 @@ -56,58 +56,69 @@ int *actualCount)	/* RETURN */
     req->length += (nbytes + 3) >> 2;
     _XSend (dpy, pattern, nbytes);
     /* use _XSend instead of Data, since following _XReply will flush buffer */
     if (!_XReply (dpy, (xReply *)&rep, 0, xFalse)) {
 	*actualCount = 0;
 	UnlockDisplay(dpy);
 	SyncHandle();
 	return (char **) NULL;
+    }
     if (rep.nFonts) {
 	flist = Xmalloc (rep.nFonts * sizeof(char *));
-	if (rep.length < (LONG_MAX >> 2)) {
+	if (rep.length > 0 && rep.length < (INT_MAX >> 2)) {
 	    rlen = rep.length << 2;
 	    ch = Xmalloc(rlen + 1);
 	    /* +1 to leave room for last null-terminator */
+	}
 	if ((! flist) || (! ch)) {
 	    if (flist) Xfree((char *) flist);
 	    if (ch) Xfree(ch);
 	    _XEatData(dpy, rep.length << 2);
 	    *actualCount = 0;
 	    UnlockDisplay(dpy);
 	    SyncHandle();
 	    return (char **) NULL;
+	}
 	_XReadPad (dpy, ch, rlen);
 	/*
 	 * unpack into null terminated strings.
 	 */
 	chend = ch + (rlen + 1);
 	length = *(unsigned char *)ch;
 	*ch = 1; /* make sure it is non-zero for XFreeFontNames */
 	for (i = 0; i < rep.nFonts; i++) {
 	    if (ch + length < chend) {
 		flist[i] = ch + 1;  /* skip over length */
 		ch += length + 1;  /* find next length ... */
-		length = *(unsigned char *)ch;
+		if (ch <= chend) {
-		*ch = '\0';  /* and replace with null-termination */
+		    length = *(unsigned char *)ch;
-		count++;
+		    *ch = '\0';  /* and replace with null-termination */
-	    } else
+		    count++;
-		flist[i] = NULL;
+		} else {
                     Xfree(flist);
                     flist = NULL;
                     count = 0;
                     break;
+		}
 	    } else {
                 Xfree(flist);
                 flist = NULL;
                 count = 0;
                 break;
+            }
+	}
+    }
     *actualCount = count;
     UnlockDisplay(dpy);
     SyncHandle();
     return (flist);
+}
 int
 XFreeFontNames(char **list)
+{
 	if (list) {
 		if (!*(list[0]-1)) { /* from ListFontsWithInfo */

 @@ -49,26 +49,27 @@ XImage *XGetImage (
      Drawable d,
      int x,
      int y,
      unsigned int width,
      unsigned int height,
      unsigned long plane_mask,
      int format)	/* either XYPixmap or ZPixmap */
+{
 	xGetImageReply rep;
 	register xGetImageReq *req;
 	char *data;
 	unsigned long nbytes;
 	XImage *image;
 	int planes;
 	LockDisplay(dpy);
 	GetReq (GetImage, req);
 	/*
 	 * first set up the standard stuff in the request
 	 */
 	req->drawable = d;
 	req->x = x;
 	req->y = y;
 	req->width = width;
 	req->height = height;
 	req->planeMask = plane_mask;
 	req->format = format;
 @@ -81,38 +82,48 @@ XImage *XGetImage (
 	if (rep.length < (INT_MAX >> 2)) {
 	    nbytes = (unsigned long)rep.length << 2;
 	    data = Xmalloc(nbytes);
 	} else
 	    data = NULL;
 	if (! data) {
 	    _XEatData(dpy, rep.length << 2);
 	    UnlockDisplay(dpy);
 	    SyncHandle();
 	    return (XImage *) NULL;
+	}
         _XReadPad (dpy, data, nbytes);
-        if (format == XYPixmap)
+        if (format == XYPixmap) {
-	   image = XCreateImage(dpy, _XVIDtoVisual(dpy, rep.visual),
+	    image = XCreateImage(dpy, _XVIDtoVisual(dpy, rep.visual),
-		  Ones (plane_mask &
+		Ones (plane_mask &
-			(((unsigned long)0xFFFFFFFF) >> (32 - rep.depth))),
+		    (((unsigned long)0xFFFFFFFF) >> (32 - rep.depth))),
-		  format, 0, data, width, height, dpy->bitmap_pad, 0);
+		format, 0, data, width, height, dpy->bitmap_pad, 0);
-	else /* format == ZPixmap */
+	    planes = image->depth;
-           image = XCreateImage (dpy, _XVIDtoVisual(dpy, rep.visual),
+	} else { /* format == ZPixmap */
-		 rep.depth, ZPixmap, 0, data, width, height,
+            image = XCreateImage (dpy, _XVIDtoVisual(dpy, rep.visual),
-		  _XGetScanlinePad(dpy, (int) rep.depth), 0);
+		rep.depth, ZPixmap, 0, data, width, height,
 		    _XGetScanlinePad(dpy, (int) rep.depth), 0);
 	    planes = 1;
+	}
 	if (!image)
 	    Xfree(data);
 	if (planes < 1 || image->height < 1 || image->bytes_per_line < 1 ||
 	    INT_MAX / image->height <= image->bytes_per_line ||
 	    INT_MAX / planes <= image->height * image->bytes_per_line ||
 	    nbytes < planes * image->height * image->bytes_per_line) {
 	    XDestroyImage(image);
 	    image = NULL;
+	}
 	UnlockDisplay(dpy);
 	SyncHandle();
 	return (image);
+}
 XImage *XGetSubImage(
      register Display *dpy,
      Drawable d,
      int x,
      int y,
      unsigned int width,
      unsigned int height,
      unsigned long plane_mask,

 @@ -45,54 +45,58 @@ char **XListExtensions(
 	unsigned long rlen;
 	LockDisplay(dpy);
 	GetEmptyReq (ListExtensions, req);
 	if (! _XReply (dpy, (xReply *) &rep, 0, xFalse)) {
 	    UnlockDisplay(dpy);
 	    SyncHandle();
 	    return (char **) NULL;
+	}
 	if (rep.nExtensions) {
 	    list = Xmalloc (rep.nExtensions * sizeof (char *));
-	    if (rep.length < (LONG_MAX >> 2)) {
+	    if (rep.length > 0 && rep.length < (INT_MAX >> 2)) {
 		rlen = rep.length << 2;
 		ch = Xmalloc (rlen + 1);
                 /* +1 to leave room for last null-terminator */
+	    }
 	    if ((!list) || (!ch)) {
 		if (list) Xfree((char *) list);
 		if (ch)   Xfree((char *) ch);
 		_XEatData(dpy, rep.length << 2);
 		UnlockDisplay(dpy);
 		SyncHandle();
 		return (char **) NULL;
+	    }
 	    _XReadPad (dpy, ch, rlen);
 	    /*
 	     * unpack into null terminated strings.
 	     */
 	    chend = ch + (rlen + 1);
 	    length = *ch;
 	    for (i = 0; i < rep.nExtensions; i++) {
 		if (ch + length < chend) {
 		    list[i] = ch+1;  /* skip over length */
 		    ch += length + 1; /* find next length ... */
-		    length = *ch;
+		    if (ch <= chend) {
-		    *ch = '\0'; /* and replace with null-termination */
+			length = *ch;
-		    count++;
+			*ch = '\0'; /* and replace with null-termination */
 			count++;
 		    } else {
 			list[i] = NULL;
+		    }
 		} else
 		    list[i] = NULL;
+	    }
+	}
 	*nextensions = count;
 	UnlockDisplay(dpy);
 	SyncHandle();
 	return (list);
+}
 int
 XFreeExtensionList (char **list)

 @@ -13,26 +13,27 @@
+ *
  * KEITH PACKARD DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
  * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
  * EVENT SHALL KEITH PACKARD BE LIABLE FOR ANY SPECIAL, INDIRECT OR
  * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
  * DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
  * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  * PERFORMANCE OF THIS SOFTWARE.
  */
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 #endif
 #include <limits.h>
 #include "Xfixesint.h"
 XserverRegion
 XFixesCreateRegion (Display *dpy, XRectangle *rectangles, int nrectangles)
+{
     XFixesExtDisplayInfo	*info = XFixesFindDisplay (dpy);
     xXFixesCreateRegionReq	*req;
     long    			len;
     XserverRegion		region;
     XFixesCheckExtension (dpy, info, 0);
     LockDisplay (dpy);
     GetReq (XFixesCreateRegion, req);
 @@ -323,30 +324,37 @@ XFixesFetchRegionAndBounds (Display
     req->xfixesReqType = X_XFixesFetchRegion;
     req->region = region;
     *nrectanglesRet = 0;
     if (!_XReply (dpy, (xReply *) &rep, 0, xFalse))
+    {
 	UnlockDisplay (dpy);
 	SyncHandle ();
 	return NULL;
+    }
     bounds->x = rep.x;
     bounds->y = rep.y;
     bounds->width = rep.width;
     bounds->height = rep.height;
-    nbytes = (long) rep.length << 2;
+    if (rep.length < (INT_MAX >> 2)) {
-    nrects = rep.length >> 1;
+	nbytes = (long) rep.length << 2;
-    nread = nrects << 3;
+	nrects = rep.length >> 1;
-    rects = Xmalloc (nrects * sizeof (XRectangle));
+	nread = nrects << 3;
 	rects = Xmalloc (nrects * sizeof (XRectangle));
     } else {
 	nbytes = 0;
 	nrects = 0;
 	nread = 0;
 	rects = NULL;
+    }
     if (!rects)
+    {
 	_XEatData (dpy, nbytes);
 	UnlockDisplay (dpy);
 	SyncHandle ();
 	return NULL;
+    }
     _XRead16 (dpy, (short *) rects, nrects << 3);
     /* skip any padding */
     if(nbytes > nread)
+    {
 	_XEatData (dpy, (unsigned long) (nbytes - nread));
+    }

