xserver: Branch 'master'

[Keith Packard]

 hw/dmx/dmx.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

New commits:
commit 50a5c32430a5267f2a05656d2417f9a8a44d8b97
Author: Jon TURNEY <jon.turney at dronecode.org.uk>
Date:   Fri Oct 23 19:32:42 2009 +0100

    dmx: Correctly compute DMXGetScreenAttributes reply length
    
    Correctly allow for excess length of DMXGetScreenAttributes reply
    over standard 32 byte reply in addition to the displayName string
    when computing the length of reply
    
    http://bugs.freedesktop.org/show_bug.cgi?id=24685
    
    Signed-off-by: Jon TURNEY <jon.turney at dronecode.org.uk>
    Reviewed-by:  Julien Cristau <jcristau at debian.org>
    Signed-off-by: Keith Packard <keithp at keithp.com>

diff --git a/hw/dmx/dmx.c b/hw/dmx/dmx.c
index b8fbf02..a1afe76 100644
--- a/hw/dmx/dmx.c
+++ b/hw/dmx/dmx.c
@@ -362,7 +362,8 @@ static int ProcDMXGetScreenAttributes(ClientPtr client)
     paddedLength            = pad_to_int32(length);
     rep.type                = X_Reply;
     rep.sequenceNumber      = client->sequence;
-    rep.length              = bytes_to_int32(paddedLength);
+    rep.length              = bytes_to_int32((sizeof(xDMXGetScreenAttributesReply) - sizeof(xGenericReply))
+                                             + paddedLength);
     rep.displayNameLength   = length;
 
     if (client->swapped) {