From 8d6b1838330625b758ebc55bb0df1b425c5cefaf Mon Sep 17 00:00:00 2001
From: Robert Morell <rmorell@nvidia.com>
Date: Thu, 21 Jan 2010 12:38:47 -0800
Subject: [PATCH] Render: Fix request size verification

RenderSetPictureClipRectangles and the Xinerama version of
RenderChangePicture were using the wrong structure types for request
size verification.

Signed-off-by: Robert Morell <rmorell@nvidia.com>
Reviewed-by: Aaron Plattner <aplattner@nvidia.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
---
 render/render.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/render/render.c b/render/render.c
index 77e5e0396..575bd9f9c 100644
--- a/render/render.c
+++ b/render/render.c
@@ -656,7 +656,7 @@ ProcRenderSetPictureClipRectangles (ClientPtr client)
     if (!pPicture->pDrawable)
         return BadDrawable;
 
-    nr = (client->req_len << 2) - sizeof(xRenderChangePictureReq);
+    nr = (client->req_len << 2) - sizeof(xRenderSetPictureClipRectanglesReq);
     if (nr & 4)
 	return BadLength;
     nr >>= 3;
@@ -2728,7 +2728,7 @@ PanoramiXRenderChangePicture (ClientPtr client)
     int		    result = Success, j;
     REQUEST(xRenderChangePictureReq);
 
-    REQUEST_AT_LEAST_SIZE(xChangeWindowAttributesReq);
+    REQUEST_AT_LEAST_SIZE(xRenderChangePictureReq);
     
     VERIFY_XIN_PICTURE(pict, stuff->picture, client, DixWriteAccess,
 		       RenderErrBase + BadPicture);