 @@ -59,26 +59,27 @@ SOFTWARE.
 #include "XIint.h"
 #include <limits.h>
 XFeedbackState *
 XGetFeedbackControl(
     register Display	*dpy,
     XDevice		*dev,
     int			*num_feedbacks)
+{
     XFeedbackState *Feedback = NULL;
     XFeedbackState *Sav = NULL;
     xFeedbackState *f = NULL;
     xFeedbackState *sav = NULL;
     char *end = NULL;
     xGetFeedbackControlReq *req;
     xGetFeedbackControlReply rep;
     XExtDisplayInfo *info = XInput_find_display(dpy);
     LockDisplay(dpy);
     if (_XiCheckExtInit(dpy, XInput_Initial_Release, info) == -1)
 	return ((XFeedbackState *) NoSuchExtension);
     GetReq(GetFeedbackControl, req);
     req->reqType = info->codes->major_opcode;
     req->ReqType = X_GetFeedbackControl;
     req->deviceid = dev->device_id;
 @@ -91,47 +92,51 @@ XGetFeedbackControl(
 	int i;
 	*num_feedbacks = rep.num_feedbacks;
 	if (rep.length < (INT_MAX >> 2)) {
 	    nbytes = rep.length << 2;
 	    f = Xmalloc(nbytes);
+	}
 	if (!f) {
 	    _XEatData(dpy, (unsigned long)nbytes);
 	    goto out;
+	}
 	sav = f;
 	end = (char *)f + nbytes;
 	_XRead(dpy, (char *)f, nbytes);
 	for (i = 0; i < *num_feedbacks; i++) {
-	    if (f->length > nbytes)
+	    if ((char *)f + sizeof(*f) > end ||
 	        f->length == 0 || f->length > nbytes)
 		goto out;
 	    nbytes -= f->length;
 	    switch (f->class) {
 	    case KbdFeedbackClass:
 		size += sizeof(XKbdFeedbackState);
 		break;
 	    case PtrFeedbackClass:
 		size += sizeof(XPtrFeedbackState);
 		break;
 	    case IntegerFeedbackClass:
 		size += sizeof(XIntegerFeedbackState);
 		break;
 	    case StringFeedbackClass:
+	    {
 		xStringFeedbackState *strf = (xStringFeedbackState *) f;
 		if ((char *)f + sizeof(*strf) > end)
 		    goto out;
 		if (strf->num_syms_supported >= (INT_MAX / sizeof(KeySym)))
 		    goto out;
 		size += sizeof(XStringFeedbackState) +
 		    (strf->num_syms_supported * sizeof(KeySym));
+	    }
 		break;
 	    case LedFeedbackClass:
 		size += sizeof(XLedFeedbackState);
 		break;
 	    case BellFeedbackClass:
 		size += sizeof(XBellFeedbackState);
 		break;
 	    default:

 @@ -50,50 +50,54 @@ SOFTWARE.
  *			 available input devices.
+ *
  */
 #include <X11/extensions/XI.h>
 #include <X11/extensions/XIproto.h>
 #include <X11/Xlibint.h>
 #include <X11/extensions/XInput.h>
 #include <X11/extensions/extutil.h>
 #include "XIint.h"
 #include <limits.h>
 static size_t
-SizeClassInfo(xAnyClassPtr *any, int num_classes)
+SizeClassInfo(xAnyClassPtr *any, size_t len, int num_classes)
+{
     int size = 0;
     int j;
     for (j = 0; j < num_classes; j++) {
         switch ((*any)->class) {
             case KeyClass:
                 size += sizeof(XKeyInfo);
                 break;
             case ButtonClass:
                 size += sizeof(XButtonInfo);
                 break;
             case ValuatorClass:
+                {
                     xValuatorInfoPtr v;
                     if (len < sizeof(v))
                         return 0;
                     v = (xValuatorInfoPtr) *any;
                     size += sizeof(XValuatorInfo) +
                         (v->num_axes * sizeof(XAxisInfo));
                     break;
+                }
             default:
                 break;
+        }
         if ((*any)->length > len)
             return 0;
         *any = (xAnyClassPtr) ((char *)(*any) + (*any)->length);
+    }
     return size;
+}
 static void
 ParseClassInfo(xAnyClassPtr *any, XAnyClassPtr *Any, int num_classes)
+{
     int j, k;
     for (j = 0; j < num_classes; j++) {
         switch ((*any)->class) {
 @@ -145,34 +149,35 @@ ParseClassInfo(xAnyClassPtr *any, XAnyCl
             default:
                 break;
+        }
         *any = (xAnyClassPtr) ((char *)(*any) + (*any)->length);
         *Any = (XAnyClassPtr) ((char *)(*Any) + (*Any)->length);
+    }
+}
 XDeviceInfo *
 XListInputDevices(
     register Display	*dpy,
     int			*ndevices)
+{
-    size_t size;
+    size_t s, size;
     xListInputDevicesReq *req;
     xListInputDevicesReply rep;
     xDeviceInfo *list, *slist = NULL;
     XDeviceInfo *sclist = NULL;
     XDeviceInfo *clist = NULL;
     xAnyClassPtr any, sav_any;
     XAnyClassPtr Any;
     char *end = NULL;
     unsigned char *nptr, *Nptr;
     int i;
     unsigned long rlen;
     XExtDisplayInfo *info = XInput_find_display(dpy);
     LockDisplay(dpy);
     if (_XiCheckExtInit(dpy, XInput_Initial_Release, info) == -1)
 	return ((XDeviceInfo *) NULL);
     GetReq(ListInputDevices, req);
     req->reqType = info->codes->major_opcode;
     req->ReqType = X_ListInputDevices;
 @@ -188,36 +193,40 @@ XListInputDevices(
 	    rlen = rep.length << 2;	/* multiply length by 4    */
 	    slist = list = Xmalloc(rlen);
+	}
 	if (!slist) {
 	    _XEatData(dpy, (unsigned long)rlen);
 	    UnlockDisplay(dpy);
 	    SyncHandle();
 	    return (XDeviceInfo *) NULL;
+	}
 	_XRead(dpy, (char *)list, rlen);
 	any = (xAnyClassPtr) ((char *)list + (*ndevices * sizeof(xDeviceInfo)));
 	sav_any = any;
 	end = (char *)list + rlen;
 	for (i = 0; i < *ndevices; i++, list++) {
-            size += SizeClassInfo(&any, (int)list->num_classes);
+            s = SizeClassInfo(&any, end - (char *)any, (int)list->num_classes);
             if (!s)
                 goto out;
             size += s;
+	}
-	Nptr = ((unsigned char *)list) + rlen + 1;
+	Nptr = ((unsigned char *)list) + rlen;
 	for (i = 0, nptr = (unsigned char *)any; i < *ndevices; i++) {
 	    if (nptr >= Nptr)
 		goto out;
 	    size += *nptr + 1;
 	    nptr += (*nptr + 1);
 	    if (nptr > Nptr)
 		goto out;
+	}
 	clist = (XDeviceInfoPtr) Xmalloc(size);
 	if (!clist) {
 	    XFree((char *)slist);
 	    UnlockDisplay(dpy);
 	    SyncHandle();
 	    return (XDeviceInfo *) NULL;
+	}
 	sclist = clist;
 	Any = (XAnyClassPtr) ((char *)clist +
 			      (*ndevices * sizeof(XDeviceInfo)));
 	list = slist;

