 @@ -2040,27 +2040,27 @@ restrict_code_range(unsigned short *refF
+    }
+}
 static int
 restrict_code_range_by_str(int count,unsigned short *refFirstCol,
 			   unsigned short *refFirstRow,
 			   unsigned short *refLastCol,
 			   unsigned short *refLastRow,
 			   char const *str)
+{
     int nRanges = 0;
     int result = 0;
-    fsRange *ranges = NULL;
+    fsRange *ranges = NULL, *oldRanges;
     char const *p, *q;
     p = q = str;
     for (;;) {
         int minpoint=0, maxpoint=65535;
         long val;
         /* skip comma and/or space */
         while (',' == *p || isspace(*p))
             p++;
         /* begin point */
         if ('-' != *p) {
 @@ -2109,30 +2109,33 @@ restrict_code_range_by_str(int count,uns
         if ( count <= 0 && minpoint>maxpoint ) {
             int tmp;
             tmp = minpoint;
             minpoint = maxpoint;
             maxpoint = tmp;
+        }
         /* add range */
 #if 0
         fprintf(stderr, "zone: 0x%04X - 0x%04X\n", minpoint, maxpoint);
         fflush(stderr);
 #endif
         nRanges++;
         oldRanges = ranges;
         ranges = realloc(ranges, nRanges*sizeof(*ranges));
-        if (NULL == ranges)
+        if (NULL == ranges) {
             free(oldRanges);
             break;
+        }
         else {
             fsRange *r = ranges+nRanges-1;
             r->min_char_low = minpoint & 0xff;
             r->max_char_low = maxpoint & 0xff;
             r->min_char_high = (minpoint>>8) & 0xff;
             r->max_char_high = (maxpoint>>8) & 0xff;
+        }
+    }
     if (ranges) {
         if ( count <= 0 ) {
             restrict_code_range(refFirstCol, refFirstRow, refLastCol, refLastRow,
                                 ranges, nRanges);
 @@ -2194,27 +2197,27 @@ FreeTypeSetUpTTCap( char *fileName, Font
 		int dirLen = p1-fileName;
 		int baseLen = fileName+len - p2 -1;
 		*dynStrRealFileName = malloc(dirLen+baseLen+1);
 		if( *dynStrRealFileName == NULL ) {
 		    result = AllocError;
 		    goto quit;
+		}
 		if ( 0 < dirLen )
 		    memcpy(*dynStrRealFileName, fileName, dirLen);
 		strcpy(*dynStrRealFileName+dirLen, p2+1);
 		capHead = p1;
 	    } else {
-		*dynStrRealFileName = xstrdup(fileName);
+		*dynStrRealFileName = strdup(fileName);
 		if( *dynStrRealFileName == NULL ) {
 		    result = AllocError;
 		    goto quit;
+		}
+	    }
+        }
 	/* font cap */
 	if (capHead) {
 	    if (SPropRecValList_add_by_font_cap(&listPropRecVal,
 						capHead)) {
 		result = BadFontPath;
 		goto quit;
 @@ -2279,33 +2282,31 @@ FreeTypeSetUpTTCap( char *fileName, Font
 		strcat(*dynStrFTFileName,":");
 		strcat(*dynStrFTFileName,beginptr);
 		strcat(*dynStrFTFileName,":");
 		strcat(*dynStrFTFileName,slash+1);
+	    }
 	    else{
 		strcat(*dynStrFTFileName,":");
 		strcat(*dynStrFTFileName,beginptr);
 		strcat(*dynStrFTFileName,":");
 		strcat(*dynStrFTFileName,*dynStrRealFileName);
+	    }
+	}
 	else{
-	    *dynStrFTFileName = malloc(strlen(*dynStrRealFileName)+1);
+	    *dynStrFTFileName = strdup(*dynStrRealFileName);
 	    if( *dynStrFTFileName == NULL ){
 		result = AllocError;
 		goto quit;
+	    }
 	    **dynStrFTFileName = '\0';
 	    strcat(*dynStrFTFileName,*dynStrRealFileName);
+	}
+    }
     /*
     fprintf(stderr,"[Filename:%s]\n",fileName);
     fprintf(stderr,"[RealFilename:%s]\n",*dynStrRealFileName);
     fprintf(stderr,"[FTFilename:%s]\n",*dynStrFTFileName);
     */
     /* slant control */
     if (SPropRecValList_search_record(&listPropRecVal,
                                       &contRecValue,
                                       "AutoItalic"))
