeof(XEventClass));
+ 	if (list) {
+-	    int i;
++	    unsigned int i;
+ 	    CARD32 ec;
+ 
+ 	    /* read and assign each XEventClass separately because
+-- 
+1.8.3.1
+
+
+From bb922ed4253b35590f0369f32a917ff89ade0830 Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sat, 9 Mar 2013 22:55:23 -0800
+Subject: [PATCH 10/15] integer overflow in XGetDeviceMotionEvents()
+ [CVE-2013-1984 4/8]
+
+If the number of events or axes reported by the server is large enough
+that it overflows when multiplied by the size of the appropriate struct,
+then memory corruption can occur when more bytes are copied from the
+X server reply than the size of the buffer we allocated to hold them.
+
+Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+---
+ src/XGMotion.c | 22 +++++++++++++++++-----
+ 1 file changed, 17 insertions(+), 5 deletions(-)
+
+diff --git a/src/XGMotion.c b/src/XGMotion.c
+index 5feac85..a4c75b6 100644
+--- a/src/XGMotion.c
++++ b/src/XGMotion.c
+@@ -59,6 +59,7 @@ SOFTWARE.
+ #include <X11/extensions/XInput.h>
+ #include <X11/extensions/extutil.h>
+ #include "XIint.h"
++#include <limits.h>
+ 
+ XDeviceTimeCoord *
+ XGetDeviceMotionEvents(
+@@ -74,7 +75,7 @@ XGetDeviceMotionEvents(
+     xGetDeviceMotionEventsReply rep;
+     XDeviceTimeCoord *tc;
+     int *data, *bufp, *readp, *savp;
+-    long size, size2;
++    unsigned long size;
+     int i, j;
+     XExtDisplayInfo *info = XInput_find_display(dpy);
+ 
+@@ -104,10 +105,21 @@ XGetDeviceMotionEvents(
+ 	SyncHandle();
+ 	return (NULL);
+     }
+-    size = rep.length << 2;
+-    size2 = rep.nEvents * (sizeof(XDeviceTimeCoord) + (rep.axes * sizeof(int)));
+-    savp = readp = (int *)Xmalloc(size);
+-    bufp = (int *)Xmalloc(size2);
++    if (rep.length < (INT_MAX >> 2)) {
++	size = rep.length << 2;
++	savp = readp = Xmalloc(size);
++    } else {
++	size = 0;
++	savp = readp = NULL;
++    }
++    /* rep.axes is a CARD8, so assume max number of axes for bounds check */
++    if (rep.nEvents <
++	(INT_MAX / (sizeof(XDeviceTimeCoord) + (UCHAR_MAX * sizeof(int))))) {
++	size_t bsize = rep.nEvents *
++	    (sizeof(XDeviceTimeCoord) + (rep.axes * sizeof(int)));
++	bufp = Xmalloc(bsize);
++    } else
++	bufp = NULL;
+     if (!bufp || !savp) {
+ 	Xfree(bufp);
+ 	Xfree(savp);
+-- 
+1.8.3.1
+
+
+From 242f92b490a695fbab244af5bad11b71f897c732 Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sat, 9 Mar 2013 22:55:23 -0800
+Subject: [PATCH 11/15] integer overflow in XIGetProperty() [CVE-2013-1984 5/8]
+
+If the number of items reported by the server is large enough that
+it overflows when multiplied by the size of the appropriate item type,
+then memory corruption can occur when more bytes are copied from the
+X server reply than the size of the buffer we allocated to hold them.
+
+Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+---
+ src/XIProperties.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/src/XIProperties.c b/src/XIProperties.c
+index 5e58fb6..32436d1 100644
+--- a/src/XIProperties.c
++++ b/src/XIProperties.c
+@@ -38,6 +38,7 @@
+ #include <X11/extensions/XInput2.h>
+ #include <X11/extensions/extutil.h>
+ #include "XIint.h"
++#include <limits.h>
+ 
+ Atom*
+ XIListProperties(Display* dpy, int deviceid, int *num_props_return)
+@@ -170,7 +171,7 @@ XIGetProperty(Display* dpy, int deviceid, Atom property, long offset,
+ {
+     xXIGetPropertyReq   *req;
+     xXIGetPropertyReply rep;
+-    long                    nbytes, rbytes;
++    unsigned long       nbytes, rbytes;
+ 
+     XExtDisplayInfo *info = XInput_find_display(dpy);
+ 
+@@ -216,9 +217,11 @@ XIGetProperty(Display* dpy, int deviceid, Atom property, long offset,
+ 	 * recopy the string to make it null terminated.
+ 	 */
+ 
+-        nbytes = rep.num_items * rep.format/8;
+-        rbytes = nbytes + 1;
+-        *data = Xmalloc(rbytes);
++	if (rep.num_items < (INT_MAX / (rep.format/8))) {
++	    nbytes = rep.num_items * rep.format/8;
++	    rbytes = nbytes + 1;
++	    *data = Xmalloc(rbytes);
++	}
+ 
+ 	if (!(*data)) {
+ 	    _XEatDataWords(dpy, rep.length);
+-- 
+1.8.3.1
+
+
+From 528419b9ef437e7eeafb41bf45e8ff7d818bd845 Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sat, 9 Mar 2013 22:55:23 -0800
+Subject: [PATCH 12/15] integer overflow in XIGetSelectedEvents()
+ [CVE-2013-1984 6/8]
+
+If the number of events or masks reported by the server is large enough
+that it overflows when multiplied by the size of the appropriate struct,
+or the sizes overflow as they are totaled up, then memory corruption can
+occur when more bytes are copied from the X server reply than the size
+of the buffer we allocated to hold them.
+
+v2: check that reply size fits inside the data read from the server,
+    so that we don't read out of bounds either
+
+Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+---
+ src/XISelEv.c | 25 +++++++++++++++++++------
+ 1 file changed, 19 insertions(+), 6 deletions(-)
+
+diff --git a/src/XISelEv.c b/src/XISelEv.c
+index f871222..0471bef 100644
+--- a/src/XISelEv.c
++++ b/src/XISelEv.c
+@@ -42,6 +42,7 @@ in this Software without prior written authorization from the author.
+ #include <X11/extensions/ge.h>
+ #include <X11/extensions/geproto.h>
+ #include "XIint.h"
++#include <limits.h>
+ 
+ int
+ XISelectEvents(Display* dpy, Window win, XIEventMask* masks, int num_masks)
+@@ -101,13 +102,14 @@ out:
+ XIEventMask*
+ XIGetSelectedEvents(Display* dpy, Window win, int *num_masks_return)
+ {
+-    int i, len = 0;
++    unsigned int i, len = 0;
+     unsigned char *mask;
+     XIEventMask *mask_out = NULL;
+     xXIEventMask *mask_in = NULL, *mi;
+     xXIGetSelectedEventsReq *req;
+     xXIGetSelectedEventsReply reply;
+     XExtDisplayInfo *info = XInput_find_display(dpy);
++    size_t rbytes;
+ 
+     *num_masks_return = -1;
+     LockDisplay(dpy);
+@@ -129,11 +131,16 @@ XIGetSelectedEvents(Display* dpy, Window win, int *num_masks_return)
+         goto out;
+     }
+ 
+-    mask_in = Xmalloc(reply.length * 4);
+-    if (!mask_in)
++    if (reply.length < (INT_MAX >> 2)) {
++        rbytes = (unsigned long) reply.length << 2;
++        mask_in = Xmalloc(rbytes);
++    }
++    if (!mask_in) {
++        _XEatDataWords(dpy, reply.length);
+         goto out;
++    }
+ 
+-    _XRead(dpy, (char*)mask_in, reply.length * 4);
++    _XRead(dpy, (char*)mask_in, rbytes);
+ 
+     /*
+      * This function takes interleaved xXIEventMask structs & masks off
+@@ -148,8 +155,14 @@ XIGetSelectedEvents(Display* dpy, Window win, int *num_masks_return)
+ 
+     for (i = 0, mi = mask_in; i < reply.num_masks; i++)
+     {
+-        len += mi->mask_len * 4;
+-        mi = (xXIEventMask*)((char*)mi + mi->mask_len * 4);
++        unsigned int mask_bytes = mi->mask_len * 4;
++        len += mask_bytes;
++        if (len > INT_MAX)
++            goto out;
++        if ((sizeof(xXIEventMask) + mask_bytes) > rbytes)
++            goto out;
++        rbytes -= (sizeof(xXIEventMask) + mask_bytes);
++        mi = (xXIEventMask*)((char*)mi + mask_bytes);
+         mi++;
+     }
+ 
+-- 
+1.8.3.1
+
+
+From 17071c1c608247800b2ca03a35b1fcc9c4cabe6c Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sun, 10 Mar 2013 13:30:55 -0700
+Subject: [PATCH 13/15] Avoid integer overflow in XGetDeviceProperties()
+ [CVE-2013-1984 7/8]
+
+If the number of items as reported by the Xserver is too large, it
+could overflow the calculation for the size of the buffer to copy the
+reply into, causing memory corruption.
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+---
+ src/XGetDProp.c | 61 ++++++++++++++++++++++++++++++++++-----------------------
+ 1 file changed, 37 insertions(+), 24 deletions(-)
+
+diff --git a/src/XGetDProp.c b/src/XGetDProp.c
+index f9e8f0c..3691122 100644
+--- a/src/XGetDProp.c
++++ b/src/XGetDProp.c
+@@ -38,6 +38,7 @@ in this Software without prior written authorization from the author.
+ #include <X11/extensions/XInput.h>
+ #include <X11/extensions/extutil.h>
+ #include "XIint.h"
++#include <limits.h>
+ 
+ int
+ XGetDeviceProperty(Display* dpy, XDevice* dev,
+@@ -48,7 +49,8 @@ XGetDeviceProperty(Display* dpy, XDevice* dev,
+ {
+     xGetDevicePropertyReq   *req;
+     xGetDevicePropertyReply rep;
+-    long                    nbytes, rbytes;
++    unsigned long           nbytes, rbytes;
++    int                     ret = Success;
+ 
+     XExtDisplayInfo *info = XInput_find_display(dpy);
+ 
+@@ -81,30 +83,43 @@ XGetDeviceProperty(Display* dpy, XDevice* dev,
+ 	 * data, but this last byte is null terminated and convenient for
+ 	 * returning string properties, so the client doesn't then have to
+ 	 * recopy the string to make it null terminated.
++	 *
++	 * Maximum item limits are set to both prevent integer overflow when
++	 * calculating the amount of memory to malloc, and to limit how much
++	 * memory will be used if a server provides an insanely high count.
+ 	 */
+ 	switch (rep.format) {
+ 	case 8:
+-	    nbytes = rep.nItems;
+-	    rbytes = rep.nItems + 1;
+-	    if (rbytes > 0 &&
+-		(*prop = (unsigned char *) Xmalloc ((unsigned)rbytes)))
+-		_XReadPad (dpy, (char *) *prop, nbytes);
++	    if (rep.nItems < INT_MAX) {
++		nbytes = rep.nItems;
++		rbytes = rep.nItems + 1;
++		if ((*prop = Xmalloc (rbytes)))
++		    _XReadPad (dpy, (char *) *prop, nbytes);
++		else
++		    ret = BadAlloc;
++	    }
+ 	    break;
+ 
+ 	case 16:
+-	    nbytes = rep.nItems << 1;
+-	    rbytes = rep.nItems * sizeof (short) + 1;
+-	    if (rbytes > 0 &&
+-		(*prop = (unsigned char *) Xmalloc ((unsigned)rbytes)))
+-		_XRead16Pad (dpy, (short *) *prop, nbytes);
++	    if (rep.nItems < (INT_MAX / sizeof (short))) {
++		nbytes = rep.nItems << 1;
++		rbytes = rep.nItems * sizeof (short) + 1;
++		if ((*prop = Xmalloc (rbytes)))
++		    _XRead16Pad (dpy, (short *) *prop, nbytes);
++		else
++		    ret = BadAlloc;
++	    }
+ 	    break;
+ 
+ 	case 32:
+-	    nbytes = rep.nItems << 2;
+-	    rbytes = rep.nItems * sizeof (long) + 1;
+-	    if (rbytes > 0 &&
+-		(*prop = (unsigned char *) Xmalloc ((unsigned)rbytes)))
+-		_XRead32 (dpy, (long *) *prop, nbytes);
++	    if (rep.nItems < (INT_MAX / sizeof (long))) {
++		nbytes = rep.nItems << 2;
++		rbytes = rep.nItems * sizeof (long) + 1;
++		if ((*prop = Xmalloc (rbytes)))
++		    _XRead32 (dpy, (long *) *prop, nbytes);
++		else
++		    ret = BadAlloc;
++	    }
+ 	    break;
+ 
+ 	default:
+@@ -112,16 +127,13 @@ XGetDeviceProperty(Display* dpy, XDevice* dev,
+ 	     * This part of the code should never be reached.  If it is,
+ 	     * the server sent back a property with an invalid format.
+ 	     */
+-	    _XEatDataWords(dpy, rep.length);
+-	    UnlockDisplay(dpy);
+-	    SyncHandle();
+-	    return(BadImplementation);
++	    ret = BadImplementation;
+ 	}
+ 	if (! *prop) {
+ 	    _XEatDataWords(dpy, rep.length);
+-	    UnlockDisplay(dpy);
+-	    SyncHandle();
+-	    return(BadAlloc);
++	    if (ret == Success)
++		ret = BadAlloc;
++	    goto out;
+ 	}
+ 	(*prop)[rbytes - 1] = '\0';
+     }
+@@ -130,9 +142,10 @@ XGetDeviceProperty(Display* dpy, XDevice* dev,
+     *actual_format = rep.format;
+     *nitems = rep.nItems;
+     *bytes_after = rep.bytesAfter;
++  out:
+     UnlockDisplay (dpy);
+     SyncHandle ();
+ 
+-    return Success;
++    return ret;
+ }
+ 
+-- 
+1.8.3.1
+
+
+From ef82512288d8ca36ac0beeb289f158195b0a8cae Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sun, 10 Mar 2013 00:22:14 -0800
+Subject: [PATCH 14/15] Avoid integer overflow in XListInputDevices()
+ [CVE-2013-1984 8/8]
+
+If the length of the reply as reported by the Xserver is too long, it
+could overflow the calculation for the size of the buffer to copy the
+reply into, causing memory corruption.
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+---
+ src/XListDev.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/src/XListDev.c b/src/XListDev.c
+index 1fa4747..1c14b96 100644
+--- a/src/XListDev.c
++++ b/src/XListDev.c
+@@ -60,6 +60,7 @@ SOFTWARE.
+ #include <X11/extensions/XInput.h>
+ #include <X11/extensions/extutil.h>
+ #include "XIint.h"
++#include <limits.h>
+ 
+ /* Calculate length field to a multiples of sizeof(XID). XIDs are typedefs
+  * to ulong and thus may be 8 bytes on some platforms. This can trigger a
+@@ -179,7 +180,7 @@ XListInputDevices(
+     XAnyClassPtr Any;
+     char *nptr, *Nptr;
+     int i;
+-    long rlen;
++    unsigned long rlen;
+     XExtDisplayInfo *info = XInput_find_display(dpy);
+ 
+     LockDisplay(dpy);
+@@ -198,9 +199,10 @@ XListInputDevices(
+ 
+     if ((*ndevices = rep.ndevices)) {	/* at least 1 input device */
+ 	size = *ndevices * sizeof(XDeviceInfo);
+-	rlen = rep.length << 2;	/* multiply length by 4    */
+-	list = (xDeviceInfo *) Xmalloc(rlen);
+-	slist = list;
++	if (rep.length < (INT_MAX >> 2)) {
++	    rlen = rep.length << 2;	/* multiply length by 4    */
++	    slist = list = Xmalloc(rlen);
++	}
+ 	if (!slist) {
+ 	    _XEatDataWords(dpy, rep.length);
+ 	    UnlockDisplay(dpy);
+-- 
+1.8.3.1
+
+
+From 81b4df8ac6aa1520c41c3526961014a6f115cc46 Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sun, 10 Mar 2013 00:16:22 -0800
+Subject: [PATCH 15/15] sign extension issue in XListInputDevices()
+ [CVE-2013-1995]
+
+nptr is (signed) char, which can be negative, and will sign extend
+when added to the int size, which means size can be subtracted from,
+leading to allocating too small a buffer to hold the data being copied
+from the X server's reply.
+
+v2: check that string size fits inside the data read from the server,
+    so that we don't read out of bounds either
+
+Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+---
+ src/XListDev.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/src/XListDev.c b/src/XListDev.c
+index 1c14b96..b85ff3c 100644
+--- a/src/XListDev.c
++++ b/src/XListDev.c
+@@ -73,7 +73,7 @@ static int pad_to_xid(int base_size)
+     return ((base_size + padsize - 1)/padsize) * padsize;
+ }
+ 
+-static int
++static size_t
+ SizeClassInfo(xAnyClassPtr *any, int num_classes)
+ {
+     int size = 0;
+@@ -170,7 +170,7 @@ XListInputDevices(
+     register Display	*dpy,
+     int			*ndevices)
+ {
+-    int size;
++    size_t size;
+     xListInputDevicesReq *req;
+     xListInputDevicesReply rep;
+     xDeviceInfo *list, *slist = NULL;
+@@ -178,7 +178,7 @@ XListInputDevices(
+     XDeviceInfo *clist = NULL;
+     xAnyClassPtr any, sav_any;
+     XAnyClassPtr Any;
+-    char *nptr, *Nptr;
++    unsigned char *nptr, *Nptr;
+     int i;
+     unsigned long rlen;
+     XExtDisplayInfo *info = XInput_find_display(dpy);
+@@ -217,9 +217,12 @@ XListInputDevices(
+             size += SizeClassInfo(&any, (int)list->num_classes);
+ 	}
+ 
+-	for (i = 0, nptr = (char *)any; i < *ndevices; i++) {
++	Nptr = ((unsigned char *)list) + rlen + 1;
++	for (i = 0, nptr = (unsigned char *)any; i < *ndevices; i++) {
+ 	    size += *nptr + 1;
+ 	    nptr += (*nptr + 1);
++	    if (nptr > Nptr)
++		goto out;
+ 	}
+ 
+ 	clist = (XDeviceInfoPtr) Xmalloc(size);
+@@ -245,8 +248,8 @@ XListInputDevices(
+ 	}
+ 
+ 	clist = sclist;
+-	nptr = (char *)any;
+-	Nptr = (char *)Any;
++	nptr = (unsigned char *)any;
++	Nptr = (unsigned char *)Any;
+ 	for (i = 0; i < *ndevices; i++, clist++) {
+ 	    clist->name = (char *)Nptr;
+ 	    memcpy(Nptr, nptr + 1, *nptr);
+@@ -256,6 +259,7 @@ XListInputDevices(
+ 	}
+     }
+ 
++  out:
+     XFree((char *)slist);
+     UnlockDisplay(dpy);
+     SyncHandle();
+-- 
+1.8.3.1
+
diff --git a/extra/mesa/CVE-2013-1993.patch b/extra/mesa/CVE-2013-1993.patch
new file mode 100644
index 000000000..00f723d35
--- /dev/null
+++ b/extra/mesa/CVE-2013-1993.patch
@@ -0,0 +1,82 @@
+From 80ac3b279e776b3d9f45a209e52c5bd34ba7e7df Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Fri, 26 Apr 2013 23:31:58 +0000
+Subject: integer overflow in XF86DRIOpenConnection() [CVE-2013-1993 1/2]
+
+busIdStringLength is a CARD32 and needs to be bounds checked before adding
+one to it to come up with the total size to allocate, to avoid integer
+overflow leading to underallocation and writing data from the network past
+the end of the allocated buffer.
+
+NOTE: This is a candidate for stable release branches.
+
+Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+Reviewed-by: Brian Paul <brianp@vmware.com>
+(cherry picked from commit 2e5a268f18be30df15aed0b44b01a18a37fb5df4)
+---
+diff --git a/src/glx/XF86dri.c b/src/glx/XF86dri.c
+index b1cdc9b..8f53bd7 100644
+--- a/src/glx/XF86dri.c
++++ b/src/glx/XF86dri.c
+@@ -43,6 +43,7 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ #include <X11/extensions/Xext.h>
+ #include <X11/extensions/extutil.h>
+ #include "xf86dristr.h"
++#include <limits.h>
+ 
+ static XExtensionInfo _xf86dri_info_data;
+ static XExtensionInfo *xf86dri_info = &_xf86dri_info_data;
+@@ -201,7 +202,11 @@ XF86DRIOpenConnection(Display * dpy, int screen, drm_handle_t * hSAREA,
+    }
+ 
+    if (rep.length) {
+-      if (!(*busIdString = calloc(rep.busIdStringLength + 1, 1))) {
++      if (rep.busIdStringLength < INT_MAX)
++         *busIdString = calloc(rep.busIdStringLength + 1, 1);
++      else
++         *busIdString = NULL;
++      if (*busIdString == NULL) {
+          _XEatData(dpy, ((rep.busIdStringLength + 3) & ~3));
+          UnlockDisplay(dpy);
+          SyncHandle();
+--
+cgit v0.9.0.2-2-gbebe
+From 6de60ddf9ccac6f185d8f4e88ddfc63a94bd670f Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Fri, 26 Apr 2013 23:33:03 +0000
+Subject: integer overflow in XF86DRIGetClientDriverName() [CVE-2013-1993 2/2]
+
+clientDriverNameLength is a CARD32 and needs to be bounds checked before
+adding one to it to come up with the total size to allocate, to avoid
+integer overflow leading to underallocation and writing data from the
+network past the end of the allocated buffer.
+
+NOTE: This is a candidate for stable release branches.
+
+Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+Reviewed-by: Brian Paul <brianp@vmware.com>
+(cherry picked from commit 306f630e676eb901789dd09a0f30d7e7fa941ebe)
+---
+diff --git a/src/glx/XF86dri.c b/src/glx/XF86dri.c
+index 8f53bd7..56e3557 100644
+--- a/src/glx/XF86dri.c
++++ b/src/glx/XF86dri.c
+@@ -305,9 +305,11 @@ XF86DRIGetClientDriverName(Display * dpy, int screen,
+    *ddxDriverPatchVersion = rep.ddxDriverPatchVersion;
+ 
+    if (rep.length) {
+-      if (!
+-          (*clientDriverName =
+-           calloc(rep.clientDriverNameLength + 1, 1))) {
++      if (rep.clientDriverNameLength < INT_MAX)
++         *clientDriverName = calloc(rep.clientDriverNameLength + 1, 1);
++      else
++         *clientDriverName = NULL;
++      if (*clientDriverName == NULL) {
+          _XEatData(dpy, ((rep.clientDriverNameLength + 3) & ~3));
+          UnlockDisplay(dpy);
+          SyncHandle();
+--
+cgit v0.9.0.2-2-gbebe
diff --git a/extra/mesa/PKGBUILD b/extra/mesa/PKGBUILD
index 013152b1c..4fa536edd 100644
--- a/extra/mesa/PKGBUILD
+++ b/extra/mesa/PKGBUILD
@@ -1,11 +1,11 @@
-# $Id: PKGBUILD 186351 2013-05-25 08:49:44Z andyrtr $
+# $Id: PKGBUILD 188839 2013-06-22 10:51:37Z lcarlier $
 # Maintainer: Jan de Groot <jgc@archlinux.org>
 # Maintainer: Andreas Radke <andyrtr@archlinux.org>
 