 @@ -60,67 +60,71 @@ SOFTWARE.
 XDeviceState *
 XQueryDeviceState(
     register Display	*dpy,
     XDevice		*dev)
+{
     int i, j;
     unsigned long rlen;
     size_t size = 0;
     xQueryDeviceStateReq *req;
     xQueryDeviceStateReply rep;
     XDeviceState *state = NULL;
     XInputClass *any, *Any;
-    char *data = NULL;
+    char *data = NULL, *end = NULL;
     XExtDisplayInfo *info = XInput_find_display(dpy);
     LockDisplay(dpy);
     if (_XiCheckExtInit(dpy, XInput_Initial_Release, info) == -1)
 	return ((XDeviceState *) NoSuchExtension);
     GetReq(QueryDeviceState, req);
     req->reqType = info->codes->major_opcode;
     req->ReqType = X_QueryDeviceState;
     req->deviceid = dev->device_id;
     if (!_XReply(dpy, (xReply *) & rep, 0, xFalse))
         goto out;
     if (rep.length > 0) {
 	if (rep.length < (INT_MAX >> 2)) {
 	    rlen = (unsigned long) rep.length << 2;
 	    data = Xmalloc(rlen);
 	    end = data + rlen;
+	}
 	if (!data) {
 	    _XEatData(dpy, (unsigned long)rlen);
 	    goto out;
+	}
 	_XRead(dpy, data, rlen);
 	for (i = 0, any = (XInputClass *) data; i < (int)rep.num_classes; i++) {
-	    if (any->length > rlen)
+	    if ((char *)any + sizeof(XInputClass) > end ||
 		any->length == 0 || any->length > rlen)
 		goto out;
 	    rlen -= any->length;
 	    switch (any->class) {
 	    case KeyClass:
 		size += sizeof(XKeyState);
 		break;
 	    case ButtonClass:
 		size += sizeof(XButtonState);
 		break;
 	    case ValuatorClass:
+	    {
 		xValuatorState *v = (xValuatorState *) any;
 		if ((char *)any + sizeof(xValuatorState) > end)
 		    goto out;
 		size += (sizeof(XValuatorState) +
 			 (v->num_valuators * sizeof(int)));
+	    }
 		break;
+	    }
 	    any = (XInputClass *) ((char *)any + any->length);
+	}
 	state = (XDeviceState *) Xmalloc(size + sizeof(XDeviceState));
 	if (!state)
             goto out;
 	state->device_id = dev->device_id;
 	state->num_classes = rep.num_classes;

 @@ -79,51 +79,53 @@ XGetDeviceControl(
     GetReq(GetDeviceControl, req);
     req->reqType = info->codes->major_opcode;
     req->ReqType = X_GetDeviceControl;
     req->deviceid = dev->device_id;
     req->control = control;
     if (!_XReply(dpy, (xReply *) & rep, 0, xFalse))
 	goto out;
     if (rep.length > 0) {
 	unsigned long nbytes;
 	size_t size = 0;
-	if (rep.length < (INT_MAX >> 2)) {
+	if (rep.length < (INT_MAX >> 2) &&
 	    (rep.length << 2) >= sizeof(xDeviceState)) {
 	    nbytes = (unsigned long) rep.length << 2;
 	    d = Xmalloc(nbytes);
+	}
 	if (!d) {
 	    _XEatData(dpy, (unsigned long)nbytes);
 	    goto out;
+	}
 	sav = d;
 	_XRead(dpy, (char *)d, nbytes);
         /* In theory, we should just be able to use d->length to get the size.
          * Turns out that a number of X servers (up to and including server
          * 1.4) sent the wrong length value down the wire. So to not break
          * apps that run against older servers, we have to calculate the size
          * manually.
          */
 	switch (d->control) {
 	case DEVICE_RESOLUTION:
+	{
 	    xDeviceResolutionState *r;
 	    size_t val_size;
 	    r = (xDeviceResolutionState *) d;
-	    if (r->num_valuators >= (INT_MAX / (3 * sizeof(int))))
+	    if (sizeof(xDeviceResolutionState) > nbytes ||
 		r->num_valuators >= (INT_MAX / (3 * sizeof(int))))
 		goto out;
 	    val_size = 3 * sizeof(int) * r->num_valuators;
 	    if ((sizeof(xDeviceResolutionState) + val_size) > nbytes)
 		goto out;
 	    size += sizeof(XDeviceResolutionState) + val_size;
 	    break;
+	}
         case DEVICE_ABS_CALIB:
+        {
             if (sizeof(xDeviceAbsCalibState) > nbytes)
                 goto out;
             size += sizeof(XDeviceAbsCalibState);
             break;

 @@ -40,26 +40,27 @@ HEWLETT-PACKARD BE LIABLE FOR ANY SPECIA
 ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
 WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
 ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
 SOFTWARE.
 ********************************************************/
 /***********************************************************************
+ *
  * XGetDeviceKeyMapping - get the keymap of an extension device.
+ *
  */
 #include <limits.h>
 #include <X11/extensions/XI.h>
 #include <X11/extensions/XIproto.h>
 #include <X11/Xlibint.h>
 #include <X11/extensions/XInput.h>
 #include <X11/extensions/extutil.h>
 #include "XIint.h"
 KeySym *
 XGetDeviceKeyMapping(register Display * dpy, XDevice * dev,
 #if NeedWidePrototypes
 		     unsigned int first,
 #else
 		     KeyCode first,
 @@ -79,26 +80,33 @@ XGetDeviceKeyMapping(register Display *
     GetReq(GetDeviceKeyMapping, req);
     req->reqType = info->codes->major_opcode;
     req->ReqType = X_GetDeviceKeyMapping;
     req->deviceid = dev->device_id;
     req->firstKeyCode = first;
     req->count = keycount;
     if (!_XReply(dpy, (xReply *) & rep, 0, xFalse)) {
 	UnlockDisplay(dpy);
 	SyncHandle();
 	return (KeySym *) NULL;
+    }
     if (rep.length > 0) {
-	*syms_per_code = rep.keySymsPerKeyCode;
+	if (rep.length < INT_MAX >> 2 &&
-	nbytes = (long)rep.length << 2;
+	    rep.length == rep.keySymsPerKeyCode * keycount) {
-	mapping = (KeySym *) Xmalloc((unsigned)nbytes);
+	    *syms_per_code = rep.keySymsPerKeyCode;
 	    nbytes = (long)rep.length << 2;
 	    mapping = (KeySym *) Xmalloc((unsigned)nbytes);
 	} else {
 	    *syms_per_code = 0;
 	    nbytes = 0;
 	    mapping = NULL;
+	}
 	if (mapping)
 	    _XRead(dpy, (char *)mapping, nbytes);
 	else
 	    _XEatData(dpy, (unsigned long)nbytes);
+    }
     UnlockDisplay(dpy);
     SyncHandle();
     return (mapping);
+}

 @@ -40,26 +40,27 @@ HEWLETT-PACKARD BE LIABLE FOR ANY SPECIA
 ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
 WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
 ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
 SOFTWARE.
 ********************************************************/
 /***********************************************************************
+ *
  * XGetDeviceModifierMapping - get the modifier map of an extension device.
+ *
  */
 #include <limits.h>
 #include <X11/extensions/XI.h>
 #include <X11/extensions/XIproto.h>
 #include <X11/Xlibint.h>
 #include <X11/extensions/XInput.h>
 #include <X11/extensions/extutil.h>
 #include "XIint.h"
 XModifierKeymap *
 XGetDeviceModifierMapping(
     register Display	*dpy,
     XDevice		*dev)
+{
     unsigned long nbytes;
 @@ -72,28 +73,34 @@ XGetDeviceModifierMapping(
     if (_XiCheckExtInit(dpy, XInput_Initial_Release, info) == -1)
 	return ((XModifierKeymap *) NoSuchExtension);
     GetReq(GetDeviceModifierMapping, req);
     req->reqType = info->codes->major_opcode;
     req->ReqType = X_GetDeviceModifierMapping;
     req->deviceid = dev->device_id;
     if (!_XReply(dpy, (xReply *) & rep, 0, xFalse)) {
 	UnlockDisplay(dpy);
 	SyncHandle();
 	return (XModifierKeymap *) NULL;
+    }
-    nbytes = (unsigned long)rep.length << 2;
+    if (rep.length < (INT_MAX >> 2) &&
-    res = (XModifierKeymap *) Xmalloc(sizeof(XModifierKeymap));
+	rep.numKeyPerModifier == rep.length >> 1) {
 	nbytes = (unsigned long)rep.length << 2;
 	res = (XModifierKeymap *) Xmalloc(sizeof(XModifierKeymap));
     } else {
 	nbytes = 0;
 	res = NULL;
+    }
     if (res) {
 	res->modifiermap = (KeyCode *) Xmalloc(nbytes);
 	if (res->modifiermap)
 	    _XReadPad(dpy, (char *)res->modifiermap, nbytes);
 	else
 	    _XEatData(dpy, (unsigned long)nbytes);
 	res->max_keypermod = rep.numKeyPerModifier;
+    }
     UnlockDisplay(dpy);
     SyncHandle();
     return (res);
+}

