[PATCH] Xi: fix modifier offset in XIPassiveGrab swapping function

[Peter Hutterer]

The request is followed by mask_len 4-byte units, then followed by the actual
modifiers.

Reported-by: Alan Coopersmith <alan.coopersmith at oracle.com>
Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
---
 Xi/xipassivegrab.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Xi/xipassivegrab.c b/Xi/xipassivegrab.c
index eccec0a..8aba977 100644
--- a/Xi/xipassivegrab.c
+++ b/Xi/xipassivegrab.c
@@ -63,7 +63,7 @@ SProcXIPassiveGrabDevice(ClientPtr client)
     swaps(&stuff->mask_len);
     swaps(&stuff->num_modifiers);
 
-    mods = (uint32_t *) &stuff[1];
+    mods = (uint32_t *) &stuff[1] + stuff->mask_len;
 
     for (i = 0; i < stuff->num_modifiers; i++, mods++) {
         swapl(mods);
-- 
1.8.4.2