From dc76cfc769ce28835a5571ef376e45fadb88af13 Mon Sep 17 00:00:00 2001
From: "Enrico Weigelt, metux IT consult" <info@metux.net>
Date: Thu, 27 Feb 2025 10:53:26 +0100
Subject: [PATCH] ProcRRGetCrtcTransform() split part 1

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
---
 randr/rrcrtc.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/randr/rrcrtc.c b/randr/rrcrtc.c
index 504dc3201..489d60af9 100644
--- a/randr/rrcrtc.c
+++ b/randr/rrcrtc.c
@@ -1826,11 +1826,16 @@ ProcRRGetCrtcTransform(ClientPtr client)
     nextra = (transform_filter_length(pending) +
               transform_filter_length(current));
 
-    reply = calloc(1, sizeof(xRRGetCrtcTransformReply) + nextra);
+    reply = calloc(1, sizeof(xRRGetCrtcTransformReply));
     if (!reply)
         return BadAlloc;
 
-    extra = (char *) (reply + 1);
+    extra = calloc(1, nextra);
+    if (!extra) {
+        free(reply);
+        return BadAlloc;
+    }
+
     reply->type = X_Reply;
     reply->sequenceNumber = client->sequence;
     reply->length = bytes_to_int32(CrtcTransformExtra + nextra);
@@ -1851,8 +1856,10 @@ ProcRRGetCrtcTransform(ClientPtr client)
         swaps(&reply->sequenceNumber);
         swapl(&reply->length);
     }
-    WriteToClient(client, sizeof(xRRGetCrtcTransformReply) + nextra, reply);
+    WriteToClient(client, sizeof(xRRGetCrtcTransformReply), reply);
+    WriteToClient(client, nextra, extra);
     free(reply);
+    free(extra);
     return Success;
 }