 pkgbase=mesa
 pkgname=('mesa' 'mesa-libgl')
 pkgver=9.1.3
-pkgrel=1
+pkgrel=2
 arch=('i686' 'x86_64' 'mips64el')
 makedepends=('python2' 'libxml2' 'libx11' 'glproto' 'libdrm' 'dri2proto' 'libxxf86vm' 'libxdamage'
              'wayland' 'systemd')
@@ -17,10 +17,18 @@ url="http://mesa3d.sourceforge.net"
 license=('custom')
 options=('!libtool')
 source=(ftp://ftp.freedesktop.org/pub/mesa/${pkgver}/MesaLib-${pkgver}.tar.bz2
-	#ftp://ftp.freedesktop.org/pub/mesa/9.1/MesaLib-9.1-rc2.tar.bz2 # for RC testing
-        LICENSE)
+        LICENSE
+	CVE-2013-1993.patch)
 md5sums=('952ccd03547ed72333b64e1746cf8ada'
-         '5c65a0fe315dd347e09b1f2826a1df5a')
+         '5c65a0fe315dd347e09b1f2826a1df5a'
+         'dc8dad7c9bc6a92bd9c33b27b9da825e')
+
+prepare() {
+    cd ${srcdir}/?esa-*
+
+    # fix CVE-2013-1993 merged upstream
+    patch -Np1 -i ${srcdir}/CVE-2013-1993.patch
+}
 