         ret->autoItalic = SPropContainer_value_dbl(contRecValue);
     /* hinting control */
 @@ -2539,27 +2540,27 @@ FreeTypeSetUpTTCap( char *fileName, Font
 #if 0
         if (scaleBitmapWidth<=0.0) {
             fprintf(stderr, "ScaleBitmapWitdh needs plus.\n");
             result = BadFontName;
             goto quit;
+        }
 #endif
         ret->scaleBitmap = scaleBitmapWidth;
+    }
     /* restriction of the code range */
     if (SPropRecValList_search_record(&listPropRecVal,
 				      &contRecValue,
 				      "CodeRange")) {
-	*dynStrTTCapCodeRange = xstrdup(SPropContainer_value_str(contRecValue));
+	*dynStrTTCapCodeRange = strdup(SPropContainer_value_str(contRecValue));
 	if( *dynStrTTCapCodeRange == NULL ) {
 	    result = AllocError;
 	    goto quit;
+	}
+    }
     /* forceConstantSpacing{Begin,End} */
     if ( 1 /* ft->spacing == 'p' */ ){
         unsigned short first_col=0,last_col=0x00ff;
         unsigned short first_row=0,last_row=0x00ff;
         if (SPropRecValList_search_record(&listPropRecVal,
                                            &contRecValue,
                                            "ForceConstantSpacingCodeRange")) {
             if ( restrict_code_range_by_str(1,&first_col, &first_row,

 @@ -88,78 +88,78 @@ XGetDeviceControl(
     req->control = control;
     if (!_XReply(dpy, (xReply *) & rep, 0, xFalse))
 	goto out;
     if (rep.length > 0) {
 	unsigned long nbytes;
 	size_t size = 0;
 	if (rep.length < (INT_MAX >> 2)) {
 	    nbytes = (unsigned long) rep.length << 2;
 	    d = Xmalloc(nbytes);
+	}
 	if (!d) {
-	    _XEatData(dpy, (unsigned long)nbytes);
+	    _XEatDataWords(dpy, rep.length);
 	    goto out;
+	}
 	sav = d;
 	_XRead(dpy, (char *)d, nbytes);
         /* In theory, we should just be able to use d->length to get the size.
          * Turns out that a number of X servers (up to and including server
          * 1.4) sent the wrong length value down the wire. So to not break
          * apps that run against older servers, we have to calculate the size
          * manually.
          */
 	switch (d->control) {
 	case DEVICE_RESOLUTION:
+	{
 	    xDeviceResolutionState *r;
 	    size_t val_size;
 	    r = (xDeviceResolutionState *) d;
 	    if (r->num_valuators >= (INT_MAX / (3 * sizeof(int))))
 		goto out;
 	    val_size = 3 * sizeof(int) * r->num_valuators;
 	    if ((sizeof(xDeviceResolutionState) + val_size) > nbytes)
 		goto out;
-	    size += sizeof(XDeviceResolutionState) + val_size;
+	    size = sizeof(XDeviceResolutionState) + val_size;
 	    break;
+	}
         case DEVICE_ABS_CALIB:
+        {
             if (sizeof(xDeviceAbsCalibState) > nbytes)
                 goto out;
-            size += sizeof(XDeviceAbsCalibState);
+            size = sizeof(XDeviceAbsCalibState);
             break;
+        }
         case DEVICE_ABS_AREA:
+        {
             if (sizeof(xDeviceAbsAreaState) > nbytes)
                 goto out;
-            size += sizeof(XDeviceAbsAreaState);
+            size = sizeof(XDeviceAbsAreaState);
             break;
+        }
         case DEVICE_CORE:
+        {
             if (sizeof(xDeviceCoreState) > nbytes)
                 goto out;
-            size += sizeof(XDeviceCoreState);
+            size = sizeof(XDeviceCoreState);
             break;
+        }
 	default:
 	    if (d->length > nbytes)
 		goto out;
-	    size += d->length;
+	    size = d->length;
 	    break;
+	}
 	Device = Xmalloc(size);
 	if (!Device)
 	    goto out;
 	Sav = Device;
 	d = sav;
 	switch (control) {
 	case DEVICE_RESOLUTION:
+	{

 @@ -59,58 +59,58 @@ SOFTWARE.
