From b243ef9bc22ba1b5e7f47bf8c3d487c09eab5ba1 Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter.hutterer@who-t.net>
Date: Sat, 18 Apr 2026 09:03:55 +1000
Subject: [PATCH] Xi: Swap property data in
 SProcXChangeDeviceProperty/SProcXIChangeProperty

Both SProcXChangeDeviceProperty() and SProcXIChangeProperty() swap the
fixed header fields (property, type, nUnits/num_items) but fail to
byte-swap the variable-length property data (CARD16 or CARD32, depending
on format) that follows the header.

Assisted-by: Claude:claude-claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2202>
---
 Xi/xiproperty.c | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/Xi/xiproperty.c b/Xi/xiproperty.c
index cd2e1a191..450b39ef5 100644
--- a/Xi/xiproperty.c
+++ b/Xi/xiproperty.c
@@ -1022,6 +1022,16 @@ SProcXChangeDeviceProperty(ClientPtr client)
     swapl(&stuff->property);
     swapl(&stuff->type);
     swapl(&stuff->nUnits);
+    switch (stuff->format) {
+    case 8:
+        break;
+    case 16:
+        SwapRestS(stuff);
+        break;
+    case 32:
+        SwapRestL(stuff);
+        break;
+    }
     return (ProcXChangeDeviceProperty(client));
 }
 
@@ -1262,6 +1272,16 @@ SProcXIChangeProperty(ClientPtr client)
     swapl(&stuff->property);
     swapl(&stuff->type);
     swapl(&stuff->num_items);
+    switch (stuff->format) {
+    case 8:
+        break;
+    case 16:
+        SwapRestS(stuff);
+        break;
+    case 32:
+        SwapRestL(stuff);
+        break;
+    }
     return (ProcXIChangeProperty(client));
 }