From 75f2b2334d9f0b5d90ad3eafbae61ccb4158e800 Mon Sep 17 00:00:00 2001
From: "Enrico Weigelt, metux IT consult" <info@metux.net>
Date: Thu, 17 Jul 2025 20:56:54 +0200
Subject: [PATCH] Xext: xv: ProcXvQueryEncodings(): use payload length from
 rpcbuf

Skip the extra payload size calculation, use the rpcbuf's wpos instead.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
---
 Xext/xvdisp.c | 37 +++++++++++++------------------------
 1 file changed, 13 insertions(+), 24 deletions(-)

diff --git a/Xext/xvdisp.c b/Xext/xvdisp.c
index 2b54ae171f..15d266a133 100644
--- a/Xext/xvdisp.c
+++ b/Xext/xvdisp.c
@@ -183,7 +183,6 @@ ProcXvQueryAdaptors(ClientPtr client)
 static int
 ProcXvQueryEncodings(ClientPtr client)
 {
-    int totalSize;
     XvPortPtr pPort;
     int ne;
     XvEncodingPtr pe;
@@ -193,29 +192,6 @@ ProcXvQueryEncodings(ClientPtr client)
 
     VALIDATE_XV_PORT(stuff->port, pPort, DixReadAccess);
 
-    /* FOR EACH ENCODING ADD UP THE BYTES FOR ENCODING NAMES */
-
-    ne = pPort->pAdaptor->nEncodings;
-    pe = pPort->pAdaptor->pEncodings;
-    totalSize = ne * sz_xvEncodingInfo;
-    while (ne--) {
-        totalSize += pad_to_int32(strlen(pe->name));
-        pe++;
-    }
-
-    xvQueryEncodingsReply rep = {
-        .type = X_Reply,
-        .sequenceNumber = client->sequence,
-        .num_encodings = pPort->pAdaptor->nEncodings,
-        .length = bytes_to_int32(totalSize),
-    };
-
-    if (client->swapped) {
-        swaps(&rep.sequenceNumber);
-        swapl(&rep.length);
-        swaps(&rep.num_encodings);
-    }
-
     x_rpcbuf_t rpcbuf = { .swapped = client->swapped, .err_clear = TRUE };
 
     ne = pPort->pAdaptor->nEncodings;
@@ -237,6 +213,19 @@ ProcXvQueryEncodings(ClientPtr client)
     if (rpcbuf.error)
         return BadAlloc;
 
+    xvQueryEncodingsReply rep = {
+        .type = X_Reply,
+        .sequenceNumber = client->sequence,
+        .num_encodings = pPort->pAdaptor->nEncodings,
+        .length = bytes_to_int32(rpcbuf.wpos),
+    };
+
+    if (client->swapped) {
+        swaps(&rep.sequenceNumber);
+        swapl(&rep.length);
+        swaps(&rep.num_encodings);
+    }
+
     WriteToClient(client, sizeof(rep), &rep);
     WriteRpcbufToClient(client, &rpcbuf);
     return Success;