 build() {
     cd ${srcdir}/?esa-*
@@ -31,11 +39,6 @@ build() {
      extraconf=""
    fi
 
-    # pick 2 commits from master to
-    # fix a nouveau crash: http://cgit.freedesktop.org/mesa/mesa/commit/?id=17f1cb1d99e66227d1e05925ef937643f5c1089a
-    # and intel kwin slowness http://cgit.freedesktop.org/mesa/mesa/commit/?id=e062a4187d8ea518a39c913ae7562cf1d8ac3205
-    #patch -Np1 -i ${srcdir}/git-fixes.patch
-
     autoreconf -vfi # our automake is far too new for their build system :)
 
     ./configure --prefix=/usr \
@@ -71,7 +74,7 @@ build() {
 
 package_ati-dri() {
   pkgdesc="Mesa drivers for AMD/ATI Radeon"
-  depends=("mesa-libgl=${pkgver}" 'llvm-amdgpu-lib-snapshot')
+  depends=("mesa-libgl=${pkgver}")
   conflicts=('xf86-video-ati<6.9.0-6')
 
   install -m755 -d ${pkgdir}/usr/lib/vdpau/
@@ -100,7 +103,7 @@ package_intel-dri() {
 
 package_nouveau-dri() {
   pkgdesc="Mesa drivers for Nouveau"
-  depends=("mesa-libgl=${pkgver}" 'llvm-amdgpu-lib-snapshot')
+  depends=("mesa-libgl=${pkgver}")
 
   install -m755 -d ${pkgdir}/usr/lib/vdpau/
   mv -v ${srcdir}/fakeinstall/usr/lib/vdpau/libvdpau_nouveau.* ${pkgdir}/usr/lib/vdpau/
@@ -117,7 +120,7 @@ package_nouveau-dri() {
 
 package_svga-dri() {
   pkgdesc="Gallium3D VMware guest GL driver"
-  depends=('gcc-libs' 'libdrm' 'expat' 'libffi' 'llvm-amdgpu-lib-snapshot')
+  depends=('libdrm' 'expat' 'llvm-amdgpu-lib-snapshot')
 
   install -m755 -d ${pkgdir}/usr/lib/xorg/modules/dri
   mv -v ${srcdir}/fakeinstall/usr/lib/xorg/modules/dri/vmwgfx_dri.so ${pkgdir}/usr/lib/xorg/modules/dri/
diff --git a/extra/php-xcache/PKGBUILD b/extra/php-xcache/PKGBUILD
index 973fdc58d..02e375e98 100644
--- a/extra/php-xcache/PKGBUILD
+++ b/extra/php-xcache/PKGBUILD
@@ -1,8 +1,8 @@
-# $Id: PKGBUILD 175092 2013-01-13 14:39:10Z pierre $
+# $Id: PKGBUILD 188803 2013-06-21 12:38:37Z pierre $
 # Maintainer: Pierre Schmitz <pierre@archlinux.de>
 
 pkgname=php-xcache
-pkgver=3.0.1
+pkgver=3.0.3
 pkgrel=1
 arch=('i686' 'x86_64' 'mips64el')
 pkgdesc='A PHP opcode cacher'
@@ -12,7 +12,7 @@ license=('custom')
 source=("http://xcache.lighttpd.net/pub/Releases/${pkgver}/xcache-${pkgver}.tar.bz2"
         'xcache.ini')
 backup=('etc/php/conf.d/xcache.ini')
-md5sums=('45086010bc4f82f506c08be1c556941b'
+md5sums=('8e9d59785725747f9f099af2bd54ddd2'
          '8fd9ce537ada9463c4b0c042243158c0')
 
 build() {
diff --git a/extra/r/PKGBUILD b/extra/r/PKGBUILD
index b6cb2551c..717b1b0e4 100644
--- a/extra/r/PKGBUILD
+++ b/extra/r/PKGBUILD
@@ -1,10 +1,10 @@
-# $Id: PKGBUILD 184431 2013-05-06 19:39:38Z foutrelis $
+# $Id: PKGBUILD 188821 2013-06-22 06:15:43Z foutrelis $
 # Maintainer: Ronald van Haren <ronald.archlinux.org>
 # Contributor: Damir Perisa <damir.perisa@bluewin.ch>
 # Contributor: K. Piche <kpiche@rogers.com>
 
