dix: Fix a double free in dixFreePrivates.

It can be reproduced when the server is regenerated and for some
reason the private keys are reassigned in a different order: a
manually allocated private may get an index formerly used by a
preallocated private. In that case it will first be manually freed and
then again by dixFreePrivates, as items[i].size was never zeroed
out. Do it in dixResetPrivates.

Signed-off-by: Francisco Jerez <currojerez@riseup.net>
Acked-by: Eamon Walsh <ewalsh@tycho.nsa.gov>
Signed-off-by: Keith Packard <keithp@keithp.com>

dix/privates.c

@@ -303,6 +303,7 @@ dixResetPrivates(void)
     /* reset private descriptors */
     for (i = 1; i < nextPriv; i++) {
 	*items[i].key = 0;
+	items[i].size = 0;
 	DeleteCallbackList(&items[i].initfuncs);
 	DeleteCallbackList(&items[i].deletefuncs);
     }