 @@ -12,99 +12,131 @@
  * paragraph) shall be included in all copies or substantial portions of the
  * Software.
+ *
  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
  * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
  * DEALINGS IN THE SOFTWARE.
+ *
  */
 #include <limits.h>
 #include <stdint.h>
 #include <X11/Xlibint.h>
 #include <X11/extensions/XI2proto.h>
 #include <X11/extensions/XInput2.h>
 #include <X11/extensions/extutil.h>
 #include "XIint.h"
 extern int copy_classes(XIDeviceInfo* to, xXIAnyInfo* from, int nclasses);
 extern int size_classes(xXIAnyInfo* from, int nclasses);
 XIDeviceInfo*
 XIQueryDevice(Display *dpy, int deviceid, int *ndevices_return)
+{
     XIDeviceInfo        *info = NULL;
     xXIQueryDeviceReq   *req;
     xXIQueryDeviceReply reply;
     char                *ptr;
     char                *end;
     int                 i;
     char                *buf;
     XExtDisplayInfo *extinfo = XInput_find_display(dpy);
     LockDisplay(dpy);
     if (_XiCheckExtInit(dpy, XInput_2_0, extinfo) == -1)
 	goto error;
     GetReq(XIQueryDevice, req);
     req->reqType  = extinfo->codes->major_opcode;
     req->ReqType  = X_XIQueryDevice;
     req->deviceid = deviceid;
     if (!_XReply(dpy, (xReply*) &reply, 0, xFalse))
         goto error;
-    *ndevices_return = reply.num_devices;
+    if (reply.length < INT_MAX / 4)
     info = Xmalloc((reply.num_devices + 1) * sizeof(XIDeviceInfo));
 	*ndevices_return = reply.num_devices;
 	info = Xmalloc((reply.num_devices + 1) * sizeof(XIDeviceInfo));
+    }
     else
+    {
 	*ndevices_return = 0;
 	info = NULL;
+    }
     if (!info)
         goto error;
     buf = Xmalloc(reply.length * 4);
     _XRead(dpy, buf, reply.length * 4);
     ptr = buf;
     end = buf + reply.length * 4;
     /* info is a null-terminated array */
     info[reply.num_devices].name = NULL;
     for (i = 0; i < reply.num_devices; i++)
+    {
         XIDeviceInfo    *lib = &info[i];
         xXIDeviceInfo   *wire = (xXIDeviceInfo*)ptr;
         if (ptr + sizeof(xXIDeviceInfo) > end)
             goto error_loop;
         lib->deviceid    = wire->deviceid;
         lib->use         = wire->use;
         lib->attachment  = wire->attachment;
         lib->enabled     = wire->enabled;
         lib->num_classes = wire->num_classes;
         lib->classes     = (XIAnyClassInfo**)&lib[1];
         ptr += sizeof(xXIDeviceInfo);
         if (ptr + wire->name_len > end)
             goto error_loop;
         lib->name = Xcalloc(wire->name_len + 1, 1);
         if (lib->name == NULL)
             goto error_loop;
         strncpy(lib->name, ptr, wire->name_len);
         lib->name[wire->name_len] = '\0';
         ptr += ((wire->name_len + 3)/4) * 4;
         lib->classes = Xmalloc(size_classes((xXIAnyInfo*)ptr, lib->num_classes));
         if (lib->classes == NULL)
+        {
             Xfree(lib->name);
             goto error_loop;
+        }
         ptr += copy_classes(lib, (xXIAnyInfo*)ptr, lib->num_classes);
+    }
     Xfree(buf);
     UnlockDisplay(dpy);
     SyncHandle();
     return info;
 error_loop:
     while (--i >= 0)
+    {
         Xfree(info[i].name);
         Xfree(info[i].classes);
+    }
 error:
     UnlockDisplay(dpy);
     SyncHandle();
     *ndevices_return = -1;
     return NULL;
+}
 void
 XIFreeDeviceInfo(XIDeviceInfo* info)
+{
     XIDeviceInfo *ptr = info;
     while(ptr->name)
+    {

 @@ -40,26 +40,27 @@ HEWLETT-PACKARD BE LIABLE FOR ANY SPECIA
 ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
 WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
 ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
 SOFTWARE.
 ********************************************************/
 /***********************************************************************
+ *
  * XOpenDevice - Request the server to open and extension input device.
+ *
  */
 #include <limits.h>
 #include <X11/extensions/XI.h>
 #include <X11/extensions/XIproto.h>
 #include <X11/Xlibint.h>
 #include <X11/extensions/XInput.h>
 #include <X11/extensions/extutil.h>
 #include "XIint.h"
 XDevice *
 XOpenDevice(
     register Display	*dpy,
     register XID	 id)
+{
     register long rlen;	/* raw length */
 @@ -73,29 +74,35 @@ XOpenDevice(
 	return ((XDevice *) NoSuchExtension);
     GetReq(OpenDevice, req);
     req->reqType = info->codes->major_opcode;
     req->ReqType = X_OpenDevice;
     req->deviceid = id;
     if (!_XReply(dpy, (xReply *) & rep, 0, xFalse)) {
 	UnlockDisplay(dpy);
 	SyncHandle();
 	return (XDevice *) NULL;
+    }
-    rlen = rep.length << 2;
+    if (rep.length < INT_MAX >> 2 &&
-    dev = (XDevice *) Xmalloc(sizeof(XDevice) + rep.num_classes *
+	(rep.length << 2) >= rep.num_classes * sizeof(xInputClassInfo)) {
-			      sizeof(XInputClassInfo));
+	rlen = rep.length << 2;
 	dev = (XDevice *) Xmalloc(sizeof(XDevice) + rep.num_classes *
 				  sizeof(XInputClassInfo));
     } else {
 	rlen = 0;
 	dev = NULL;
+    }
     if (dev) {
 	int dlen;	/* data length */
 	dev->device_id = req->deviceid;
 	dev->num_classes = rep.num_classes;
 	dev->classes = (XInputClassInfo *) ((char *)dev + sizeof(XDevice));
 	dlen = rep.num_classes * sizeof(xInputClassInfo);
 	_XRead(dpy, (char *)dev->classes, dlen);
 	/* could be padding that we still need to eat (yummy!) */
 	if (rlen - dlen > 0)
 	    _XEatData(dpy, (unsigned long)rlen - dlen);
     } else
 	_XEatData(dpy, (unsigned long)rlen);

 @@ -19,26 +19,27 @@
  * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
  * DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
  * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
  * OF THIS SOFTWARE.
+ *
  * Author:  Jim Gettys, HP Labs, HP.
  * Author:  Keith Packard, Intel Corporation
  */
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 #endif
 #include <limits.h>
 #include <stdio.h>
 #include <X11/Xlib.h>
 /* we need to be able to manipulate the Display structure on events */
 #include <X11/Xlibint.h>
 #include <X11/extensions/render.h>
 #include <X11/extensions/Xrender.h>
 #include "Xrandrint.h"
 static XRRScreenConfiguration *_XRRGetScreenInfo (Display *dpy,
 						  XExtDisplayInfo *info,
 						  Window window);
 Rotation XRRConfigRotations(XRRScreenConfiguration *config, Rotation *current_rotation)
 @@ -263,42 +264,52 @@ static XRRScreenConfiguration *_XRRGetSc
 	xrri->minor_version = async_state.minor_version;
 	xrri->has_rates = _XRRHasRates (xrri->minor_version, xrri->major_version);
+    }
     /*
      * Make the reply compatible with v1.1
      */
     if (!xrri->has_rates)
+    {
 	rep.rate = 0;
 	rep.nrateEnts = 0;
+    }
-    nbytes = (long) rep.length << 2;
+    if (rep.length < INT_MAX >> 2) {
 	nbytes = (long) rep.length << 2;
 	nbytesRead = (long) (rep.nSizes * SIZEOF (xScreenSizes) +
 			    ((rep.nrateEnts + 1)& ~1) * 2 /* SIZEOF(CARD16) */);
     nbytesRead = (long) (rep.nSizes * SIZEOF (xScreenSizes) +
 			 ((rep.nrateEnts + 1)& ~1) * 2 /* SIZEOF (CARD16) */);
 	/*
-    /*
+	 * first we must compute how much space to allocate for
-     * first we must compute how much space to allocate for
+	 * randr library's use; we'll allocate the structures in a single
-     * randr library's use; we'll allocate the structures in a single
+	 * allocation, on cleanlyness grounds.
-     * allocation, on cleanlyness grounds.
+	 */
      */
 	rbytes = sizeof (XRRScreenConfiguration) +
-    rbytes = sizeof (XRRScreenConfiguration) +
+	  (rep.nSizes * sizeof (XRRScreenSize) +
-      (rep.nSizes * sizeof (XRRScreenSize) +
+	   rep.nrateEnts * sizeof (int));
        rep.nrateEnts * sizeof (int));
-    scp = (struct _XRRScreenConfiguration *) Xmalloc(rbytes);
+	scp = (struct _XRRScreenConfiguration *) Xmalloc(rbytes);
     } else {
 	nbytes = 0;
 	nbytesRead = 0;
 	rbytes = 0;
 	scp = NULL;
+    }
     if (scp == NULL) {
 	_XEatData (dpy, (unsigned long) nbytes);
 	return NULL;
+    }
     ssp = (XRRScreenSize *)(scp + 1);
     rates = (short *) (ssp + rep.nSizes);
     /* set up the screen configuration structure */
     scp->screen =
       ScreenOfDisplay (dpy, XRRRootToScreen(dpy, rep.root));