 pkgname=r
-pkgver=3.0.0
+pkgver=3.0.1
 pkgrel=1
 pkgdesc="Language and environment for statistical computing and graphics"
 arch=('i686' 'x86_64' 'mips64el')
@@ -22,7 +22,7 @@ source=("http://cran.r-project.org/src/base/R-${pkgver%%.*}/R-${pkgver}.tar.gz"
 	'r.desktop'
 	'r.png'
 	'R.conf')
-sha1sums=('0cb1d1b815af4ce640ceafd5402a2eb94924c945'
+sha1sums=('5cc65476837926fdf04105954ea94efa53ac85ce'
           '13aa29219bcaa102e575de8c1c8e0833d233e836'
           'a69a07ec363440efc18ce0a7f2af103375dea978'
           '43668da6cfd1b4455a99f23e79e2059294dddac9')
diff --git a/extra/refind-efi/PKGBUILD b/extra/refind-efi/PKGBUILD
new file mode 100644
index 000000000..028af2afd
--- /dev/null
+++ b/extra/refind-efi/PKGBUILD
@@ -0,0 +1,211 @@
+# $Id: PKGBUILD 188814 2013-06-21 19:48:54Z tpowa $
+# Maintainer: Tobias Powalowski <tpowa@archlinux.org>
+# Contributor: Keshav Padram <(the.ridikulus.rat) (aatt) (gemmaeiil) (ddoott) (ccoomm)>
+
+#######
+_TIANOCORE_SVN_URL="https://svn.code.sf.net/p/edk2/code/branches/UDK2010.SR1"
+# BaseTools MdePkg MdeModulePkg IntelFrameworkPkg IntelFrameworkModulePkg
+_TIANO_DIR_="tianocore-udk-svn"
+#######
+
+#######
+_TIANOCORE_PKG="Mde"
+_TIANOCORE_TARGET="RELEASE"
+_UDK_TARGET="${_TIANOCORE_PKG}Pkg/${_TIANOCORE_PKG}Pkg.dsc"
+_COMPILER="GCC46"
+#######
+
+pkgname="refind-efi"
+pkgver="0.6.12"
+pkgrel="2"
+pkgdesc="Rod Smith's fork of rEFIt UEFI Boot Manager - built with Tianocore UDK libs"
+url="http://www.rodsbooks.com/refind/index.html"
+arch=('x86_64' 'i686')
+license=('GPL3' 'custom')
+
+makedepends=('subversion' 'python2')
+depends=('dosfstools' 'efibootmgr')
+optdepends=('mactel-boot: For bless command in Apple Mac systems'
+            'bash: For /usr/bin/refind-mkfont script'
+            'imagemagick: For /usr/bin/refind-mkfont script')
+
+options=('!strip' 'docs' '!makeflags')
+
+install="${pkgname}.install"
+
+source=("http://downloads.sourceforge.net/refind/refind-src-${pkgver}.zip"
+        'UDK-MdePkg-Revert-PathNodeCount.patch'
+        'refind_linux.conf')
+
+for _DIR_ in BaseTools MdePkg MdeModulePkg IntelFrameworkPkg IntelFrameworkModulePkg ; do
+	source+=("${_TIANO_DIR_}/${_DIR_}::svn+${_TIANOCORE_SVN_URL}/${_DIR_}")
+done
+
+sha1sums=('aabac34b2a30e16c5fd105777b9245c2ed0496e4'
+          '4d1992699f9b48dd2b7e6bd6c0b25fc065f75894'
+          '3d53eb615c3363d45feb95b9bfbf1d5491bf1c24'
+          'SKIP'
+          'SKIP'
+          'SKIP'
+          'SKIP'
+          'SKIP')
+
+[[ "${CARCH}" == "x86_64" ]] && _TIANO_ARCH="X64"
+[[ "${CARCH}" == "i686" ]] && _TIANO_ARCH="IA32"
+
+[[ "${CARCH}" == "x86_64" ]] && _TIANO_S_ARCH="x64"
+[[ "${CARCH}" == "i686" ]] && _TIANO_S_ARCH="ia32"
+
+_tianocore_udk_common() {
+	
+	## Unset all FLAGS
+	unset CFLAGS
+	unset CPPFLAGS
+	unset CXXFLAGS
+	unset LDFLAGS
+	unset MAKEFLAGS
+	
+	## Setup UDK Environment variables
+	export _UDK_DIR="${srcdir}/${_TIANO_DIR_}_build"
+	export EDK_TOOLS_PATH="${_UDK_DIR}/BaseTools"
+	
+	rm -rf "${_UDK_DIR}/" || true
+	mkdir -p "${_UDK_DIR}/"
+	
+	for _DIR_ in BaseTools MdePkg MdeModulePkg IntelFrameworkPkg IntelFrameworkModulePkg ; do
+		mv "${srcdir}/${_DIR_}" "${_UDK_DIR}/${_DIR_}"
+	done
+	
+	cd "${_UDK_DIR}/"
+	
+	## Fix PcdMaximumPathNodeCount compile error
+	patch -Np1 -R -i "${srcdir}/UDK-MdePkg-Revert-PathNodeCount.patch"
+	echo
+	
+	## Cleanup UDK config files
+	rm -rf "${_UDK_DIR}/Build/" || true
+	rm -rf "${_UDK_DIR}/Conf/" || true
+	mkdir -p "${_UDK_DIR}/Conf/"
+	mkdir -p "${_UDK_DIR}/Build/"
+	
+	## UDK BaseTools requires python2
+	sed 's|python |python2 |g' -i "${EDK_TOOLS_PATH}/BinWrappers/PosixLike"/* || true
+	sed 's|python |python2 |g' -i "${EDK_TOOLS_PATH}/Tests/GNUmakefile"
+	
+	## Fix GCC Warning as error
+	sed 's|-Werror |-Wno-error -Wno-unused-but-set-variable |g' -i "${EDK_TOOLS_PATH}/Source/C/Makefiles/header.makefile" || true
+	sed 's|-Werror |-Wno-error -Wno-unused-but-set-variable |g' -i "${EDK_TOOLS_PATH}/Conf/tools_def.template" || true
+	
+	## Fix GCC >=4.7 error - gcc: error: unrecognized command line option '-melf_x86_64'
+	sed 's| -m64 --64 -melf_x86_64| -m64|g' -i "${EDK_TOOLS_PATH}/Conf/tools_def.template" || true
+	sed 's|--64 | |g' -i "${EDK_TOOLS_PATH}/Conf/tools_def.template" || true
+	sed 's| -m64 -melf_x86_64| -m64|g' -i "${EDK_TOOLS_PATH}/Conf/tools_def.template" || true
+	
+	## Remove GCC -g debug option and add -0s -mabi=ms
+	sed 's|DEFINE GCC_ALL_CC_FLAGS            = -g |DEFINE GCC_ALL_CC_FLAGS            = -Os -mabi=ms |g' -i "${EDK_TOOLS_PATH}/Conf/tools_def.template" || true
+	sed 's|DEFINE GCC44_ALL_CC_FLAGS            = -g |DEFINE GCC44_ALL_CC_FLAGS            = -Os -mabi=ms |g' -i "${EDK_TOOLS_PATH}/Conf/tools_def.template" || true
+	
+	## Fix UDK Target Platform
+	sed "s|ACTIVE_PLATFORM       = Nt32Pkg/Nt32Pkg.dsc|ACTIVE_PLATFORM       = ${_UDK_TARGET}|g" -i "${EDK_TOOLS_PATH}/Conf/target.template" || true
+	sed "s|TARGET                = DEBUG|TARGET                = ${_TIANOCORE_TARGET}|g" -i "${EDK_TOOLS_PATH}/Conf/target.template" || true
+	sed "s|TOOL_CHAIN_TAG        = MYTOOLS|TOOL_CHAIN_TAG        = ${_COMPILER}|g" -i "${EDK_TOOLS_PATH}/Conf/target.template" || true
+	
+	## Setup UDK Environment
+	chmod +x "${_UDK_DIR}/BaseTools/BuildEnv"
+	source "${_UDK_DIR}/BaseTools/BuildEnv" BaseTools
+	echo
+	
+	## Compile UDK BaseTools
+	make -C "${EDK_TOOLS_PATH}"
+	echo
+	
+	## Compile UDK x86_64-UEFI Libraries
+	"${EDK_TOOLS_PATH}/BinWrappers/PosixLike/build" -p "${_UDK_TARGET}" -a "${_TIANO_ARCH}" -b "${_TIANOCORE_TARGET}" -t "${_COMPILER}"
+	echo
+	
+	## Fix UDK Target ARCH for rEFInd
+	sed "s|IA32|${_TIANO_ARCH}|g" -i "${_UDK_DIR}/Conf/target.txt" || true
+	
+}
+
+build() {
+	
+	_tianocore_udk_common
+	echo
+	
+	cd "${srcdir}/refind-${pkgver}/"
+	
+	## Fix UDK Path in rEFInd Makefiles
+	sed "s|EDK2BASE = /usr/local/UDK2010/MyWorkSpace|EDK2BASE = ${_UDK_DIR}|g" -i "${srcdir}/refind-${pkgver}/Make.tiano" || true
+	sed "s|EDK2BASE = /usr/local/UDK2010/MyWorkSpace|EDK2BASE = ${_UDK_DIR}|g" -i "${srcdir}/refind-${pkgver}/filesystems/Make.tiano" || true
+	sed "s|EDK2BASE = /usr/local/UDK2010/MyWorkSpace|EDK2BASE = ${_UDK_DIR}|g" -i "${srcdir}/refind-${pkgver}/gptsync/Make.tiano" || true
+	
+	## Unset all FLAGS
+	unset CFLAGS
+	unset CPPFLAGS
+	unset CXXFLAGS
+	unset LDFLAGS
+	unset MAKEFLAGS
+	
+	## Compile refind.efi
+	make tiano
+	
+	## Compile UEFI FS drivers
+	make fs
+	
+}
+
+package() {
+	
+	## Install the rEFInd UEFI application
+	install -d "${pkgdir}/usr/lib/refind/"
+	install -D -m0644 "${srcdir}/refind-${pkgver}/refind/refind_${_TIANO_S_ARCH}.efi" "${pkgdir}/usr/lib/refind/refind_${_TIANO_S_ARCH}.efi"
+	
+	## Install UEFI drivers built from rEFInd
+	install -d "${pkgdir}/usr/lib/refind/drivers_${_TIANO_S_ARCH}/"
+	install -D -m0644 "${srcdir}/refind-${pkgver}/drivers_${_TIANO_S_ARCH}"/*.efi "${pkgdir}/usr/lib/refind/drivers_${_TIANO_S_ARCH}/"
+	
+	## Install UEFI applications built from rEFInd
+	install -d "${pkgdir}/usr/lib/refind/tools_${_TIANO_S_ARCH}"
+	install -D -m0644 "${srcdir}/refind-${pkgver}/gptsync/gptsync_${_TIANO_S_ARCH}.efi" "${pkgdir}/usr/lib/refind/tools_${_TIANO_S_ARCH}/gptsync_${_TIANO_S_ARCH}.efi"
+	
+	## Install the rEFInd config file
+	install -d "${pkgdir}/usr/lib/refind/config/"
+	install -D -m0644 "${srcdir}/refind-${pkgver}/refind.conf-sample" "${pkgdir}/usr/lib/refind/config/refind.conf"
+	install -D -m0644 "${srcdir}/refind_linux.conf" "${pkgdir}/usr/lib/refind/config/refind_linux.conf"
+	
+	## Install the rEFInd docs
+	install -d "${pkgdir}/usr/share/refind/docs/html/"
+	install -d "${pkgdir}/usr/share/refind/docs/Styles/"
+	install -D -m0644 "${srcdir}/refind-${pkgver}/docs/refind"/* "${pkgdir}/usr/share/refind/docs/html/"
+	install -D -m0644 "${srcdir}/refind-${pkgver}/docs/Styles"/* "${pkgdir}/usr/share/refind/docs/Styles/"
+	install -D -m0644 "${srcdir}/refind-${pkgver}/README.txt" "${pkgdir}/usr/share/refind/docs/README"
+	install -D -m0644 "${srcdir}/refind-${pkgver}/NEWS.txt" "${pkgdir}/usr/share/refind/docs/NEWS"
+	rm -f "${pkgdir}/usr/share/refind/docs/html/.DS_Store" || true
+	
+	## Install the rEFInd fonts
+	install -d "${pkgdir}/usr/share/refind/fonts/"
+	install -D -m0644 "${srcdir}/refind-${pkgver}/fonts"/* "${pkgdir}/usr/share/refind/fonts/"
+	rm -f "${pkgdir}/usr/share/refind/fonts/mkfont.sh"
+	
+	## Install the rEFInd mkfont.sh
+	install -d "${pkgdir}/usr/bin/"
+	install -D -m0755 "${srcdir}/refind-${pkgver}/fonts/mkfont.sh" "${pkgdir}/usr/bin/refind-mkfont"
+	
+	## Install the rEFInd icons
+	install -d "${pkgdir}/usr/share/refind/icons/"
+	install -D -m0644 "${srcdir}/refind-${pkgver}/icons"/* "${pkgdir}/usr/share/refind/icons/"
+	
+	## Install the rEFInd images
+	install -d "${pkgdir}/usr/share/refind/images/"
+	install -D -m0644 "${srcdir}/refind-${pkgver}/images"/*.{png,bmp} "${pkgdir}/usr/share/refind/images/"
+	
+	## Install the rEFInd keys
+	install -d "${pkgdir}/usr/share/refind/keys/"
+	install -D -m0644 "${srcdir}/refind-${pkgver}/keys"/* "${pkgdir}/usr/share/refind/keys/"
+	
+	## Install the rEFIt license file, since rEFInd is a fork of rEFIt
+	install -d "${pkgdir}/usr/share/licenses/refind/"
+	install -D -m0644 "${srcdir}/refind-${pkgver}/LICENSE.txt" "${pkgdir}/usr/share/licenses/refind/LICENSE"
+	
+}
diff --git a/extra/refind-efi/UDK-MdePkg-Revert-PathNodeCount.patch b/extra/refind-efi/UDK-MdePkg-Revert-PathNodeCount.patch
new file mode 100644
index 000000000..1b8f5a44b
--- /dev/null
+++ b/extra/refind-efi/UDK-MdePkg-Revert-PathNodeCount.patch
@@ -0,0 +1,660 @@
+commit 771729c77fa49cf0ff17491f371003c4f5d66f85
+Author: niruiyu <niruiyu@6f19259b-4bc3-4df7-8a09-765794883524>
+Date:   Mon Sep 24 03:20:35 2012 +0000
+
+    Add new API IsDevicePathValid() to UefiDevicePathLib.
+    
+    Signed-off-by: Ruiyu Ni<ruiyu.ni@intel.com>
+    Reviewed-by: Liming Gao<liming.gao@intel.com>
+    Reviewed-by: Kinney Michael D<michael.d.kinney@intel.com>
+    
+    git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@13737 6f19259b-4bc3-4df7-8a09-765794883524
+
+diff --git a/MdePkg/Include/Library/DevicePathLib.h b/MdePkg/Include/Library/DevicePathLib.h
+index 68b1f1b..37acd45 100644
+--- a/MdePkg/Include/Library/DevicePathLib.h
++++ b/MdePkg/Include/Library/DevicePathLib.h
+@@ -4,7 +4,7 @@
+   This library provides defines, macros, and functions to help create and parse 

