diff --git a/Xext/shape.c b/Xext/shape.c
index cba0586c5..b7631eb43 100644
--- a/Xext/shape.c
+++ b/Xext/shape.c
@@ -260,7 +260,7 @@ ShapeRectangles(ClientPtr client, xShapeRectanglesReq *stuff)
         client->errorValue = stuff->ordering;
         return BadValue;
     }
-    nrects = ((stuff->length << 2) - sizeof(xShapeRectanglesReq));
+    nrects = ((client->req_len << 2) - sizeof(xShapeRectanglesReq));
     if (nrects & 4)
         return BadLength;
     nrects >>= 3;