 #include <X11/Xlibint.h>
 #include <X11/extensions/XInput.h>
 #include <X11/extensions/extutil.h>
 #include "XIint.h"
 #include <limits.h>
 XEventClass *
 XGetDeviceDontPropagateList(
     register Display	*dpy,
     Window		 window,
     int			*count)
+{
     XEventClass *list = NULL;
     int rlen;
     xGetDeviceDontPropagateListReq *req;
     xGetDeviceDontPropagateListReply rep;
     XExtDisplayInfo *info = XInput_find_display(dpy);
     LockDisplay(dpy);
     if (_XiCheckExtInit(dpy, XInput_Initial_Release, info) == -1)
 	return ((XEventClass *) NoSuchExtension);
     GetReq(GetDeviceDontPropagateList, req);
     req->reqType = info->codes->major_opcode;
     req->ReqType = X_GetDeviceDontPropagateList;
     req->window = window;
     if (!_XReply(dpy, (xReply *) & rep, 0, xFalse)) {
 	UnlockDisplay(dpy);
 	SyncHandle();
 	return (XEventClass *) NULL;
+    }
     *count = rep.count;
     if (rep.length != 0) {
 	if ((rep.count != 0) && (rep.length < (INT_MAX / sizeof(XEventClass))))
 	    list = Xmalloc(rep.length * sizeof(XEventClass));
 	rlen = rep.length << 2;
 	if (list) {
 	    unsigned int i;
 	    CARD32 ec;
 	    /* read and assign each XEventClass separately because
 	     * the library representation may not be the same size
 	     * as the wire representation (64 bit machines)
 	     */
 	    for (i = 0; i < rep.length; i++) {
 		_XRead(dpy, (char *)(&ec), sizeof(CARD32));
 		list[i] = (XEventClass) ec;
+	    }
-	} else
+	} else {
-	    _XEatData(dpy, (unsigned long)rlen);
+            *count = 0;
 	    _XEatDataWords(dpy, rep.length);
+        }
+    }
     UnlockDisplay(dpy);
     SyncHandle();
     return (list);
+}

 @@ -20,65 +20,73 @@
  * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
  * DEALINGS IN THE SOFTWARE.
+ *
  */
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 #endif
 #include <stdint.h>
 #include <X11/Xlibint.h>
 #include <X11/extensions/XI2proto.h>
 #include <X11/extensions/XInput2.h>
 #include <X11/extensions/extutil.h>
 #include <limits.h>
 #include "XIint.h"
 static int
 _XIPassiveGrabDevice(Display* dpy, int deviceid, int grabtype, int detail,
                      Window grab_window, Cursor cursor,
                      int grab_mode, int paired_device_mode,
                      Bool owner_events, XIEventMask *mask,
                      int num_modifiers, XIGrabModifiers *modifiers_inout)
+{
     xXIPassiveGrabDeviceReq *req;
     xXIPassiveGrabDeviceReply reply;
     xXIGrabModifierInfo *failed_mods;
     int len = 0, i;
     char *buff;
     XExtDisplayInfo *extinfo = XInput_find_display(dpy);
     LockDisplay(dpy);
     if (_XiCheckExtInit(dpy, XInput_2_0, extinfo) == -1)
 	return -1;
     if (mask->mask_len > INT_MAX - 3 ||
         (mask->mask_len + 3)/4 >= 0xffff)
         return -1;
     buff = calloc(4, (mask->mask_len + 3)/4);
     if (!buff)
         return -1;
     GetReq(XIPassiveGrabDevice, req);
     req->reqType = extinfo->codes->major_opcode;
     req->ReqType = X_XIPassiveGrabDevice;
     req->deviceid = deviceid;
     req->grab_mode = grab_mode;
     req->paired_device_mode = paired_device_mode;
     req->owner_events = owner_events;
     req->grab_window = grab_window;
     req->cursor = cursor;
     req->detail = detail;
     req->num_modifiers = num_modifiers;
     req->mask_len = (mask->mask_len + 3)/4;
     req->grab_type = grabtype;