+   EFI_DEVICE_PATH_PROTOCOL structures.

+ 

+-Copyright (c) 2006 - 2010, Intel Corporation. All rights reserved.<BR>

++Copyright (c) 2006 - 2012, Intel Corporation. All rights reserved.<BR>

+ This program and the accompanying materials are licensed and made available under 

+ the terms and conditions of the BSD License that accompanies this distribution.  

+ The full text of the license may be found at

+@@ -21,6 +21,28 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+ #define END_DEVICE_PATH_LENGTH               (sizeof (EFI_DEVICE_PATH_PROTOCOL))

+ 

+ /**

++  Determine whether a given device path is valid.

++  If DevicePath is NULL, then ASSERT().

++

++  @param  DevicePath  A pointer to a device path data structure.

++  @param  MaxSize     The maximum size of the device path data structure.

++

++  @retval TRUE        DevicePath is valid.

++  @retval FALSE       The length of any node node in the DevicePath is less

++                      than sizeof (EFI_DEVICE_PATH_PROTOCOL).

++  @retval FALSE       If MaxSize is not zero, the size of the DevicePath

++                      exceeds MaxSize.

++  @retval FALSE       If PcdMaximumDevicePathNodeCount is not zero, the node

++                      count of the DevicePath exceeds PcdMaximumDevicePathNodeCount.

++**/

++BOOLEAN

++EFIAPI

++IsDevicePathValid (

++  IN CONST EFI_DEVICE_PATH_PROTOCOL *DevicePath,

++  IN       UINTN                    MaxSize

++  );

++

++/**

+   Returns the Type field of a device path node.

+ 

+   Returns the Type field of the device path node specified by Node.

+@@ -123,7 +145,8 @@ IsDevicePathEndType (
+   Determines if a device path node is an end node of an entire device path.

+ 

+   Determines if a device path node specified by Node is an end node of an entire device path.

+-  If Node represents the end of an entire device path, then TRUE is returned.  Otherwise, FALSE is returned.

++  If Node represents the end of an entire device path, then TRUE is returned.

++  Otherwise, FALSE is returned.

+ 

+   If Node is NULL, then ASSERT().

+ 

+@@ -143,7 +166,8 @@ IsDevicePathEnd (
+   Determines if a device path node is an end node of a device path instance.

+ 

+   Determines if a device path node specified by Node is an end node of a device path instance.

+-  If Node represents the end of a device path instance, then TRUE is returned.  Otherwise, FALSE is returned.

++  If Node represents the end of a device path instance, then TRUE is returned.

++  Otherwise, FALSE is returned.

+ 

+   If Node is NULL, then ASSERT().

+ 

+@@ -169,6 +193,7 @@ IsDevicePathEndInstance (
+ 

+   If Node is NULL, then ASSERT().

+   If NodeLength >= 0x10000, then ASSERT().

++  If NodeLength < sizeof (EFI_DEVICE_PATH_PROTOCOL), then ASSERT().

+ 

+   @param  Node      A pointer to a device path node data structure.

+   @param  Length    The length, in bytes, of the device path node.

+@@ -208,13 +233,14 @@ SetDevicePathEndNode (
+ /**

+   Returns the size of a device path in bytes.

+ 

+-  This function returns the size, in bytes, of the device path data structure specified by

+-  DevicePath including the end of device path node.  If DevicePath is NULL, then 0 is returned.

++  This function returns the size, in bytes, of the device path data structure 

++  specified by DevicePath including the end of device path node.

++  If DevicePath is NULL or invalid, then 0 is returned.

+ 

+-  @param  DevicePath                 A pointer to a device path data structure.

+-  

+-  @retval 0       DevicePath is NULL.

+-  @retval Others  The size of a device path in bytes.

++  @param  DevicePath  A pointer to a device path data structure.

++

++  @retval 0           If DevicePath is NULL or invalid.

++  @retval Others      The size of a device path in bytes.

+ 

+ **/

+ UINTN

+@@ -235,7 +261,7 @@ GetDevicePathSize (
+   

+   @param  DevicePath                 A pointer to a device path data structure.

+ 

+-  @retval NULL    DevicePath is NULL.

++  @retval NULL    DevicePath is NULL or invalid.

+   @retval Others  A pointer to the duplicated device path.

+   

+ **/

+@@ -263,6 +289,7 @@ DuplicateDevicePath (
+   @param  SecondDevicePath           A pointer to a device path data structure.

+   

+   @retval NULL      If there is not enough memory for the newly allocated buffer.

++  @retval NULL      If FirstDevicePath or SecondDevicePath is invalid.

+   @retval Others    A pointer to the new device path if success.

+                     Or a copy an end-of-device-path if both FirstDevicePath and SecondDevicePath are NULL.

+ 

+@@ -316,6 +343,7 @@ AppendDevicePathNode (
+   and a new end-of-device-path-instance node is inserted between. 

+   If DevicePath is NULL, then a copy if DevicePathInstance is returned.

+   If DevicePathInstance is NULL, then NULL is returned.

++  If DevicePath or DevicePathInstance is invalid, then NULL is returned.

+   If there is not enough memory to allocate space for the new device path, then NULL is returned.  

+   The memory is allocated from EFI boot services memory. It is the responsibility of the caller to

+   free the memory allocated.

+@@ -341,6 +369,7 @@ AppendDevicePathInstance (
+   point to the next device path instance in the device path (or NULL if no more) and updates Size

+   to hold the size of the device path instance copy.

+   If DevicePath is NULL, then NULL is returned.

++  If DevicePath points to a invalid device path, then NULL is returned.

+   If there is not enough memory to allocate space for the new device path, then NULL is returned.  

+   The memory is allocated from EFI boot services memory. It is the responsibility of the caller to

+   free the memory allocated.

