From 06695207274ddacfeba4d17d83209c68b8af117d Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter.hutterer@who-t.net>
Date: Fri, 17 Apr 2026 10:29:52 +1000
Subject: [PATCH] Xi/xichangehierarchy: reject zero-length hierarchy change
 entries

No need to spin for a zero-length change. The loop is already bounded to
255 iterations so this just keeps the room slightly cooler.

This is a slight behavior change in that subsequent hierarchy changes
will no longer be accepted (but already-applied changes remain).  But a
client sending zero length hierarchy changes is buggy anyway, so meh.

Assisted-by: Claude:claude-claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2200>
---
 Xi/xichangehierarchy.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/Xi/xichangehierarchy.c b/Xi/xichangehierarchy.c
index ba18ac721..2a3a439a1 100644
--- a/Xi/xichangehierarchy.c
+++ b/Xi/xichangehierarchy.c
@@ -454,8 +454,10 @@ ProcXIChangeHierarchy(ClientPtr client)
         SWAPIF(swaps(&any->type));
         SWAPIF(swaps(&any->length));
 
-        if (len < ((size_t)any->length << 2))
-            return BadLength;
+        if (any->length == 0 || len < ((size_t)any->length << 2)) {
+            rc = BadLength;
+            goto unwind;
+        }
 
 #define CHANGE_SIZE_MATCH(type) \
     do { \