From 482cc72aa790bd2f23c7ebe12c5549b47c737115 Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter.hutterer@who-t.net>
Date: Tue, 9 Jun 2009 13:03:38 +1000
Subject: [PATCH] Xi: get the class length before swapping.

Advancing by the already-swapped length lets our pointers point into
nirvana.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
---
 Xi/querydev.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/Xi/querydev.c b/Xi/querydev.c
index 1f7fed187..22a553723 100644
--- a/Xi/querydev.c
+++ b/Xi/querydev.c
@@ -425,6 +425,7 @@ SwapDeviceInfo(DeviceIntPtr dev, xXIDeviceInfo* info)
 
     for (i = 0; i < info->num_classes; i++)
     {
+        int len = ((xXIAnyInfo*)any)->length;
         switch(((xXIAnyInfo*)any)->type)
         {
             case ButtonClass:
@@ -438,7 +439,7 @@ SwapDeviceInfo(DeviceIntPtr dev, xXIDeviceInfo* info)
                 break;
         }
 
-        any += (((xXIAnyInfo*)any)->length * 4);
+        any += len * 4;
     }
 
     swaps(&info->deviceid, n);