+@@ -394,12 +423,13 @@ CreateDeviceNode (
+   Determines if a device path is single or multi-instance.

+ 

+   This function returns TRUE if the device path specified by DevicePath is multi-instance.

+-  Otherwise, FALSE is returned.  If DevicePath is NULL, then FALSE is returned.

++  Otherwise, FALSE is returned.

++  If DevicePath is NULL or invalid, then FALSE is returned.

+ 

+   @param  DevicePath                 A pointer to a device path data structure.

+ 

+   @retval  TRUE                      DevicePath is multi-instance.

+-  @retval  FALSE                     DevicePath is not multi-instance, or DevicePath is NULL.

++  @retval  FALSE                     DevicePath is not multi-instance, or DevicePath is NULL or invalid.

+ 

+ **/

+ BOOLEAN

+diff --git a/MdePkg/Library/UefiDevicePathLib/UefiDevicePathLib.c b/MdePkg/Library/UefiDevicePathLib/UefiDevicePathLib.c
+index db065e4..a91a7a3 100644
+--- a/MdePkg/Library/UefiDevicePathLib/UefiDevicePathLib.c
++++ b/MdePkg/Library/UefiDevicePathLib/UefiDevicePathLib.c
+@@ -8,7 +8,7 @@
+   environment varibles. Multi-instance device paths should never be placed

+   on a Handle.

+ 

+-  Copyright (c) 2006 - 2010, Intel Corporation. All rights reserved.<BR>

++  Copyright (c) 2006 - 2012, Intel Corporation. All rights reserved.<BR>

+   This program and the accompanying materials                          

+   are licensed and made available under the terms and conditions of the BSD License         

+   which accompanies this distribution.  The full text of the license may be found at        

+@@ -28,6 +28,7 @@
+ #include <Library/MemoryAllocationLib.h>

+ #include <Library/UefiBootServicesTableLib.h>

+ #include <Library/BaseLib.h>

++#include <Library/PcdLib.h>

+ 

+ //

+ // Template for an end-of-device path node.

+@@ -42,6 +43,61 @@ GLOBAL_REMOVE_IF_UNREFERENCED CONST EFI_DEVICE_PATH_PROTOCOL  mUefiDevicePathLib
+ };

+ 

+ /**

++  Determine whether a given device path is valid.

++  If DevicePath is NULL, then ASSERT().

++

++  @param  DevicePath  A pointer to a device path data structure.

++  @param  MaxSize     The maximum size of the device path data structure.

++

++  @retval TRUE        DevicePath is valid.

++  @retval FALSE       The length of any node node in the DevicePath is less

++                      than sizeof (EFI_DEVICE_PATH_PROTOCOL).

++  @retval FALSE       If MaxSize is not zero, the size of the DevicePath

++                      exceeds MaxSize.

++  @retval FALSE       If PcdMaximumDevicePathNodeCount is not zero, the node

++                      count of the DevicePath exceeds PcdMaximumDevicePathNodeCount.

++**/

++BOOLEAN

++EFIAPI

++IsDevicePathValid (

++  IN CONST EFI_DEVICE_PATH_PROTOCOL *DevicePath,

++  IN       UINTN                    MaxSize

++  )

++{

++  UINTN Count;

++  UINTN Size;

++  UINTN NodeLength;

++

++  ASSERT (DevicePath != NULL);

++

++  for (Count = 0, Size = 0; !IsDevicePathEnd (DevicePath); DevicePath = NextDevicePathNode (DevicePath)) {

++    NodeLength = DevicePathNodeLength (DevicePath);

++    if (NodeLength < sizeof (EFI_DEVICE_PATH_PROTOCOL)) {

++      return FALSE;

++    }

++

++    if (MaxSize > 0) {

++      Size += NodeLength;

++      if (Size + END_DEVICE_PATH_LENGTH > MaxSize) {

++        return FALSE;

++      }

++    }

++

++    if (PcdGet32 (PcdMaximumDevicePathNodeCount) > 0) {

++      Count++;

++      if (Count >= PcdGet32 (PcdMaximumDevicePathNodeCount)) {

++        return FALSE;

++      }

++    }

++  }

++

++  //

++  // Only return TRUE when the End Device Path node is valid.

++  //

++  return (BOOLEAN) (DevicePathNodeLength (DevicePath) == END_DEVICE_PATH_LENGTH);

++}

++

++/**

+   Returns the Type field of a device path node.

+ 

+   Returns the Type field of the device path node specified by Node.

+@@ -106,8 +162,12 @@ DevicePathNodeLength (
+   IN CONST VOID  *Node

+   )

+ {

++  UINTN Length;

++

+   ASSERT (Node != NULL);

+-  return ReadUnaligned16 ((UINT16 *)&((EFI_DEVICE_PATH_PROTOCOL *)(Node))->Length[0]);

++  Length = ReadUnaligned16 ((UINT16 *)&((EFI_DEVICE_PATH_PROTOCOL *)(Node))->Length[0]);

++  ASSERT (Length >= sizeof (EFI_DEVICE_PATH_PROTOCOL));

++  return Length;

+ }

+ 

+ /**

+@@ -227,7 +287,8 @@ IsDevicePathEndInstance (
+   be used to set the contents of the Length field.

+ 

+   If Node is NULL, then ASSERT().

+-  If NodeLength >= 0x10000, then ASSERT().

++  If NodeLength >= SIZE_64KB, then ASSERT().

++  If NodeLength < sizeof (EFI_DEVICE_PATH_PROTOCOL), then ASSERT().

+ 

+   @param  Node      A pointer to a device path node data structure.

+   @param  Length    The length, in bytes, of the device path node.

+@@ -243,7 +304,7 @@ SetDevicePathNodeLength (
+   )

+ {

+   ASSERT (Node != NULL);

+-  ASSERT (Length < 0x10000);

++  ASSERT ((Length >= sizeof (EFI_DEVICE_PATH_PROTOCOL)) && (Length < SIZE_64KB));

+   return WriteUnaligned16 ((UINT16 *)&((EFI_DEVICE_PATH_PROTOCOL *)(Node))->Length[0], (UINT16)(Length));

+ }

+ 

+@@ -277,12 +338,12 @@ SetDevicePathEndNode (
+   Returns the size of a device path in bytes.

+ 

+   This function returns the size, in bytes, of the device path data structure 

+-  specified by DevicePath including the end of device path node.  If DevicePath 

+-  is NULL, then 0 is returned.

++  specified by DevicePath including the end of device path node.

++  If DevicePath is NULL or invalid, then 0 is returned.

+ 

+   @param  DevicePath  A pointer to a device path data structure.

+-  

+-  @retval 0           If DevicePath is NULL.

++

++  @retval 0           If DevicePath is NULL or invalid.

+   @retval Others      The size of a device path in bytes.

+ 

+ **/

+@@ -298,6 +359,10 @@ GetDevicePathSize (
+     return 0;

+   }

+ 

++  if (!IsDevicePathValid (DevicePath, 0)) {

++    return 0;

++  }

++

+   //

+   // Search for the end of the device path structure

+   //

+@@ -324,7 +389,7 @@ GetDevicePathSize (
+   

+   @param  DevicePath    A pointer to a device path data structure.

+ 

+-  @retval NULL          If DevicePath is NULL.

++  @retval NULL          DevicePath is NULL or invalid.

+   @retval Others        A pointer to the duplicated device path.

+   

+ **/

+@@ -370,6 +435,7 @@ DuplicateDevicePath (
+   @param  SecondDevicePath           A pointer to a device path data structure.

+   

+   @retval NULL      If there is not enough memory for the newly allocated buffer.

++  @retval NULL      If FirstDevicePath or SecondDevicePath is invalid.

+   @retval Others    A pointer to the new device path if success.

+                     Or a copy an end-of-device-path if both FirstDevicePath and SecondDevicePath are NULL.

+ 

+@@ -398,6 +464,10 @@ AppendDevicePath (
+     return DuplicateDevicePath (FirstDevicePath);

+   }

+ 

++  if (!IsDevicePathValid (FirstDevicePath, 0) || !IsDevicePathValid (SecondDevicePath, 0)) {

++    return NULL;

++  }

++

+   //

+   // Allocate space for the combined device path. It only has one end node of

+   // length EFI_DEVICE_PATH_PROTOCOL.

+@@ -500,6 +570,7 @@ AppendDevicePathNode (
+   path instance and a new end-of-device-path-instance node is inserted between. 

+   If DevicePath is NULL, then a copy if DevicePathInstance is returned.

+   If DevicePathInstance is NULL, then NULL is returned.

++  If DevicePath or DevicePathInstance is invalid, then NULL is returned.

+   If there is not enough memory to allocate space for the new device path, then 

+   NULL is returned.  

+   The memory is allocated from EFI boot services memory. It is the responsibility 

+@@ -531,6 +602,10 @@ AppendDevicePathInstance (
+     return NULL;

+   }

+ 

++  if (!IsDevicePathValid (DevicePath, 0) || !IsDevicePathValid (DevicePathInstance, 0)) {

++    return NULL;

++  }

++

+   SrcSize       = GetDevicePathSize (DevicePath);

+   InstanceSize  = GetDevicePathSize (DevicePathInstance);

+ 

+@@ -559,6 +634,7 @@ AppendDevicePathInstance (
+   DevicePath to point to the next device path instance in the device path (or NULL 

+   if no more) and updates Size to hold the size of the device path instance copy.

+   If DevicePath is NULL, then NULL is returned.

++  If DevicePath points to a invalid device path, then NULL is returned.

+   If there is not enough memory to allocate space for the new device path, then 

+   NULL is returned.  

+   The memory is allocated from EFI boot services memory. It is the responsibility 

+@@ -596,6 +672,10 @@ GetNextDevicePathInstance (
+     return NULL;

+   }

+ 

++  if (!IsDevicePathValid (*DevicePath, 0)) {

++    return NULL;

++  }

++

+   //

+   // Find the end of the device path instance

+   //

+@@ -681,13 +761,14 @@ CreateDeviceNode (
+ 

+   This function returns TRUE if the device path specified by DevicePath is

+   multi-instance.

+-  Otherwise, FALSE is returned.  If DevicePath is NULL, then FALSE is returned.