     len = req->mask_len + num_modifiers;
     SetReqLen(req, len, len);
     buff = calloc(4, req->mask_len);
     memcpy(buff, mask->mask, mask->mask_len);
     Data(dpy, buff, req->mask_len * 4);
     for (i = 0; i < num_modifiers; i++)
         Data(dpy, (char*)&modifiers_inout[i].modifiers, 4);
     free(buff);
     if (!_XReply(dpy, (xReply *)&reply, 0, xFalse))
+    {
 	UnlockDisplay(dpy);
 	SyncHandle();
 	return -1;
+    }

 @@ -55,27 +55,27 @@ XIListProperties(Display* dpy, int devic
     GetReq(XIListProperties, req);
     req->reqType = info->codes->major_opcode;
     req->ReqType = X_XIListProperties;
     req->deviceid = deviceid;
     if (!_XReply(dpy, (xReply*)&rep, 0, xFalse))
         goto cleanup;
     if (rep.num_properties) {
         props = (Atom*)Xmalloc(rep.num_properties * sizeof(Atom));
         if (!props)
+        {
-            _XEatData(dpy, rep.num_properties << 2);
+            _XEatDataWords(dpy, rep.length);
             goto cleanup;
+        }
         _XRead32(dpy, (long*)props, rep.num_properties << 2);
+    }
     *num_props_return = rep.num_properties;
 cleanup:
     UnlockDisplay(dpy);
     SyncHandle();
     return props;
+}
 @@ -194,48 +194,47 @@ XIGetProperty(Display* dpy, int deviceid
 	UnlockDisplay (dpy);
 	SyncHandle ();
 	return 1;
+    }
     *data = NULL;
     if (rep.type != None) {
         if (rep.format != 8 && rep.format != 16 && rep.format != 32) {
 	    /*
 	     * This part of the code should never be reached.  If it is,
 	     * the server sent back a property with an invalid format.
 	     */
-	    nbytes = rep.length << 2;
+	    _XEatDataWords(dpy, rep.length);
 	    _XEatData(dpy, nbytes);
 	    UnlockDisplay(dpy);
 	    SyncHandle();
 	    return(BadImplementation);
+        }
 	/*
 	 * One extra byte is malloced than is needed to contain the property
 	 * data, but this last byte is null terminated and convenient for
 	 * returning string properties, so the client doesn't then have to
 	 * recopy the string to make it null terminated.
 	 */
 	if (rep.num_items < (INT_MAX / (rep.format/8))) {
 	    nbytes = rep.num_items * rep.format/8;
 	    rbytes = nbytes + 1;
 	    *data = Xmalloc(rbytes);
+	}
 	if (!(*data)) {
-	    _XEatData(dpy, nbytes);
+	    _XEatDataWords(dpy, rep.length);
 	    UnlockDisplay(dpy);
 	    SyncHandle();
 	    return(BadAlloc);
+	}
         _XReadPad (dpy, (char *)*data, nbytes);
 	(*data)[rbytes - 1] = '\0';
+    }
     *type_return        = rep.type;
     *format_return      = rep.format;
     *num_items_return   = rep.num_items;
     *bytes_after_return = rep.bytes_after;

 @@ -43,65 +43,85 @@ in this Software without prior written a
 #include <X11/extensions/geproto.h>
 #include "XIint.h"
 #include <limits.h>
 int
 XISelectEvents(Display* dpy, Window win, XIEventMask* masks, int num_masks)
+{
     XIEventMask  *current;
     xXISelectEventsReq  *req;
     xXIEventMask mask;
     int i;
     int len = 0;
     int r = Success;
     int max_mask_len = 0;
     char *buff;
     XExtDisplayInfo *info = XInput_find_display(dpy);
     LockDisplay(dpy);
     if (_XiCheckExtInit(dpy, XInput_2_0, info) == -1) {
         r = NoSuchExtension;
         goto out;
+    }
     for (i = 0; i < num_masks; i++) {
         current = &masks[i];
         if (current->mask_len > INT_MAX - 3 ||
             (current->mask_len + 3)/4 >= 0xffff) {
             r = -1;
