From 50a5c32430a5267f2a05656d2417f9a8a44d8b97 Mon Sep 17 00:00:00 2001
From: Jon TURNEY <jon.turney@dronecode.org.uk>
Date: Fri, 23 Oct 2009 19:32:42 +0100
Subject: [PATCH] dmx: Correctly compute DMXGetScreenAttributes reply length

Correctly allow for excess length of DMXGetScreenAttributes reply
over standard 32 byte reply in addition to the displayName string
when computing the length of reply

http://bugs.freedesktop.org/show_bug.cgi?id=24685

Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by:  Julien Cristau <jcristau@debian.org>
Signed-off-by: Keith Packard <keithp@keithp.com>
---
 hw/dmx/dmx.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/dmx/dmx.c b/hw/dmx/dmx.c
index b8fbf02f1..a1afe76cf 100644
--- a/hw/dmx/dmx.c
+++ b/hw/dmx/dmx.c
@@ -362,7 +362,8 @@ static int ProcDMXGetScreenAttributes(ClientPtr client)
     paddedLength            = pad_to_int32(length);
     rep.type                = X_Reply;
     rep.sequenceNumber      = client->sequence;
-    rep.length              = bytes_to_int32(paddedLength);
+    rep.length              = bytes_to_int32((sizeof(xDMXGetScreenAttributesReply) - sizeof(xGenericReply))
+                                             + paddedLength);
     rep.displayNameLength   = length;
 
     if (client->swapped) {