++  Otherwise, FALSE is returned.

++  If DevicePath is NULL or invalid, then FALSE is returned.

+ 

+   @param  DevicePath                 A pointer to a device path data structure.

+ 

+   @retval  TRUE                      DevicePath is multi-instance.

+-  @retval  FALSE                     DevicePath is not multi-instance or DevicePath 

+-                                     is NULL.

++  @retval  FALSE                     DevicePath is not multi-instance, or DevicePath 

++                                     is NULL or invalid.

+ 

+ **/

+ BOOLEAN

+@@ -702,6 +783,10 @@ IsDevicePathMultiInstance (
+     return FALSE;

+   }

+ 

++  if (!IsDevicePathValid (DevicePath, 0)) {

++    return FALSE;

++  }

++

+   Node = DevicePath;

+   while (!IsDevicePathEnd (Node)) {

+     if (IsDevicePathEndInstance (Node)) {

+@@ -776,15 +861,14 @@ FileDevicePath (
+   IN CONST CHAR16                    *FileName

+   )

+ {

+-  UINT16                    Size;

++  UINTN                     Size;

+   FILEPATH_DEVICE_PATH      *FilePath;

+   EFI_DEVICE_PATH_PROTOCOL  *DevicePath;

+   EFI_DEVICE_PATH_PROTOCOL  *FileDevicePath;

+ 

+   DevicePath = NULL;

+ 

+-  Size = (UINT16) StrSize (FileName);

+-  

++  Size = StrSize (FileName);

+   FileDevicePath = AllocatePool (Size + SIZE_OF_FILEPATH_DEVICE_PATH + END_DEVICE_PATH_LENGTH);

+   if (FileDevicePath != NULL) {

+     FilePath = (FILEPATH_DEVICE_PATH *) FileDevicePath;

+diff --git a/MdePkg/Library/UefiDevicePathLib/UefiDevicePathLib.inf b/MdePkg/Library/UefiDevicePathLib/UefiDevicePathLib.inf
+index c34301d..2ae151d 100644
+--- a/MdePkg/Library/UefiDevicePathLib/UefiDevicePathLib.inf
++++ b/MdePkg/Library/UefiDevicePathLib/UefiDevicePathLib.inf
+@@ -3,7 +3,7 @@
+ #

+ # Device Path Library that layers on top of the Memory Allocation Library.

+ #

+-# Copyright (c) 2007 - 2010, Intel Corporation. All rights reserved.<BR>

++# Copyright (c) 2007 - 2012, Intel Corporation. All rights reserved.<BR>

+ #

+ #  This program and the accompanying materials

+ #  are licensed and made available under the terms and conditions of the BSD License

+@@ -42,8 +42,10 @@
+   MemoryAllocationLib

+   DebugLib

+   BaseMemoryLib

+-

++  PcdLib

+ 

+ [Protocols]

+   gEfiDevicePathProtocolGuid                    ## CONSUMES

+ 

++[Pcd]

++  gEfiMdePkgTokenSpaceGuid.PcdMaximumDevicePathNodeCount

+diff --git a/MdePkg/Library/UefiDevicePathLibDevicePathProtocol/UefiDevicePathLib.c b/MdePkg/Library/UefiDevicePathLibDevicePathProtocol/UefiDevicePathLib.c
+index 8275dd6..1052988 100644
+--- a/MdePkg/Library/UefiDevicePathLibDevicePathProtocol/UefiDevicePathLib.c
++++ b/MdePkg/Library/UefiDevicePathLibDevicePathProtocol/UefiDevicePathLib.c
+@@ -2,7 +2,7 @@
+   Library instance that implement UEFI Device Path Library class based on protocol

+   gEfiDevicePathUtilitiesProtocolGuid.

+ 

+-  Copyright (c) 2006 - 2010, Intel Corporation. All rights reserved.<BR>

++  Copyright (c) 2006 - 2012, Intel Corporation. All rights reserved.<BR>

+   This program and the accompanying materials

+   are licensed and made available under the terms and conditions of the BSD License

+   which accompanies this distribution.  The full text of the license may be found at

+@@ -24,6 +24,7 @@
+ #include <Library/MemoryAllocationLib.h>

+ #include <Library/BaseMemoryLib.h>

+ #include <Library/UefiBootServicesTableLib.h>

++#include <Library/PcdLib.h>

+ 

+ EFI_DEVICE_PATH_UTILITIES_PROTOCOL          *mDevicePathUtilities = NULL;

+ 

+@@ -72,6 +73,61 @@ DevicePathLibConstructor (
+ }

+ 

+ /**

++  Determine whether a given device path is valid.

++  If DevicePath is NULL, then ASSERT().

++

++  @param  DevicePath  A pointer to a device path data structure.

++  @param  MaxSize     The maximum size of the device path data structure.

++

++  @retval TRUE        DevicePath is valid.

++  @retval FALSE       The length of any node node in the DevicePath is less

++                      than sizeof (EFI_DEVICE_PATH_PROTOCOL).

++  @retval FALSE       If MaxSize is not zero, the size of the DevicePath

++                      exceeds MaxSize.

++  @retval FALSE       If PcdMaximumDevicePathNodeCount is not zero, the node

++                      count of the DevicePath exceeds PcdMaximumDevicePathNodeCount.

++**/

++BOOLEAN

++EFIAPI

++IsDevicePathValid (

++  IN CONST EFI_DEVICE_PATH_PROTOCOL *DevicePath,

++  IN       UINTN                    MaxSize

++  )

++{

++  UINTN Count;

++  UINTN Size;

++  UINTN NodeLength;

++

++  ASSERT (DevicePath != NULL);

++

++  for (Count = 0, Size = 0; !IsDevicePathEnd (DevicePath); DevicePath = NextDevicePathNode (DevicePath)) {

++    NodeLength = DevicePathNodeLength (DevicePath);

++    if (NodeLength < sizeof (EFI_DEVICE_PATH_PROTOCOL)) {

++      return FALSE;

++    }

++

++    if (MaxSize > 0) {

++      Size += NodeLength;

++      if (Size + END_DEVICE_PATH_LENGTH > MaxSize) {

++        return FALSE;

++      }

++    }

++

++    if (PcdGet32 (PcdMaximumDevicePathNodeCount) > 0) {

++      Count++;

++      if (Count >= PcdGet32 (PcdMaximumDevicePathNodeCount)) {

++        return FALSE;

++      }

++    }

++  }

++

++  //

++  // Only return TRUE when the End Device Path node is valid.

++  //

++  return (BOOLEAN) (DevicePathNodeLength (DevicePath) == END_DEVICE_PATH_LENGTH);

++}

++

++/**

+   Returns the Type field of a device path node.

+ 

+   Returns the Type field of the device path node specified by Node.

+@@ -136,8 +192,12 @@ DevicePathNodeLength (
+   IN CONST VOID  *Node

+   )

+ {

++  UINTN Length;

++

+   ASSERT (Node != NULL);

+-  return ReadUnaligned16 ((UINT16 *)&((EFI_DEVICE_PATH_PROTOCOL *)(Node))->Length[0]);

++  Length = ReadUnaligned16 ((UINT16 *)&((EFI_DEVICE_PATH_PROTOCOL *)(Node))->Length[0]);

++  ASSERT (Length >= sizeof (EFI_DEVICE_PATH_PROTOCOL));

++  return Length;

+ }

+ 

+ /**

+@@ -256,7 +316,8 @@ IsDevicePathEndInstance (
+   be used to set the contents of the Length field.

+ 

+   If Node is NULL, then ASSERT().

+-  If NodeLength >= 0x10000, then ASSERT().

++  If NodeLength >= SIZE_64KB, then ASSERT().

++  If NodeLength < sizeof (EFI_DEVICE_PATH_PROTOCOL), then ASSERT().

+ 

+   @param  Node      A pointer to a device path node data structure.

+   @param  Length    The length, in bytes, of the device path node.

+@@ -272,7 +333,7 @@ SetDevicePathNodeLength (
+   )

+ {

+   ASSERT (Node != NULL);

+-  ASSERT (Length < 0x10000);

++  ASSERT ((Length >= sizeof (EFI_DEVICE_PATH_PROTOCOL)) && (Length < SIZE_64KB));

+   return WriteUnaligned16 ((UINT16 *)&((EFI_DEVICE_PATH_PROTOCOL *)(Node))->Length[0], (UINT16)(Length));

+ }

+ 

+@@ -305,13 +366,14 @@ SetDevicePathEndNode (
+ /**

+   Returns the size of a device path in bytes.

+ 

+-  This function returns the size, in bytes, of the device path data structure specified by

+-  DevicePath including the end of device path node.  If DevicePath is NULL, then 0 is returned.

++  This function returns the size, in bytes, of the device path data structure 

++  specified by DevicePath including the end of device path node.

++  If DevicePath is NULL or invalid, then 0 is returned.

+ 

+-  @param  DevicePath                 A pointer to a device path data structure.

+-  

+-  @retval 0       If DevicePath is NULL.

+-  @retval Others  The size of a device path in bytes.

++  @param  DevicePath  A pointer to a device path data structure.

++

++  @retval 0           If DevicePath is NULL or invalid.

++  @retval Others      The size of a device path in bytes.

+ 

+ **/

+ UINTN

+@@ -336,7 +398,7 @@ GetDevicePathSize (
+   

+   @param  DevicePath                 A pointer to a device path data structure.

+ 

+-  @retval NULL    If DevicePath is NULL.

++  @retval NULL    If DevicePath is NULL or invalid.

+   @retval Others  A pointer to the duplicated device path.

+   

+ **/

+@@ -367,6 +429,7 @@ DuplicateDevicePath (
+   @param  SecondDevicePath           A pointer to a device path data structure.

+   

+   @retval NULL      If there is not enough memory for the newly allocated buffer.

++  @retval NULL      If FirstDevicePath or SecondDevicePath is invalid.

+   @retval Others    A pointer to the new device path if success.

+                     Or a copy an end-of-device-path if both FirstDevicePath and 

+                     SecondDevicePath are NULL.

+@@ -431,6 +494,7 @@ AppendDevicePathNode (
+   path instance and a new end-of-device-path-instance node is inserted between. 

