commit faddfbec6ff331c3859e2f57040da4a8cf072baa
Author: Julien Cristau <jcristau@debian.org>
Date:   Fri May 22 09:54:38 2009 +0200

    Backport: randr: fix server crash in RRGetScreenInfo

    We don't return rates to randr < 1.1 clients, so don't allocate space
    for them.  This fixes a FatalError due to not all allocated space being
    used.

    X.Org bug#21861 <http://bugs.freedesktop.org/show_bug.cgi?id=21861>

    Reported-by: Guillaume Quintin <coincoin169g@gmail.com>
    Signed-off-by: Julien Cristau <jcristau@debian.org>

    Backported from Arctica GH 3.6.x branch.

    v2: backport to nx-libs 3.6.x (Ulrich Sibiller)
    v3: backport to nx-libs 3.5.0.x (Mihai Moldovan)

diff --git a/nx-X11/programs/Xserver/randr/rrscreen.c b/nx-X11/programs/Xserver/randr/rrscreen.c
index 9bea97b..20eed11 100644
--- a/nx-X11/programs/Xserver/randr/rrscreen.c
+++ b/nx-X11/programs/Xserver/randr/rrscreen.c
@@ -677,8 +677,9 @@ ProcRRGetScreenInfo (ClientPtr client)
 	rep.sizeID = pData->size;
 	rep.rate = pData->refresh;
 
-	extraLen = (rep.nSizes * sizeof (xScreenSizes) +
-		    rep.nrateEnts * sizeof (CARD16));
+	extraLen = rep.nSizes * sizeof (xScreenSizes);
+	if (has_rate)
+		extraLen += rep.nrateEnts * sizeof (CARD16);
 
 	if (extraLen)
 	{