From eb04c7a1b3f8c3ced7ce4472f4fe08de9454efe7 Mon Sep 17 00:00:00 2001
From: "Enrico Weigelt, metux IT consult" <info@metux.net>
Date: Wed, 13 Aug 2025 16:44:24 +0200
Subject: [PATCH] dix: use x_rpcbuf_t in ProcQueryTree()

Use x_rpcbuf_t for reply payload assembly.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
---
 dix/dispatch.c | 29 +++++++++++++----------------
 1 file changed, 13 insertions(+), 16 deletions(-)

diff --git a/dix/dispatch.c b/dix/dispatch.c
index f004241f2e..5e4d643331 100644
--- a/dix/dispatch.c
+++ b/dix/dispatch.c
@@ -1019,9 +1019,8 @@ ProcGetGeometry(ClientPtr client)
 int
 ProcQueryTree(ClientPtr client)
 {
-    int rc, numChildren = 0;
+    int rc;
     WindowPtr pWin, pHead;
-    Window *childIDs = (Window *) NULL;
 
     REQUEST(xResourceReq);
 
@@ -1031,39 +1030,37 @@ ProcQueryTree(ClientPtr client)
         return rc;
 
     pHead = RealChildHead(pWin);
-    for (WindowPtr pChild = pWin->lastChild; pChild != pHead; pChild = pChild->prevSib)
-        numChildren++;
-    if (numChildren) {
-        int curChild = 0;
 
-        childIDs = calloc(numChildren, sizeof(Window));
-        if (!childIDs)
-            return BadAlloc;
-        for (WindowPtr pChild = pWin->lastChild; pChild != pHead;
-             pChild = pChild->prevSib)
-            childIDs[curChild++] = pChild->drawable.id;
+    x_rpcbuf_t rpcbuf = { .swapped = client->swapped, .err_clear = TRUE };
+
+    CARD32 numChildren = 0;
+    for (WindowPtr pChild = pWin->lastChild; pChild != pHead; pChild = pChild->prevSib) {
+        x_rpcbuf_write_CARD32(&rpcbuf, pChild->drawable.id);
+        numChildren++;
     }
 
+    if (rpcbuf.error)
+        return BadAlloc;
+
     xQueryTreeReply rep = {
         .type = X_Reply,
         .sequenceNumber = client->sequence,
         .root = pWin->drawable.pScreen->root->drawable.id,
         .parent = (pWin->parent) ? pWin->parent->drawable.id : (Window) None,
         .nChildren = numChildren,
-        .length = bytes_to_int32(numChildren * sizeof(Window)),
+        .length = x_rpcbuf_wsize_units(&rpcbuf)
     };
 
     if (client->swapped) {
-        SwapLongs(childIDs, rep.length);
         swaps(&rep.sequenceNumber);
         swapl(&rep.length);
         swapl(&rep.root);
         swapl(&rep.parent);
         swaps(&rep.nChildren);
     }
+
     WriteToClient(client, sizeof(rep), &rep);
-    WriteToClient(client, numChildren * sizeof(Window), childIDs);
-    free(childIDs);
+    WriteRpcbufToClient(client, &rpcbuf);
     return Success;
 }