diff --git a/Mesa.changes b/Mesa.changes
index e10a4a5..0fc760b 100644
--- a/Mesa.changes
+++ b/Mesa.changes
@@ -1,3 +1,11 @@
+-------------------------------------------------------------------
+Tue Feb 26 23:23:46 UTC 2013 - stefan.bruens@rwth-aachen.de
+
+- fix_glx_indirect_reply_bfo#59876.diff
+  * GLX replies are parsed incorrectly when using libxcb and AIGLX,
+    happens for most replies where data is embedded in the header.
+    (bfo#59876, bnc#802718) 
+
 -------------------------------------------------------------------
 Thu Feb 21 23:23:22 UTC 2013 - hrvoje.senjan@gmail.com
 
diff --git a/Mesa.spec b/Mesa.spec
index c471b44..59a4e01 100644
--- a/Mesa.spec
+++ b/Mesa.spec
@@ -98,6 +98,8 @@ Patch13:        u_mesa-8.0.1-fix-16bpp.patch
 Patch14:        u_remove-os-abi-tag.patch
 # Patch from Fedora, use shmget when available, under llvmpipe
 Patch16:        u_mesa-8.0-llvmpipe-shmget.patch
+# bnc#802718, bfo#59876: GLX replies are parsed incorrectly when using libxcb and AIGLX
+Patch18:        U_glx-fix-glGetTexLevelParameteriv-for-indirect-render.patch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
 
 %description
@@ -509,6 +511,7 @@ rm -rf docs/README.{VMS,WIN32,OS2}
 %patch16 -p1
 %patch13 -p1
 %patch14 -p1
+%patch18 -p1
 
 %build
 
diff --git a/U_glx-fix-glGetTexLevelParameteriv-for-indirect-render.patch b/U_glx-fix-glGetTexLevelParameteriv-for-indirect-render.patch
new file mode 100644
index 0000000..80795b6
--- /dev/null
+++ b/U_glx-fix-glGetTexLevelParameteriv-for-indirect-render.patch
@@ -0,0 +1,44 @@
+From c41ba5bda9bf7b9c818b5a5ca503afedabad57bd Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Stefan=20Br=C3=BCns?= <Stefan.Bruens@rwth-aachen.de>
+Date: Tue, 5 Feb 2013 17:29:20 +0100
+Subject: [PATCH] glx: fix glGetTexLevelParameteriv for indirect rendering
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+A single element in a GLX reply is contained in the header itself.
+The number of elements is denoted in the "n" field of the reply.
+If "n" is 1, the length of additional data is 0.
+The XXX_data_length() function of xcb does not return the length of
+the (optional, n>1) data but the number of elements.
+
+Fixes http://bugs.freedesktop.org/show_bug.cgi?id=59876
+
+Note: This is a candidate for the stable branches.
+
+Signed-off-by: Stefan Brüns <stefan.bruens@rwth-aachen.de>
+Signed-off-by: Brian Paul <brianp@vmware.com>
+Reviewed-by: Ian Romanick <ian.d.romanick@intel.com>
+(cherry picked from commit 5876a5dbc0a6ec9ae7f44b5e483d38ae0d24a259)
+---
+ src/mapi/glapi/gen/glX_proto_send.py |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/src/mapi/glapi/gen/glX_proto_send.py b/src/mapi/glapi/gen/glX_proto_send.py
+index fbc0dd3..f4d519f 100644
+--- a/src/mapi/glapi/gen/glX_proto_send.py
++++ b/src/mapi/glapi/gen/glX_proto_send.py
+@@ -700,7 +700,9 @@ generic_%u_byte( GLint rop, const void * ptr )
+ 						if f.reply_always_array:
+ 							print '        (void)memcpy(%s, %s_data(reply), %s_data_length(reply) * sizeof(%s));' % (output.name, xcb_name, xcb_name, output.get_base_type_string())
+ 						else:
+-							print '        if (%s_data_length(reply) == 0)' % (xcb_name)
++							print '        /* the XXX_data_length() xcb function name is misleading, it returns the number */'
++							print '        /* of elements, not the length of the data part. A single element is embedded. */'
++							print '        if (%s_data_length(reply) == 1)' % (xcb_name)
+ 							print '            (void)memcpy(%s, &reply->datum, sizeof(reply->datum));' % (output.name)
+ 							print '        else'
+ 							print '            (void)memcpy(%s, %s_data(reply), %s_data_length(reply) * sizeof(%s));' % (output.name, xcb_name, xcb_name, output.get_base_type_string())
+-- 
+1.7.10.4
+