From a7811ea424cae6c0ada496535d3ea0a9be1fee7a Mon Sep 17 00:00:00 2001
From: "Enrico Weigelt, metux IT consult" <info@metux.net>
Date: Tue, 2 Sep 2025 20:06:36 +0200
Subject: [PATCH] dix: ProcGetFontPath(): use x_rpcbuf_t

Use x_rpcbuf_t for payload assembly and X_SEND_REPLY_WITH_RPCBUF()
for sending it all out.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
---
 dix/dispatch.c | 21 +++++++--------------
 dix/dix_priv.h |  2 ++
 dix/dixfonts.c | 12 ++++++++++++
 3 files changed, 21 insertions(+), 14 deletions(-)

diff --git a/dix/dispatch.c b/dix/dispatch.c
index 9dcec0f952..d80fd3053d 100644
--- a/dix/dispatch.c
+++ b/dix/dispatch.c
@@ -3396,31 +3396,24 @@ ProcSetFontPath(ClientPtr client)
 int
 ProcGetFontPath(ClientPtr client)
 {
-    int rc, stringLens, numpaths;
-    unsigned char *bufferStart;
-
     /* REQUEST (xReq); */
-
     REQUEST_SIZE_MATCH(xReq);
-    rc = GetFontPath(client, &numpaths, &stringLens, &bufferStart);
+
+    int rc = XaceHookServerAccess(client, DixGetAttrAccess);
     if (rc != Success)
         return rc;
 
+    x_rpcbuf_t rpcbuf = { .swapped = client->swapped, .err_clear = TRUE };
+
     xGetFontPathReply rep = {
-        .type = X_Reply,
-        .sequenceNumber = client->sequence,
-        .length = bytes_to_int32(stringLens + numpaths),
-        .nPaths = numpaths
+        .nPaths = FillFontPath(&rpcbuf)
     };
 
     if (client->swapped) {
-        swaps(&rep.sequenceNumber);
-        swapl(&rep.length);
         swaps(&rep.nPaths);
     }
-    WriteToClient(client, sizeof(rep), &rep);
-    WriteToClient(client, stringLens + numpaths, bufferStart);
-    return Success;
+
+    return X_SEND_REPLY_WITH_RPCBUF(client, rep, rpcbuf);
 }
 
 int
diff --git a/dix/dix_priv.h b/dix/dix_priv.h
index a1d546fd0f..d2acb3219c 100644
--- a/dix/dix_priv.h
+++ b/dix/dix_priv.h
@@ -94,6 +94,8 @@ void CloseDownClient(ClientPtr client);
 ClientPtr GetCurrentClient(void);
 void InitClient(ClientPtr client, int i, void *ospriv);
 
+int FillFontPath(x_rpcbuf_t *rpcbuf);
+
 /* lookup builtin color by name */
 Bool dixLookupBuiltinColor(int screen,
                            char *name,
diff --git a/dix/dixfonts.c b/dix/dixfonts.c
index 47742c650a..bfc6a65a05 100644
--- a/dix/dixfonts.c
+++ b/dix/dixfonts.c
@@ -59,6 +59,7 @@ Equipment Corporation.
 
 #include "dix/dix_priv.h"
 #include "dix/gc_priv.h"
+#include "dix/rpcbuf_priv.h"
 #include "include/swaprep.h"
 #include "os/auth.h"
 #include "os/log_priv.h"
@@ -1816,6 +1817,17 @@ DeleteClientFontStuff(ClientPtr client)
     }
 }
 
+int FillFontPath(x_rpcbuf_t *rpcbuf)
+{
+    for (int i = 0; i < num_fpes; i++) {
+        FontPathElementPtr fpe = font_path_elements[i];
+        /* write a pascal-string */
+        x_rpcbuf_write_CARD8(rpcbuf, fpe->name_length);
+        x_rpcbuf_write_CARD8s(rpcbuf, (CARD8*)fpe->name, fpe->name_length);
+    }
+    return num_fpes;
+}
+
 static int
 register_fpe_funcs(const xfont2_fpe_funcs_rec *funcs)
 {