>>	try a diff between these two code.  they are identical!
>Are they used the same way?  Is the code path leading to them the same?

	yes.

>Is there a reason that both XFree.org and our X11 maintainer seem to
>have concluded that the XF86 3 code is not vulnerable?  Wouldn't it seem
>to warrant checking with said maintainer before changing code this close
>to a release?

	i'm not too sure if XFree86 team cares about 3.3.x any longer.
	so it is uncertain if "no announcement about XF86 3.3.x" means "3.3.x
	is safe" or "3.3.x is no longer maintained".

	i sent a question to them, so we will find out.

itojun