+   If DevicePath is NULL, then a copy if DevicePathInstance is returned.

+   If DevicePathInstance is NULL, then NULL is returned.

++  If DevicePath or DevicePathInstance is invalid, then NULL is returned.

+   If there is not enough memory to allocate space for the new device path, then 

+   NULL is returned.   

+   The memory is allocated from EFI boot services memory. It is the responsibility 

+@@ -524,15 +588,16 @@ CreateDeviceNode (
+ /**

+   Determines if a device path is single or multi-instance.

+ 

+-  This function returns TRUE if the device path specified by DevicePath is 

++  This function returns TRUE if the device path specified by DevicePath is

+   multi-instance.

+-  Otherwise, FALSE is returned.  If DevicePath is NULL, then FALSE is returned.

++  Otherwise, FALSE is returned.

++  If DevicePath is NULL or invalid, then FALSE is returned.

+ 

+   @param  DevicePath                 A pointer to a device path data structure.

+ 

+   @retval  TRUE                      DevicePath is multi-instance.

+-  @retval  FALSE                     DevicePath is not multi-instance or DevicePath 

+-                                     is NULL.

++  @retval  FALSE                     DevicePath is not multi-instance, or DevicePath 

++                                     is NULL or invalid.

+ 

+ **/

+ BOOLEAN

+diff --git a/MdePkg/Library/UefiDevicePathLibDevicePathProtocol/UefiDevicePathLibDevicePathProtocol.inf b/MdePkg/Library/UefiDevicePathLibDevicePathProtocol/UefiDevicePathLibDevicePathProtocol.inf
+index 3393830..16b47e3 100644
+--- a/MdePkg/Library/UefiDevicePathLibDevicePathProtocol/UefiDevicePathLibDevicePathProtocol.inf
++++ b/MdePkg/Library/UefiDevicePathLibDevicePathProtocol/UefiDevicePathLibDevicePathProtocol.inf
+@@ -4,7 +4,7 @@
+ #  Device Path Library that layers on top of the UEFI 2.0 Device Path Protocol.

+ #  This library is not available for EFI 1.10 modules.

+ #

+-#  Copyright (c) 2007 - 2011, Intel Corporation. All rights reserved.<BR>

++#  Copyright (c) 2007 - 2012, Intel Corporation. All rights reserved.<BR>

+ #

+ #  This program and the accompanying materials

+ #  are licensed and made available under the terms and conditions of the BSD License

+@@ -44,11 +44,14 @@
+   MemoryAllocationLib

+   BaseLib

+   DebugLib

+-

++  PcdLib

+ 

+ [Protocols]

+   gEfiDevicePathProtocolGuid                    ## CONSUMES

+   gEfiDevicePathUtilitiesProtocolGuid           ## CONSUMES

+ 

++[Pcd]

++  gEfiMdePkgTokenSpaceGuid.PcdMaximumDevicePathNodeCount

++

+ [Depex.common.DXE_DRIVER, Depex.common.DXE_RUNTIME_DRIVER, Depex.common.DXE_SAL_DRIVER, Depex.common.DXE_SMM_DRIVER]

+   gEfiDevicePathUtilitiesProtocolGuid

+diff --git a/MdePkg/MdePkg.dec b/MdePkg/MdePkg.dec
+index b29cb01..aefba3f 100644
+--- a/MdePkg/MdePkg.dec
++++ b/MdePkg/MdePkg.dec
+@@ -1287,6 +1287,9 @@
+   ## Indicates the maximum node number of linked list

+   gEfiMdePkgTokenSpaceGuid.PcdMaximumLinkedListLength|1000000|UINT32|0x00000003

+ 

++  ## Indicates the maximum node number of device path

++  gEfiMdePkgTokenSpaceGuid.PcdMaximumDevicePathNodeCount|0|UINT32|0x00000029

++

+   ## Indicates the timeout tick of holding spin lock

+   gEfiMdePkgTokenSpaceGuid.PcdSpinLockTimeout|10000000|UINT32|0x00000004

+ 

diff --git a/extra/refind-efi/refind-efi.install b/extra/refind-efi/refind-efi.install
new file mode 100644
index 000000000..e43f6cb61
--- /dev/null
+++ b/extra/refind-efi/refind-efi.install
@@ -0,0 +1,31 @@
+post_install() {
+	
+	cat << EOF 
+
+rEFInd UEFI applications have been installed at /usr/lib/refind/refind_*.efi
+
+Other UEFI applications have been installed at /usr/lib/refind/tools_*/
+
+UEFI drivers have deen installed at /usr/lib/refind/drivers_*/
+
+Copy the efi application (according to your UEFI ARCH) 
+and /usr/lib/refind/config/refind.conf to a sub-directory of <EFISYS>/EFI/
+and add an entry to firmware boot menu using efibootmgr or mactel-boot (for Macs)
+
+rEFInd Icons have been installed at /usr/share/refind/icons/
+rEFInd Fonts have been installed at /usr/share/refind/fonts/
+
+HTML Documentation is available at /usr/share/refind/docs/html/
+
+More info: https://wiki.archlinux.org/index.php/UEFI_Bootloaders#Using_rEFInd
+
+EOF
+	
+}
+
+post_upgrade() {
+	
+	post_install
+	
+}
+
diff --git a/extra/refind-efi/refind_include_more_shell_paths.patch b/extra/refind-efi/refind_include_more_shell_paths.patch
new file mode 100644
index 000000000..078322e1a
--- /dev/null
+++ b/extra/refind-efi/refind_include_more_shell_paths.patch
@@ -0,0 +1,13 @@
+diff --git a/refind/main.c b/refind/main.c
+index beac3bf..1a2cf58 100644
+--- a/refind/main.c
++++ b/refind/main.c
+@@ -62,5 +62,5 @@
+ #define SHELL_NAMES             L"\\EFI\\tools\\shell.efi,\\EFI\\tools\\shellia32.efi,\\shellia32.efi"
+ #define DRIVER_DIRS             L"drivers,drivers_ia32"
+ #else
+-#define SHELL_NAMES             L"\\EFI\\tools\\shell.efi"
++#define SHELL_NAMES             L"\\EFI\\tools\\shell.efi,\\shell.efi"
+ #define DRIVER_DIRS             L"drivers"
+ #endif
+ 
diff --git a/extra/refind-efi/refind_linux.conf b/extra/refind-efi/refind_linux.conf
new file mode 100644
index 000000000..a34536b37
--- /dev/null
+++ b/extra/refind-efi/refind_linux.conf
@@ -0,0 +1,5 @@
+## This file should be present in the same directory as the EFISTUB kernel and initramfs files
+## More info at http://www.rodsbooks.com/refind/linux.html , http://www.rodsbooks.com/efi-bootloaders/efistub.html
+
+"Boot with defaults"    "root=PARTUUID=XXXXXXXX rootfstype=XXXX ro"
+"Boot to terminal"      "root=PARTUUID=XXXXXXXX rootfstype=XXXX ro systemd.unit=multi-user.target"
diff --git a/extra/vc/PKGBUILD b/extra/vc/PKGBUILD
index 19e6366d9..77a4e49f9 100644
--- a/extra/vc/PKGBUILD
+++ b/extra/vc/PKGBUILD
@@ -1,17 +1,17 @@
-# $Id: PKGBUILD 183664 2013-04-26 12:12:30Z andrea $
+# $Id: PKGBUILD 188826 2013-06-22 07:21:35Z andrea $
 # Maintainer: Andrea Scarpino <andrea@archlinux.org>
 # Contributor: PedsXing <pedsxing at gmx dot net>
 
 pkgname=vc
-pkgver=0.7.1
+pkgver=0.7.2
 pkgrel=1
 pkgdesc="A library to ease explicit vectorization of C++ code"
 url='http://code.compeng.uni-frankfurt.de/projects/vc/'
 arch=('x86_64' 'i686')
 license=('LGPL3')
 makedepends=('cmake')
-source=("http://code.compeng.uni-frankfurt.de/attachments/download/161/Vc-${pkgver}.tar.gz")
-md5sums=('a7bc94838e55b5e0cdf5a02e1b52f8dc')
+source=("http://code.compeng.uni-frankfurt.de/attachments/download/164/Vc-${pkgver}.tar.gz")
+md5sums=('f54dd2945f9e5a38945e50b4a3f7a901')
  
 build() {
   mkdir build 
@@ -22,13 +22,12 @@ build() {
   make
 }
 
-# check() {
-#  cd build
-#  make test
-#}
+check() {
+  cd build
+  make test
+}
 
 package() {
   cd build
   make DESTDIR="${pkgdir}" install
 }
-
diff --git a/extra/x2goserver/PKGBUILD b/extra/x2goserver/PKGBUILD
index 9cc8a9e2e..34c426773 100644
--- a/extra/x2goserver/PKGBUILD
+++ b/extra/x2goserver/PKGBUILD
@@ -1,4 +1,4 @@
-# $Id: PKGBUILD 188542 2013-06-15 10:17:06Z andyrtr $
+# $Id: PKGBUILD 188846 2013-06-22 19:39:32Z andyrtr $
 # Maintainer: AndyRTR <andyrtr@archlinux.org>
 
 # Contributor: Gerhard Brauer <gerbra@archlinux.de>
@@ -7,7 +7,7 @@
 # Contributor: Milan Knížek <knizek@volny.cz>
 
 pkgname=x2goserver
-pkgver=4.0.1.1
+pkgver=4.0.1.3
 pkgrel=1
 pkgdesc="Open source terminal server"
 arch=('i686' 'x86_64' 'mips64el')
@@ -21,7 +21,7 @@ install=x2goserver.install
 backup=('etc/x2go/x2goserver.conf' 'etc/x2go/x2gosql/sql')
 source=(http://code.x2go.org/releases/source/${pkgname}/${pkgname}-${pkgver}.tar.gz
         x2goserver.service)
-md5sums=('d970699f1df8d7096a7d3151c0ede447'
+md5sums=('494b2d0435f7a11bc68a5d1d2a8a5f33'
          'f76081c01e40b6206895d194dc949707')
 
 build() {