 @@ -14,26 +14,27 @@
  * THE COPYRIGHT HOLDERS DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
  * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
  * EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE FOR ANY SPECIAL, INDIRECT OR
  * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
  * DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
  * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
  * OF THIS SOFTWARE.
  */
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 #endif
 #include <limits.h>
 #include <stdio.h>
 #include <X11/Xlib.h>
 /* we need to be able to manipulate the Display structure on events */
 #include <X11/Xlibint.h>
 #include <X11/extensions/render.h>
 #include <X11/extensions/Xrender.h>
 #include "Xrandrint.h"
 XRRCrtcInfo *
 XRRGetCrtcInfo (Display *dpy, XRRScreenResources *resources, RRCrtc crtc)
+{
     XExtDisplayInfo	    *info = XRRFindDisplay(dpy);
     xRRGetCrtcInfoReply	    rep;
 @@ -47,42 +48,53 @@ XRRGetCrtcInfo (Display *dpy, XRRScreenR
     GetReq (RRGetCrtcInfo, req);
     req->reqType = info->codes->major_opcode;
     req->randrReqType = X_RRGetCrtcInfo;
     req->crtc = crtc;
     req->configTimestamp = resources->configTimestamp;
     if (!_XReply (dpy, (xReply *) &rep, 0, xFalse))
+    {
 	UnlockDisplay (dpy);
 	SyncHandle ();
 	return NULL;
+    }
-    nbytes = (long) rep.length << 2;
+    if (rep.length < INT_MAX >> 2)
+    {
 	nbytes = (long) rep.length << 2;
-    nbytesRead = (long) (rep.nOutput * 4 +
+	nbytesRead = (long) (rep.nOutput * 4 +
-			 rep.nPossibleOutput * 4);
+			     rep.nPossibleOutput * 4);
-    /*
+	/*
-     * first we must compute how much space to allocate for
+	* first we must compute how much space to allocate for
-     * randr library's use; we'll allocate the structures in a single
+	* randr library's use; we'll allocate the structures in a single
-     * allocation, on cleanlyness grounds.
+	* allocation, on cleanlyness grounds.
-     */
+	*/
 	rbytes = (sizeof (XRRCrtcInfo) +
 		  rep.nOutput * sizeof (RROutput) +
 		  rep.nPossibleOutput * sizeof (RROutput));
-    rbytes = (sizeof (XRRCrtcInfo) +
+	xci = (XRRCrtcInfo *) Xmalloc(rbytes);
 	      rep.nOutput * sizeof (RROutput) +
-	      rep.nPossibleOutput * sizeof (RROutput));
+    else
+    {
 	nbytes = 0;
 	nbytesRead = 0;
 	rbytes = 0;
 	xci = NULL;
+    }
     xci = (XRRCrtcInfo *) Xmalloc(rbytes);
     if (xci == NULL) {
 	_XEatData (dpy, (unsigned long) nbytes);
 	UnlockDisplay (dpy);
 	SyncHandle ();
 	return NULL;
+    }
     xci->timestamp = rep.timestamp;
     xci->x = rep.x;
     xci->y = rep.y;
     xci->width = rep.width;
     xci->height = rep.height;
     xci->mode = rep.mode;
 @@ -184,32 +196,41 @@ XRRGetCrtcGamma (Display *dpy, RRCrtc cr
     long    		    nbytesRead;
     RRCheckExtension (dpy, info, NULL);
     LockDisplay(dpy);
     GetReq (RRGetCrtcGamma, req);
     req->reqType = info->codes->major_opcode;
     req->randrReqType = X_RRGetCrtcGamma;
     req->crtc = crtc;
     if (!_XReply (dpy, (xReply *) &rep, 0, xFalse))
 	goto out;
-    nbytes = (long) rep.length << 2;
+    if (rep.length < INT_MAX >> 2)
+    {
 	nbytes = (long) rep.length << 2;
-    /* three channels of CARD16 data */
+	/* three channels of CARD16 data */
-    nbytesRead = (rep.size * 2 * 3);
+	nbytesRead = (rep.size * 2 * 3);
-    crtc_gamma = XRRAllocGamma (rep.size);
+	crtc_gamma = XRRAllocGamma (rep.size);
+    }
     else
+    {
 	nbytes = 0;
 	nbytesRead = 0;
 	crtc_gamma = NULL;
+    }
     if (!crtc_gamma)
+    {
 	_XEatData (dpy, (unsigned long) nbytes);
 	goto out;
+    }
     _XRead16 (dpy, crtc_gamma->red, rep.size * 2);
     _XRead16 (dpy, crtc_gamma->green, rep.size * 2);
     _XRead16 (dpy, crtc_gamma->blue, rep.size * 2);
     if (nbytes > nbytesRead)
 	_XEatData (dpy, (unsigned long) (nbytes - nbytesRead));
 @@ -347,27 +368,27 @@ _XRRHasTransform (int major, int minor)
     return major > 1 || (major == 1 && minor >= 3);
+}
 Status
 XRRGetCrtcTransform (Display	*dpy,
 		     RRCrtc	crtc,
 		     XRRCrtcTransformAttributes **attributes)
+{
     XExtDisplayInfo		*info = XRRFindDisplay(dpy);
     xRRGetCrtcTransformReply	rep;
     xRRGetCrtcTransformReq	*req;
     int				major_version, minor_version;
     XRRCrtcTransformAttributes	*attr;
-    char			*extra = NULL, *e;
+    char			*extra = NULL, *end = NULL, *e;
     int				p;
     *attributes = NULL;
     RRCheckExtension (dpy, info, False);
     if (!XRRQueryVersion (dpy, &major_version, &minor_version) ||
 	!_XRRHasTransform (major_version, minor_version))
+    {
 	/* For pre-1.3 servers, just report identity matrices everywhere */
 	rep.pendingTransform = identity;
 	rep.pendingNbytesFilter = 0;
 	rep.pendingNparamsFilter = 0;
 @@ -385,29 +406,33 @@ XRRGetCrtcTransform (Display	*dpy,
 	if (!_XReply (dpy, (xReply *) &rep, CrtcTransformExtra >> 2, xFalse))
+	{
 	    rep.pendingTransform = identity;
 	    rep.pendingNbytesFilter = 0;
 	    rep.pendingNparamsFilter = 0;
 	    rep.currentTransform = identity;
 	    rep.currentNbytesFilter = 0;
 	    rep.currentNparamsFilter = 0;
+	}
 	else
+	{
 	    int extraBytes = rep.length * 4 - CrtcTransformExtra;
-	    extra = Xmalloc (extraBytes);
+	    if (rep.length < INT_MAX / 4 &&
 		rep.length * 4 >= CrtcTransformExtra) {
 		extra = Xmalloc (extraBytes);
 		end = extra + extraBytes;
 	    } else
 		extra = NULL;
 	    if (!extra) {
 		_XEatData (dpy, extraBytes);
 		UnlockDisplay (dpy);
 		SyncHandle ();
 		return False;
+	    }
 	    _XRead (dpy, extra, extraBytes);
+	}
 	UnlockDisplay (dpy);
 	SyncHandle ();
+    }
     attr = Xmalloc (sizeof (XRRCrtcTransformAttributes) +
 		    rep.pendingNparamsFilter * sizeof (XFixed) +
 @@ -419,42 +444,58 @@ XRRGetCrtcTransform (Display	*dpy,
 	XFree (extra);
 	return False;
+    }
     XTransform_from_xRenderTransform (&attr->pendingTransform, &rep.pendingTransform);
     XTransform_from_xRenderTransform (&attr->currentTransform, &rep.currentTransform);
     attr->pendingParams = (XFixed *) (attr + 1);
     attr->currentParams = attr->pendingParams + rep.pendingNparamsFilter;
     attr->pendingFilter = (char *) (attr->currentParams + rep.currentNparamsFilter);
     attr->currentFilter = attr->pendingFilter + rep.pendingNbytesFilter + 1;
     e = extra;
     if (e + rep.pendingNbytesFilter > end) {
 	XFree (extra);
 	return False;
+    }
     memcpy (attr->pendingFilter, e, rep.pendingNbytesFilter);
     attr->pendingFilter[rep.pendingNbytesFilter] = '\0';
     e += (rep.pendingNbytesFilter + 3) & ~3;
     for (p = 0; p < rep.pendingNparamsFilter; p++) {
 	INT32	f;
 	if (e + 4 > end) {
 	    XFree (extra);
 	    return False;
+	}
 	memcpy (&f, e, 4);
 	e += 4;
 	attr->pendingParams[p] = (XFixed) f;
+    }
     attr->pendingNparams = rep.pendingNparamsFilter;
     if (e + rep.currentNbytesFilter > end) {
 	XFree (extra);
 	return False;
+    }
     memcpy (attr->currentFilter, e, rep.currentNbytesFilter);
     attr->currentFilter[rep.currentNbytesFilter] = '\0';
     e += (rep.currentNbytesFilter + 3) & ~3;
     for (p = 0; p < rep.currentNparamsFilter; p++) {
 	INT32	f;
 	if (e + 4 > end) {
 	    XFree (extra);
 	    return False;
+	}
 	memcpy (&f, e, 4);
 	e += 4;
 	attr->currentParams[p] = (XFixed) f;
+    }
     attr->currentNparams = rep.currentNparamsFilter;
     if (extra)
 	XFree (extra);
     *attributes = attr;
     return True;
+}

