From dab12997453994d717982bf53b7817ffcd5560ea Mon Sep 17 00:00:00 2001
From: "Enrico Weigelt, metux IT consult" <info@metux.net>
Date: Tue, 6 Aug 2024 15:59:11 +0200
Subject: [PATCH] Xext: shape: fix length checking with bigreq

The authorative source of the request frame size is client->req_len,
especially with big requests larger than 2^18 bytes.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1639>
---
 Xext/shape.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Xext/shape.c b/Xext/shape.c
index e0410129f..e89dd9ffd 100644
--- a/Xext/shape.c
+++ b/Xext/shape.c
@@ -258,7 +258,7 @@ ShapeRectangles(ClientPtr client, xShapeRectanglesReq *stuff)
         client->errorValue = stuff->ordering;
         return BadValue;
     }
-    nrects = ((stuff->length << 2) - sizeof(xShapeRectanglesReq));
+    nrects = ((client->req_len << 2) - sizeof(xShapeRectanglesReq));
     if (nrects & 4)
         return BadLength;
     nrects >>= 3;