             goto out;
+        }
         if (current->mask_len > max_mask_len)
             max_mask_len = current->mask_len;
+    }
     /* max_mask_len is in bytes, but we need 4-byte units on the wire,
      * and they need to be padded with 0 */
     buff = calloc(4, ((max_mask_len + 3)/4));
     if (!buff) {
         r = -1;
         goto out;
+    }
     GetReq(XISelectEvents, req);
     req->reqType = info->codes->major_opcode;
     req->ReqType = X_XISelectEvents;
     req->win = win;
     req->num_masks = num_masks;
     /* get the right length */
     for (i = 0; i < num_masks; i++)
+    {
         len++;
         current = &masks[i];
         len += (current->mask_len + 3)/4;
+    }
     SetReqLen(req, len, len);
     for (i = 0; i < num_masks; i++)
+    {
         char *buff;
         current = &masks[i];
         mask.deviceid = current->deviceid;
         mask.mask_len = (current->mask_len + 3)/4;
         /* masks.mask_len is in bytes, but we need 4-byte units on the wire,
-         * and they need to be padded with 0 */
+        memset(buff, 0, max_mask_len);
         buff = calloc(1, mask.mask_len * 4);
         memcpy(buff, current->mask, current->mask_len);
         Data(dpy, (char*)&mask, sizeof(xXIEventMask));
         Data(dpy, buff, mask.mask_len * 4);
         free(buff);
+    }
     free(buff);
 out:
     UnlockDisplay(dpy);
     SyncHandle();
     return r;
+}
 XIEventMask*
 XIGetSelectedEvents(Display* dpy, Window win, int *num_masks_return)
+{
     unsigned int i, len = 0;
     unsigned char *mask;
     XIEventMask *mask_out = NULL;
 @@ -132,28 +152,34 @@ XIGetSelectedEvents(Display* dpy, Window
+    }
     if (reply.length < (INT_MAX >> 2)) {
         rbytes = (unsigned long) reply.length << 2;
         mask_in = Xmalloc(rbytes);
+    }
     if (!mask_in) {
         _XEatDataWords(dpy, reply.length);
         goto out;
+    }
     _XRead(dpy, (char*)mask_in, rbytes);
-    /* Memory layout of the XIEventMask for a 3 mask reply:
+    /*
-     * [struct a][struct b][struct c][masks a][masks b][masks c]
+     * This function takes interleaved xXIEventMask structs & masks off
      * the wire, such as this 3 mask reply:
      *   [struct a][masks a][struct b][masks b][struct c][masks c]
      * And generates a memory buffer to be returned to callers in which
      * they are not interleaved, so that callers can treat the returned
      * pointer as a simple array of XIEventMask structs, such as:
      *   [struct a][struct b][struct c][masks a][masks b][masks c]
      */
     len = reply.num_masks * sizeof(XIEventMask);
     for (i = 0, mi = mask_in; i < reply.num_masks; i++)
+    {
         unsigned int mask_bytes = mi->mask_len * 4;
         len += mask_bytes;
         if (len > INT_MAX)
             goto out;
         if ((sizeof(xXIEventMask) + mask_bytes) > rbytes)
             goto out;
         rbytes -= (sizeof(xXIEventMask) + mask_bytes);
         mi = (xXIEventMask*)((char*)mi + mask_bytes);

 @@ -194,27 +194,27 @@ XListInputDevices(
     if (!_XReply(dpy, (xReply *) & rep, 0, xFalse)) {
 	UnlockDisplay(dpy);
 	SyncHandle();
 	return (XDeviceInfo *) NULL;
+    }
     if ((*ndevices = rep.ndevices)) {	/* at least 1 input device */
 	size = *ndevices * sizeof(XDeviceInfo);
 	if (rep.length < (INT_MAX >> 2)) {
 	    rlen = rep.length << 2;	/* multiply length by 4    */
 	    slist = list = Xmalloc(rlen);
