From c98273d0bc00c460db0f5e2787eea541e04103c3 Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter.hutterer@who-t.net>
Date: Fri, 17 Apr 2026 12:02:42 +1000
Subject: [PATCH] render: add missing byte-swap of filter params in
 SProcRenderSetPictureFilter

SProcRenderSetPictureFilter() swapped the picture and nbytes fields but
did not swap the xFixed (CARD32) filter parameter values that follow the
filter name string in the request body.

Co-Authored-by: Claude Code <noreply@anthropic.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2181>
---
 render/render.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/render/render.c b/render/render.c
index c95a5de15..fde156593 100644
--- a/render/render.c
+++ b/render/render.c
@@ -2401,11 +2401,24 @@ SProcRenderQueryFilters(ClientPtr client)
 static int _X_COLD
 SProcRenderSetPictureFilter(ClientPtr client)
 {
+    int nparams;
+    char *name;
+    xFixed *params;
+
     REQUEST(xRenderSetPictureFilterReq);
     REQUEST_AT_LEAST_SIZE(xRenderSetPictureFilterReq);
 
     swapl(&stuff->picture);
     swaps(&stuff->nbytes);
+
+    name = (char *) (stuff + 1);
+    params = (xFixed *) (name + pad_to_int32(stuff->nbytes));
+    nparams = ((xFixed *) stuff + client->req_len) - params;
+    if (nparams < 0)
+        return BadLength;
+
+    SwapLongs((CARD32*)params, nparams);
+
     return (*ProcRenderVector[stuff->renderReqType]) (client);
 }