 @@ -15,26 +15,27 @@
  * THE COPYRIGHT HOLDERS DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
  * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
  * EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE FOR ANY SPECIAL, INDIRECT OR
  * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
  * DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
  * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
  * OF THIS SOFTWARE.
  */
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 #endif
 #include <limits.h>
 #include <stdio.h>
 #include <X11/Xlib.h>
 /* we need to be able to manipulate the Display structure on events */
 #include <X11/Xlibint.h>
 #include <X11/extensions/render.h>
 #include <X11/extensions/Xrender.h>
 #include "Xrandrint.h"
 #define OutputInfoExtra	(SIZEOF(xRRGetOutputInfoReply) - 32)
 XRROutputInfo *
 XRRGetOutputInfo (Display *dpy, XRRScreenResources *resources, RROutput output)
+{
 @@ -50,26 +51,32 @@ XRRGetOutputInfo (Display *dpy, XRRScree
     GetReq (RRGetOutputInfo, req);
     req->reqType = info->codes->major_opcode;
     req->randrReqType = X_RRGetOutputInfo;
     req->output = output;
     req->configTimestamp = resources->configTimestamp;
     if (!_XReply (dpy, (xReply *) &rep, OutputInfoExtra >> 2, xFalse))
+    {
 	UnlockDisplay (dpy);
 	SyncHandle ();
 	return NULL;
+    }
     if (rep.length > INT_MAX >> 2 || rep.length < (OutputInfoExtra >> 2))
+    {
 	UnlockDisplay (dpy);
 	SyncHandle ();
 	return NULL;
+    }
     nbytes = ((long) (rep.length) << 2) - OutputInfoExtra;
     nbytesRead = (long) (rep.nCrtcs * 4 +
 			 rep.nModes * 4 +
 			 rep.nClones * 4 +
 			 ((rep.nameLength + 3) & ~3));
     /*
      * first we must compute how much space to allocate for
      * randr library's use; we'll allocate the structures in a single
      * allocation, on cleanlyness grounds.
      */

 @@ -14,26 +14,27 @@
  * THE COPYRIGHT HOLDERS DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
  * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
  * EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE FOR ANY SPECIAL, INDIRECT OR
  * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
  * DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
  * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
  * OF THIS SOFTWARE.
  */
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 #endif
 #include <limits.h>
 #include <stdio.h>
 #include <X11/Xlib.h>
 /* we need to be able to manipulate the Display structure on events */
 #include <X11/Xlibint.h>
 #include <X11/extensions/render.h>
 #include <X11/extensions/Xrender.h>
 #include "Xrandrint.h"
 /*
  * this is cheating on the knowledge that the two requests are identical
  * but for the request number.
  */
 static XRRScreenResources *
 @@ -95,47 +96,56 @@ doGetScreenResources (Display *dpy, Wind
+    {
 	DeqAsyncHandler (dpy, &async);
 	if (async_state.error)
+	{
 	    UnlockDisplay (dpy);
 	    SyncHandle();
 	    LockDisplay (dpy);
+	}
 	xrri->major_version = async_state.major_version;
 	xrri->minor_version = async_state.minor_version;
 	xrri->has_rates = _XRRHasRates (xrri->minor_version, xrri->major_version);
+    }
-    nbytes = (long) rep.length << 2;
+    if (rep.length < INT_MAX >> 2) {
 	nbytes = (long) rep.length << 2;
     nbytesRead = (long) (rep.nCrtcs * 4 +
 			 rep.nOutputs * 4 +
 			 rep.nModes * SIZEOF (xRRModeInfo) +
 			 ((rep.nbytesNames + 3) & ~3));
-    /*
+	/*
-     * first we must compute how much space to allocate for
+	 * first we must compute how much space to allocate for
-     * randr library's use; we'll allocate the structures in a single
+	 * randr library's use; we'll allocate the structures in a single
-     * allocation, on cleanlyness grounds.
+	 * allocation, on cleanlyness grounds.
-     */
+	 */
-    rbytes = (sizeof (XRRScreenResources) +
+	rbytes = (sizeof (XRRScreenResources) +
-	      rep.nCrtcs * sizeof (RRCrtc) +
+		  rep.nCrtcs * sizeof (RRCrtc) +
-	      rep.nOutputs * sizeof (RROutput) +
+		  rep.nOutputs * sizeof (RROutput) +
-	      rep.nModes * sizeof (XRRModeInfo) +
+		  rep.nModes * sizeof (XRRModeInfo) +
-	      rep.nbytesNames + rep.nModes);	/* '\0' terminate names */
+		  rep.nbytesNames + rep.nModes);    /* '\0' terminate names */
 	xrsr = (XRRScreenResources *) Xmalloc(rbytes);
 	wire_names = (char *) Xmalloc (rep.nbytesNames);
     } else {
 	nbytes = 0;
 	nbytesRead = 0;
 	rbytes = 0;
 	xrsr = NULL;
 	wire_names = NULL;
+    }
     xrsr = (XRRScreenResources *) Xmalloc(rbytes);
     wire_names = (char *) Xmalloc (rep.nbytesNames);
     if (xrsr == NULL || wire_names == NULL) {
 	if (xrsr) Xfree (xrsr);
 	if (wire_names) Xfree (wire_names);
 	_XEatData (dpy, (unsigned long) nbytes);
 	UnlockDisplay (dpy);
 	SyncHandle ();
 	return NULL;
+    }
     xrsr->timestamp = rep.timestamp;
     xrsr->configTimestamp = rep.configTimestamp;
     xrsr->ncrtc = rep.nCrtcs;
     xrsr->crtcs = (RRCrtc *) (xrsr + 1);
 @@ -164,26 +174,34 @@ doGetScreenResources (Display *dpy, Wind
 	xrsr->modes[i].vSyncEnd = modeInfo.vSyncEnd;
 	xrsr->modes[i].vTotal = modeInfo.vTotal;
 	xrsr->modes[i].nameLength = modeInfo.nameLength;
 	xrsr->modes[i].modeFlags = modeInfo.modeFlags;
+    }
     /*
      * Read names and '\0' pad each one
      */
     _XReadPad (dpy, wire_names, rep.nbytesNames);
     wire_name = wire_names;
     for (i = 0; i < rep.nModes; i++)  {
 	xrsr->modes[i].name = names;
 	if (xrsr->modes[i].nameLength > rep.nbytesNames) {
 	    Xfree (xrsr);
 	    Xfree (wire_names);
 	    UnlockDisplay (dpy);
 	    SyncHandle ();
 	    return NULL;
+	}
 	rep.nbytesNames -= xrsr->modes[i].nameLength;
 	memcpy (names, wire_name, xrsr->modes[i].nameLength);
 	names[xrsr->modes[i].nameLength] = '\0';
 	names += xrsr->modes[i].nameLength + 1;
 	wire_name += xrsr->modes[i].nameLength;
+    }
     Xfree (wire_names);
     /*
      * Skip any extra data
      */
     if (nbytes > nbytesRead)
 	_XEatData (dpy, (unsigned long) (nbytes - nbytesRead));

