--- xc/programs/Xserver/hw/xfree86/xaa/xaaTEText.c.orig	2005-03-04 10:04:01.238775184 -0500

+++ xc/programs/Xserver/hw/xfree86/xaa/xaaTEText.c	2005-03-04 10:04:04.414292432 -0500

@@ -249,6 +249,7 @@

 	RightEdge = min(Right, pbox->x2);

 	if(RightEdge > LeftEdge) {	/* we have something to draw */

+	    unsigned int *fallbackBits = NULL;

 	    ytop = max(Top, pbox->y1);

 	    ybot = min(Bottom, pbox->y2);

@@ -261,9 +262,22 @@

 		int count;

 		glyphs = (unsigned int**)(infoRec->PreAllocMem);

-		for(count = 0; count < nglyph; count++) 

+		for(count = 0; count < nglyph; count++) {

  			glyphs[count] = (unsigned int*) 

 				FONTGLYPHBITS(gBase,*ppci++);

+			if (!glyphs[count]) {

+			    /* Glyphs with NULL bits do exist in the wild.

+			       Replace with blank bits in that case */

+			    

+			    if (!fallbackBits) {

+				int fontHeight = Bottom - Top + 1;

+				fallbackBits = xcalloc (glyphWidth * fontHeight, 1);

+				if (!fallbackBits)

+				    return;

+			    }

+			    glyphs[count] = fallbackBits;

+			}

+		}

 		/* our new unrolled TE code only writes DWORDS at a time 

 		   so it can read up to 6 characters past the last one 

@@ -276,12 +290,15 @@

 		glyphs[count + 5] = glyphs[0];

 	    }

-   /* x, y, w, h, skipleft, skiptop, glyphp, glyphWidth, fg, bg, rop, pm */

+    /* x, y, w, h, skipleft, skiptop, glyphp, glyphWidth, fg, bg, rop, pm */

 	    (*infoRec->TEGlyphRenderer)( pScrn, 

 		LeftEdge, ytop, RightEdge - LeftEdge, ybot - ytop, 

 		skippix, ytop - Top, glyphs + skipglyphs, glyphWidth, 

-		fg, bg, rop, planemask); 

+		fg, bg, rop, planemask);

+

+	    if (fallbackBits)

+		xfree (fallbackBits);

 	}

 	nbox--; pbox++;