+	}
 	if (!slist) {
-	    _XEatData(dpy, (unsigned long)rlen);
+	    _XEatDataWords(dpy, rep.length);
 	    UnlockDisplay(dpy);
 	    SyncHandle();
 	    return (XDeviceInfo *) NULL;
+	}
 	_XRead(dpy, (char *)list, rlen);
 	any = (xAnyClassPtr) ((char *)list + (*ndevices * sizeof(xDeviceInfo)));
 	sav_any = any;
 	for (i = 0; i < *ndevices; i++, list++) {
             size += SizeClassInfo(&any, (int)list->num_classes);
+	}
 	Nptr = ((unsigned char *)list) + rlen + 1;

 @@ -114,27 +114,27 @@ XGetDeviceMotionEvents(
+    }
     /* rep.axes is a CARD8, so assume max number of axes for bounds check */
     if (rep.nEvents <
 	(INT_MAX / (sizeof(XDeviceTimeCoord) + (UCHAR_MAX * sizeof(int))))) {
 	size_t bsize = rep.nEvents *
 	    (sizeof(XDeviceTimeCoord) + (rep.axes * sizeof(int)));
 	bufp = Xmalloc(bsize);
     } else
 	bufp = NULL;
     if (!bufp || !savp) {
 	Xfree(bufp);
 	Xfree(savp);
 	*nEvents = 0;
-	_XEatData(dpy, (unsigned long)size);
+	_XEatDataWords(dpy, rep.length);
 	UnlockDisplay(dpy);
 	SyncHandle();
 	return (NULL);
+    }
     _XRead(dpy, (char *)readp, size);
     tc = (XDeviceTimeCoord *) bufp;
     data = (int *)(tc + rep.nEvents);
     for (i = 0; i < *nEvents; i++, tc++) {
 	tc->time = *readp++;
 	tc->data = data;
 	for (j = 0; j < *axis_count; j++)
 	    *data++ = *readp++;

 @@ -120,27 +120,27 @@ XGetDeviceProperty(Display* dpy, XDevice
 		else
 		    ret = BadAlloc;
+	    }
 	    break;
 	default:
 	    /*
 	     * This part of the code should never be reached.  If it is,
 	     * the server sent back a property with an invalid format.
 	     */
 	    ret = BadImplementation;
+	}
 	if (! *prop) {
-	    _XEatData(dpy, (unsigned long) nbytes);
+	    _XEatDataWords(dpy, rep.length);
 	    if (ret == Success)
 		ret = BadAlloc;
 	    goto out;
+	}
 	(*prop)[rbytes - 1] = '\0';
+    }
     *actual_type = rep.propertyType;
     *actual_format = rep.format;
     *nitems = rep.nItems;
     *bytes_after = rep.bytesAfter;
   out:
     UnlockDisplay (dpy);

 @@ -84,27 +84,27 @@ XQueryDeviceState(
     req->reqType = info->codes->major_opcode;
     req->ReqType = X_QueryDeviceState;
     req->deviceid = dev->device_id;
     if (!_XReply(dpy, (xReply *) & rep, 0, xFalse))
         goto out;
     if (rep.length > 0) {
 	if (rep.length < (INT_MAX >> 2)) {
 	    rlen = (unsigned long) rep.length << 2;
 	    data = Xmalloc(rlen);
+	}
 	if (!data) {
-	    _XEatData(dpy, (unsigned long)rlen);
+	    _XEatDataWords(dpy, rep.length);
 	    goto out;
+	}
 	_XRead(dpy, data, rlen);
 	for (i = 0, any = (XInputClass *) data; i < (int)rep.num_classes; i++) {
 	    if (any->length > rlen)
 		goto out;
 	    rlen -= any->length;
 	    switch (any->class) {
 	    case KeyClass:
 		size += sizeof(XKeyState);
 		break;

 @@ -91,27 +91,27 @@ XGetFeedbackControl(
     if (rep.length > 0) {
 	unsigned long nbytes;
 	size_t size = 0;
 	int i;
 	*num_feedbacks = rep.num_feedbacks;
 	if (rep.length < (INT_MAX >> 2)) {
 	    nbytes = rep.length << 2;
 	    f = Xmalloc(nbytes);
+	}
 	if (!f) {
-	    _XEatData(dpy, (unsigned long)nbytes);
+	    _XEatDataWords(dpy, rep.length);
 	    goto out;
+	}
 	sav = f;
 	_XRead(dpy, (char *)f, nbytes);
 	for (i = 0; i < *num_feedbacks; i++) {
 	    if (f->length > nbytes)
 		goto out;
 	    nbytes -= f->length;
 	    switch (f->class) {
 	    case KbdFeedbackClass:
 		size += sizeof(XKbdFeedbackState);