From 5b38b2d9b981d425587a4eb440acb2f0d6b0db13 Mon Sep 17 00:00:00 2001
From: David Reveman <davidr@novell.com>
Date: Mon, 20 Aug 2007 14:38:33 -0400
Subject: Properly set length field in gradient requests (bug 9526).

---
 src/Picture.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/src/Picture.c b/src/Picture.c
index 0b18f5c..509a835 100644
--- a/src/Picture.c
+++ b/src/Picture.c
@@ -277,6 +277,7 @@ Picture XRenderCreateLinearGradient(Display *dpy,
     XRenderExtDisplayInfo	    *info = XRenderFindDisplay (dpy);
     Picture		    pid;
     xRenderCreateLinearGradientReq *req;
+    long			   len;
 
     RenderCheckExtension (dpy, info, 0);
     LockDisplay(dpy);
@@ -291,9 +292,10 @@ Picture XRenderCreateLinearGradient(Display *dpy,
     req->p2.y = gradient->p2.y;
 
     req->nStops = nStops;
+    len = (long) nStops * 3;
+    SetReqLen (req, len, 6);
     DataInt32(dpy, stops, nStops * 4);
     Data16(dpy, colors, nStops * 8);
-    req->length += nStops*3;
 
     UnlockDisplay(dpy);
     SyncHandle();
@@ -309,6 +311,7 @@ Picture XRenderCreateRadialGradient(Display *dpy,
     XRenderExtDisplayInfo	    *info = XRenderFindDisplay (dpy);
     Picture		    pid;
     xRenderCreateRadialGradientReq *req;
+    long			   len;
 
     RenderCheckExtension (dpy, info, 0);
     LockDisplay(dpy);
@@ -325,9 +328,10 @@ Picture XRenderCreateRadialGradient(Display *dpy,
     req->outer_radius = gradient->outer.radius;
 
     req->nStops = nStops;
+    len = (long) nStops * 3;
+    SetReqLen (req, len, 6);
     DataInt32(dpy, stops, nStops * 4);
     Data16(dpy, colors, nStops * 8);
-    req->length += nStops*3;
 
     UnlockDisplay(dpy);
     SyncHandle();
@@ -343,6 +347,7 @@ Picture XRenderCreateConicalGradient(Display *dpy,
     XRenderExtDisplayInfo	    *info = XRenderFindDisplay (dpy);
     Picture		    pid;
     xRenderCreateConicalGradientReq *req;
+    long			    len;
 
     RenderCheckExtension (dpy, info, 0);
     LockDisplay(dpy);
@@ -356,9 +361,10 @@ Picture XRenderCreateConicalGradient(Display *dpy,
     req->angle = gradient->angle;
 
     req->nStops = nStops;
+    len = (long) nStops * 3;
+    SetReqLen (req, len, 6);
     DataInt32(dpy, stops, nStops * 4);
     Data16(dpy, colors, nStops * 8);
-    req->length += nStops*3;
 
     UnlockDisplay(dpy);
     SyncHandle();
-- 
cgit v1.2.3