Xi: store mask_len before swapping in ProcXIGetSelectedEvents.

Swapping the mask_len and then advancing the pointer by the swapped length
is just a bad idea.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>

1 files changed, 3 insertions, 4 deletions

diff --git a/Xi/xiselectev.c b/Xi/xiselectev.c
index f2c6b9a04..1259de596 100644
--- a/Xi/xiselectev.c
+++ b/Xi/xiselectev.c
@@ -224,10 +224,9 @@ ProcXIGetSelectedEvents(ClientPtr client)
         {
             if (devmask[j] != 0)
             {
+                int mask_len = (j + 4)/4; /* j is an index, hence + 4, not + 3 */
                 evmask->deviceid = i;
-                evmask->mask_len = (j + 4)/4; /* j is an index, hence + 4,
-                                                 not + 3 */
-
+                evmask->mask_len = mask_len;
                 reply.num_masks++;
                 reply.length += sizeof(xXIEventMask)/4 + evmask->mask_len;
 
@@ -239,7 +238,7 @@ ProcXIGetSelectedEvents(ClientPtr client)
 
                 memcpy(&evmask[1], devmask, j + 1);
                 evmask = (xXIEventMask*)((char*)evmask +
-                           sizeof(xXIEventMask) + evmask->mask_len * 4);
+                           sizeof(xXIEventMask) + mask_len * 4);
                 break;
             }
         }