From 54a552c94e6facf37fa94993889e49ed24bd68e0 Mon Sep 17 00:00:00 2001
From: Ben Byer <bbyer@bbyer.apple.com>
Date: Tue, 30 Oct 2007 20:00:21 -0700
Subject: [PATCH] DIX Fix:  QueryFontReply packets can be too big to be
 allocated on the stack

---
 dix/dispatch.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/dix/dispatch.c b/dix/dispatch.c
index 05795407f..bd9136fa3 100644
--- a/dix/dispatch.c
+++ b/dix/dispatch.c
@@ -1366,7 +1366,7 @@ ProcQueryFont(register ClientPtr client)
 	rlength = sizeof(xQueryFontReply) +
 	             FONTINFONPROPS(FONTCHARSET(pFont)) * sizeof(xFontProp)  +
 		     nprotoxcistructs * sizeof(xCharInfo);
-	reply = (xQueryFontReply *)ALLOCATE_LOCAL(rlength);
+	reply = (xQueryFontReply *)xalloc(rlength);
 	if(!reply)
 	{
 	    return(BadAlloc);
@@ -1378,7 +1378,7 @@ ProcQueryFont(register ClientPtr client)
 	QueryFont( pFont, reply, nprotoxcistructs);
 
         WriteReplyToClient(client, rlength, reply);
-	DEALLOCATE_LOCAL(reply);
+	xfree(reply);
 	return(client->noClientException);
     }
 }
@@ -2203,7 +2203,7 @@ DoGetImage(register ClientPtr client, int format, Drawable drawable,
 		length += widthBytesLine;
 	    }
 	}
-	if(!(pBuf = (char *) ALLOCATE_LOCAL(length)))
+	if(!(pBuf = (char *)xalloc(length)))
 	    return (BadAlloc);
 	WriteReplyToClient(client, sizeof (xGetImageReply), &xgi);
     }
@@ -2312,7 +2312,7 @@ DoGetImage(register ClientPtr client, int format, Drawable drawable,
 	REGION_DESTROY(pDraw->pScreen, pVisibleRegion);
 #endif
     if (!im_return)
-	DEALLOCATE_LOCAL(pBuf);
+	xfree(pBuf);
     return (client->noClientException);
 }