diff --git a/Xext/xvdisp.c b/Xext/xvdisp.c
index 4b34f17d5..483a97b95 100644
--- a/Xext/xvdisp.c
+++ b/Xext/xvdisp.c
@@ -619,28 +619,29 @@ ProcXvQueryPortAttributes(ClientPtr client)
     int size, i;
     XvPortPtr pPort;
     XvAttributePtr pAtt;
-    xvAttributeInfo Info;
 
     REQUEST(xvQueryPortAttributesReq);
     REQUEST_SIZE_MATCH(xvQueryPortAttributesReq);
 
     VALIDATE_XV_PORT(stuff->port, pPort, DixGetAttrAccess);
 
+    int text_size = 0;
+    for (i = 0, pAtt = pPort->pAdaptor->pAttributes;
+         i < pPort->pAdaptor->nAttributes; i++, pAtt++) {
+        text_size += pad_to_int32(strlen(pAtt->name) + 1);
+    }
+
+    int length = (pPort->pAdaptor->nAttributes * sz_xvAttributeInfo)
+               + text_size;
+
     xvQueryPortAttributesReply rep = {
         .type = X_Reply,
         .sequenceNumber = client->sequence,
         .num_attributes = pPort->pAdaptor->nAttributes,
+        .length = bytes_to_int32(length),
+        .text_size = text_size,
     };
 
-    for (i = 0, pAtt = pPort->pAdaptor->pAttributes;
-         i < pPort->pAdaptor->nAttributes; i++, pAtt++) {
-        rep.text_size += pad_to_int32(strlen(pAtt->name) + 1);
-    }
-
-    rep.length = (pPort->pAdaptor->nAttributes * sz_xvAttributeInfo)
-        + rep.text_size;
-    rep.length >>= 2;
-
     if (client->swapped) {
         swaps(&rep.sequenceNumber);
         swapl(&rep.length);
@@ -650,25 +651,34 @@ ProcXvQueryPortAttributes(ClientPtr client)
 
     WriteToClient(client, sizeof(rep), &rep);
 
+    char buf[length];
+    char * walk = buf;
+    memset(buf, 0, sizeof(buf));
+
     for (i = 0, pAtt = pPort->pAdaptor->pAttributes;
          i < pPort->pAdaptor->nAttributes; i++, pAtt++) {
         size = strlen(pAtt->name) + 1;  /* pass the NULL */
-        Info.flags = pAtt->flags;
-        Info.min = pAtt->min_value;
-        Info.max = pAtt->max_value;
-        Info.size = pad_to_int32(size);
+
+        xvAttributeInfo *Info = (xvAttributeInfo*)walk;
+        Info->flags = pAtt->flags;
+        Info->min = pAtt->min_value;
+        Info->max = pAtt->max_value;
+        Info->size = pad_to_int32(size);
 
         if (client->swapped) {
-            swapl(&Info.flags);
-            swapl(&Info.size);
-            swapl(&Info.min);
-            swapl(&Info.max);
+            swapl(&Info->flags);
+            swapl(&Info->size);
+            swapl(&Info->min);
+            swapl(&Info->max);
         }
 
-        WriteToClient(client, sizeof(Info), &Info);
-        WriteToClient(client, size, pAtt->name);
+        walk += sizeof(xvAttributeInfo);
+
+        memcpy(walk, pAtt->name, size);
+        walk += pad_to_int32(size);
     }
 
+    WriteToClient(client, sizeof(buf), buf);
     return Success;
 }