 @@ -28,27 +28,27 @@
 #include <limits.h>
 XFilters *
 XRenderQueryFilters (Display *dpy, Drawable drawable)
+{
     XRenderExtDisplayInfo		*info = XRenderFindDisplay (dpy);
     XRenderInfo			*xri;
     xRenderQueryFiltersReq	*req;
     xRenderQueryFiltersReply	rep;
     XFilters			*filters;
     char			*name;
     char			len;
     int				i;
-    unsigned long		nbytes, nbytesAlias, nbytesName;
+    unsigned long		nbytes, nbytesAlias, nbytesName, reply_left;
     if (!RenderHasExtension (info))
 	return NULL;
     if (!XRenderQueryFormats (dpy))
 	return NULL;
     xri = info->info;
     if (xri->minor_version < 6)
 	return NULL;
     LockDisplay (dpy);
     GetReq (RenderQueryFilters, req);
 @@ -104,37 +104,47 @@ XRenderQueryFilters (Display *dpy, Drawa
      *	nbytesName  char strings
      */
     filters->nfilter = rep.numFilters;
     filters->nalias = rep.numAliases;
     filters->filter = (char **) (filters + 1);
     filters->alias = (short *) (filters->filter + rep.numFilters);
     name = (char *) (filters->alias + rep.numAliases);
     /*
      * Read the filter aliases
      */
     _XRead16Pad (dpy, filters->alias, 2 * rep.numAliases);
     reply_left = 8 + rep.length - 2 * rep.numAliases;;
     /*
      * Read the filter names
      */
     for (i = 0; i < rep.numFilters; i++)
+    {
 	int	l;
 	_XRead (dpy, &len, 1);
 	reply_left--;
 	l = len & 0xff;
 	if ((unsigned long)l + 1 > nbytesName) {
 	    Xfree(filters);
 	    UnlockDisplay (dpy);
 	    SyncHandle ();
 	    return NULL;
+	}
 	nbytesName -= l + 1;
 	filters->filter[i] = name;
 	_XRead (dpy, name, l);
         reply_left -= l;
 	name[l] = '\0';
 	name += l + 1;
+    }
     i = name - (char *) (filters->alias + rep.numAliases);
     if (i & 3)
 	_XEatData (dpy, 4 - (i & 3));
     UnlockDisplay (dpy);
     SyncHandle ();
     return filters;
+}

 @@ -40,26 +40,27 @@ from The Open Group.
  * NETWORK COMPUTING DEVICES DISCLAIMs ALL WARRANTIES WITH REGARD TO
  * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
  * AND FITNESS, IN NO EVENT SHALL NETWORK COMPUTING DEVICES BE LIABLE
  * FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN
  * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
  * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  **************************************************************************/
 /*
  * By Stephen Gildea, X Consortium, and Martha Zimet, NCD.
  */
 #include <stdio.h>
 #include <limits.h>
 #include <assert.h>
 #include <X11/Xlibint.h>
 #include <X11/extensions/Xext.h>
 #include <X11/extensions/extutil.h>
 #include <X11/extensions/recordproto.h>
 #include <X11/extensions/record.h>
 static XExtensionInfo _xrecord_info_data;
 static XExtensionInfo *xrecord_info = &_xrecord_info_data;
 static /* const */ char *xrecord_extension_name = RECORD_NAME;
 #define XRecordCheckExtension(dpy,i,val) \
     XextCheckExtension(dpy, i, xrecord_extension_name, val)
 @@ -729,89 +730,118 @@ parse_reply_call_callback(
 	    return Error;
 	data->id_base = rep->idBase;
 	data->category = rep->category;
 	data->client_swapped = rep->clientSwapped;
 	data->server_time = rep->serverTime;
 	data->client_seq = rep->recordedSequenceNumber;
 	/*
 	 * compute the size of this protocol element.
 	 */
 	switch (rep->category) {
 	case XRecordFromServer:
 	    if (rep->elementHeader&XRecordFromServerTime) {
 		if (current_index + 4 > rep->length << 2)
 		    return Error;
 		EXTRACT_CARD32(rep->clientSwapped,
 			       reply->buf+current_index,
 			       data->server_time);
 		current_index += 4;
+	    }
 	    if (current_index + 1 > rep->length << 2)
 		return Error;
 	    switch (reply->buf[current_index]) {
 	    case X_Reply: /* reply */
 		if (current_index + 8 > rep->length << 2)
 		    return Error;
 		EXTRACT_CARD32(rep->clientSwapped,
 			       reply->buf+current_index+4, datum_bytes);
 		if (datum_bytes < 0 || datum_bytes > ((INT_MAX >> 2) - 8))
 		    return Error;
 		datum_bytes = (datum_bytes+8) << 2;
 		break;
 	    default: /* error or event */
 		datum_bytes = 32;
+	    }
 	    break;
 	case XRecordFromClient:
 	    if (rep->elementHeader&XRecordFromClientTime) {
 		if (current_index + 4 > rep->length << 2)
 		    return Error;
 		EXTRACT_CARD32(rep->clientSwapped,
 			       reply->buf+current_index,
 			       data->server_time);
 		current_index += 4;
+	    }
 	    if (rep->elementHeader&XRecordFromClientSequence) {
 		if (current_index + 4 > rep->length << 2)
 		    return Error;
 		EXTRACT_CARD32(rep->clientSwapped,
 			       reply->buf+current_index,
 			       data->client_seq);
 		current_index += 4;
+	    }
 	    if (current_index + 4 > rep->length<<2)
 		return Error;
 	    if (reply->buf[current_index+2] == 0
 		&& reply->buf[current_index+3] == 0) /* needn't swap 0 */
 	    {	/* BIG-REQUESTS */
 		if (current_index + 8 > rep->length << 2)
 		    return Error;
 		EXTRACT_CARD32(rep->clientSwapped,
 			       reply->buf+current_index+4, datum_bytes);
 	    } else {
 		EXTRACT_CARD16(rep->clientSwapped,
 			       reply->buf+current_index+2, datum_bytes);
+	    }
 	    if (datum_bytes < 0 || datum_bytes > INT_MAX >> 2)
 		return Error;
 	    datum_bytes <<= 2;
 	    break;
 	case XRecordClientStarted:
 	    if (current_index + 8 > rep->length << 2)
 		return Error;
 	    EXTRACT_CARD16(rep->clientSwapped,
 			   reply->buf+current_index+6, datum_bytes);
 	    datum_bytes = (datum_bytes+2) << 2;
 	    break;
 	case XRecordClientDied:
 	    if (rep->elementHeader&XRecordFromClientSequence) {
 		if (current_index + 4 > rep->length << 2)
 		    return Error;
 		EXTRACT_CARD32(rep->clientSwapped,
 			       reply->buf+current_index,
 			       data->client_seq);
 		current_index += 4;
 	    } else if (current_index < rep->length << 2)
-	    /* fall through */
+		return Error;
 	    datum_bytes = 0;
 	    break;
 	case XRecordStartOfData:
 	case XRecordEndOfData:
 	    if (current_index < rep->length << 2)
 		return Error;
 	    datum_bytes = 0;
 	    break;
+	}
 	if (datum_bytes > 0) {
-	    if (current_index + datum_bytes > rep->length << 2)
+	    if (INT_MAX - datum_bytes < (rep->length << 2) - current_index) {
 		fprintf(stderr,
 			"XRecord: %lu-byte reply claims %d-byte element (seq %lu)\n",
-			(long)rep->length << 2, current_index + datum_bytes,
+			(unsigned long)rep->length << 2, current_index + datum_bytes,
 			dpy->last_request_read);
 		return Error;
+	    }
 	    /*
 	     * This assignment (and indeed the whole buffer sharing
 	     * scheme) assumes arbitrary 4-byte boundaries are
 	     * addressable.
 	     */
 	    data->data = reply->buf+current_index;
 	    reply->ref_count++;
 	} else {
 	    data->data = NULL;
+	}
 	data->data_len = datum_bytes >> 2;
 	(*callback)(closure, data);
 @@ -843,26 +873,32 @@ XRecordEnableContext(Display *dpy, XReco
     req->recordReqType = X_RecordEnableContext;
     req->context = context;
     while (1)
+    {
 	/* This code should match that in XRecordEnableContextAsync */
 	if (!_XReply (dpy, (xReply *)&rep, 0, xFalse))
+	{
 	    UnlockDisplay(dpy);
 	    SyncHandle();
 	    return 0;
+	}
 	if (rep.length > INT_MAX >> 2) {
 	    UnlockDisplay(dpy);
 	    SyncHandle();
 	    return 0;
+	}
 	if (rep.length > 0) {
 	    reply = alloc_reply_buffer(info, rep.length<<2);
 	    if (!reply) {
 		UnlockDisplay(dpy);
 		SyncHandle();
 		return 0;
+	    }
 	    _XRead (dpy, (char *)reply->buf, rep.length<<2);
 	} else {
 	    reply = NULL;
+	}
 	status = parse_reply_call_callback(dpy, info, &rep, reply,

