On Tue, Mar 8, 2011 at 14:44:02 +1000, Peter Hutterer wrote: > If modifiers failed, the reply length was 4 bytes too short. > > Signed-off-by: Peter Hutterer <peter.hutte...@who-t.net> > --- > Xi/xipassivegrab.c | 4 ++-- > 1 files changed, 2 insertions(+), 2 deletions(-) > > diff --git a/Xi/xipassivegrab.c b/Xi/xipassivegrab.c > index 8663d12..3319ef9 100644 > --- a/Xi/xipassivegrab.c > +++ b/Xi/xipassivegrab.c > @@ -191,7 +191,7 @@ ProcXIPassiveGrabDevice(ClientPtr client) > info->status = status; > info->modifiers = *modifiers; > rep.num_modifiers++; > - rep.length++; > + rep.length += bytes_to_int32(sizeof(xXIGrabModifierInfo)); > } > } > > @@ -199,7 +199,7 @@ ProcXIPassiveGrabDevice(ClientPtr client) > if (rep.num_modifiers) > { > client->pSwapReplyFunc = (ReplySwapPtr) Swap32Write; > - WriteSwappedDataToClient(client, rep.num_modifiers * 4, > (char*)modifiers_failed); > + WriteSwappedDataToClient(client, rep.length * 4, > (char*)modifiers_failed); > } > free(modifiers_failed); > return ret;
Reviewed-by: Julien Cristau <jcris...@debian.org> I have a doubt about the swap function though. Swap32Write seems fine for xXIGrabModifierInfo::modifiers, not so much for ::status? Cheers, Julien _______________________________________________ xorg-devel@lists.x.org: X.Org development Archives: http://lists.x.org/archives/xorg-devel Info: http://lists.x.org/mailman/listinfo/xorg-devel