 @@ -142,61 +142,66 @@ XvQueryExtension(
 int
 XvQueryAdaptors(
      Display *dpy,
      Window window,
      unsigned int *p_nAdaptors,
      XvAdaptorInfo **p_pAdaptors
 ){
   XExtDisplayInfo *info = xv_find_display(dpy);
   xvQueryAdaptorsReq *req;
   xvQueryAdaptorsReply rep;
   int size,ii,jj;
   char *name;
   char *end;
   XvAdaptorInfo *pas, *pa;
   XvFormat *pfs, *pf;
   char *buffer;
   int status;
   union
+    {
       char *buffer;
       char *string;
       xvAdaptorInfo *pa;
       xvFormat *pf;
     } u;
   XvCheckExtension(dpy, info, XvBadExtension);
   LockDisplay(dpy);
   XvGetReq(QueryAdaptors, req);
   req->window = window;
   /* READ THE REPLY */
   if (_XReply(dpy, (xReply *)&rep, 0, xFalse) == 0) {
       UnlockDisplay(dpy);
       SyncHandle();
       return(XvBadReply);
+  }
   size = rep.length << 2;
-  if ( (buffer = (char *)Xmalloc ((unsigned) size)) == NULL) {
+  if (size > 0) {
     if ((buffer = Xmalloc(size)) == NULL) {
       UnlockDisplay(dpy);
       SyncHandle();
       return(XvBadAlloc);
+    }
     _XRead(dpy, buffer, (long) size);
+  }
   _XRead (dpy, buffer, size);
   u.buffer = buffer;
   end = buffer + size;
   /* GET INPUT ADAPTORS */
   if (rep.num_adaptors == 0) {
       pas = NULL;
   } else {
       size = rep.num_adaptors*sizeof(XvAdaptorInfo);
       if ((pas=(XvAdaptorInfo *)Xmalloc(size))==NULL) {
           Xfree(buffer);
           UnlockDisplay(dpy);
           SyncHandle();
           return(XvBadAlloc);
+      }
 @@ -204,37 +209,46 @@ XvQueryAdaptors(
   /* INIT ADAPTOR FIELDS */
   pa = pas;
   for (ii=0; ii<rep.num_adaptors; ii++) {
       pa->num_adaptors = 0;
       pa->name = (char *)NULL;
       pa->formats = (XvFormat *)NULL;
       pa++;
+  }
   pa = pas;
   for (ii=0; ii<rep.num_adaptors; ii++) {
       if (u.buffer + sz_xvAdaptorInfo > end) {
         status = XvBadReply;
         goto out;
+      }
       pa->type = u.pa->type;
       pa->base_id = u.pa->base_id;
       pa->num_ports = u.pa->num_ports;
       pa->num_formats = u.pa->num_formats;
       pa->num_adaptors = rep.num_adaptors - ii;
       /* GET ADAPTOR NAME */
       size = u.pa->name_size;
       u.buffer += (sz_xvAdaptorInfo + 3) & ~3;
       if (u.buffer + size > end) {
         status = XvBadReply;
         goto out;
+      }
       if ( (name = (char *)Xmalloc(size+1)) == NULL)
+	{
 	  XvFreeAdaptorInfo(pas);
 	  Xfree(buffer);
           UnlockDisplay(dpy);
           SyncHandle();
 	  return(XvBadAlloc);
+	}
       (void)strncpy(name, u.string, size);
       name[size] = '\0';
       pa->name = name;
       u.buffer += (size + 3) & ~3;
 @@ -242,47 +256,55 @@ XvQueryAdaptors(
       /* GET FORMATS */
       size = pa->num_formats*sizeof(XvFormat);
       if ((pfs=(XvFormat *)Xmalloc(size))==NULL) {
 	  XvFreeAdaptorInfo(pas);
 	  Xfree(buffer);
           UnlockDisplay(dpy);
           SyncHandle();
 	  return(XvBadAlloc);
+      }
       pf = pfs;
       for (jj=0; jj<pa->num_formats; jj++) {
           if (u.buffer + sz_xvFormat > end) {
             Xfree(pfs);
             status = XvBadReply;
             goto out;
+          }
 	  pf->depth = u.pf->depth;
 	  pf->visual_id = u.pf->visual;
 	  pf++;
 	  u.buffer += (sz_xvFormat + 3) & ~3;
+      }
       pa->formats = pfs;
       pa++;
+  }
   *p_nAdaptors = rep.num_adaptors;
   *p_pAdaptors = pas;
   status = Success;
 out:
   Xfree(buffer);
   UnlockDisplay(dpy);
   SyncHandle();
-  return (Success);
+  return (status);
+}
 void
 XvFreeAdaptorInfo(XvAdaptorInfo *pAdaptors)
+{
   XvAdaptorInfo *pa;
   int ii;
   if (!pAdaptors) return;
   pa = pAdaptors;
 @@ -304,114 +326,130 @@ XvFreeAdaptorInfo(XvAdaptorInfo *pAdapto
 int
 XvQueryEncodings(
      Display *dpy,
      XvPortID port,
      unsigned int *p_nEncodings,
      XvEncodingInfo **p_pEncodings
 ){
   XExtDisplayInfo *info = xv_find_display(dpy);
   xvQueryEncodingsReq *req;
   xvQueryEncodingsReply rep;
   int size, jj;
   char *name;
   char *end;
   int status;
   XvEncodingInfo *pes, *pe;
   char *buffer;
   union
+    {
       char *buffer;
       char *string;
       xvEncodingInfo *pe;
     } u;
   XvCheckExtension(dpy, info, XvBadExtension);
   LockDisplay(dpy);
   XvGetReq(QueryEncodings, req);
   req->port = port;
   /* READ THE REPLY */
   if (_XReply(dpy, (xReply *)&rep, 0, xFalse) == 0) {
       UnlockDisplay(dpy);
       SyncHandle();
       return(XvBadReply);
+  }
   size = rep.length << 2;
-  if ( (buffer = (char *)Xmalloc ((unsigned) size)) == NULL) {
+  if (size > 0) {
     if ( (buffer = (char *)Xmalloc ((unsigned) size)) == NULL) {
       UnlockDisplay(dpy);
       SyncHandle();
       return(XvBadAlloc);
+    }
     _XRead (dpy, buffer, size);
+  }
   _XRead (dpy, buffer, size);
   u.buffer = buffer;
   end = buffer + size;
   /* GET ENCODINGS */
   size = rep.num_encodings*sizeof(XvEncodingInfo);
   if ( (pes = (XvEncodingInfo *)Xmalloc(size)) == NULL) {
       Xfree(buffer);
       UnlockDisplay(dpy);
       SyncHandle();
       return(XvBadAlloc);
+  }
   /* INITIALIZE THE ENCODING POINTER */
   pe = pes;
   for (jj=0; jj<rep.num_encodings; jj++) {
       pe->name = (char *)NULL;
       pe->num_encodings = 0;
       pe++;
+  }
   pe = pes;
   for (jj=0; jj<rep.num_encodings; jj++) {
       if (u.buffer + sz_xvEncodingInfo > end) {
         status = XvBadReply;
         goto out;
+      }
       pe->encoding_id = u.pe->encoding;
       pe->width = u.pe->width;
       pe->height = u.pe->height;
       pe->rate.numerator = u.pe->rate.numerator;
       pe->rate.denominator = u.pe->rate.denominator;
       pe->num_encodings = rep.num_encodings - jj;
       size = u.pe->name_size;
       u.buffer += (sz_xvEncodingInfo + 3) & ~3;
       if (u.buffer + size > end) {
         status = XvBadReply;
         goto out;
+      }
       if ( (name = (char *)Xmalloc(size+1)) == NULL) {
 	  XvFreeEncodingInfo(pes);
 	  Xfree(buffer);
           UnlockDisplay(dpy);
           SyncHandle();
 	  return(XvBadAlloc);
+      }
       strncpy(name, u.string, size);
       name[size] = '\0';
       pe->name = name;
       pe++;
       u.buffer += (size + 3) & ~3;
+  }
   *p_nEncodings = rep.num_encodings;
   *p_pEncodings = pes;
   status = Success;
 out:
   Xfree(buffer);
   UnlockDisplay(dpy);
   SyncHandle();
-  return (Success);
+  return (status);
+}
 void
 XvFreeEncodingInfo(XvEncodingInfo *pEncodings)
+{
   XvEncodingInfo *pe;
   int ii;
   if (!pEncodings) return;
   pe = pEncodings;

 @@ -540,27 +540,27 @@ extern LockInfoPtr _Xglobal_lock;
  * MakeBigReq sets the CARD16 "req->length" to 0 and inserts a new CARD32
  * length, after req->length, before the data in the request.  The new length
  * includes the "n" extra 32-bit words.
+ *
  * Do not use MakeBigReq if there is no data already in the request.
  * req->length must already be >= 2.
  */
 #define MakeBigReq(req,n) \
     { \
     char _BRdat[4]; \
     unsigned long _BRlen = req->length - 1; \
     req->length = 0; \
     memcpy(_BRdat, ((char *)req) + (_BRlen << 2), 4); \
-    memmove(((char *)req) + 8, ((char *)req) + 4, _BRlen << 2); \
+    memmove(((char *)req) + 8, ((char *)req) + 4, (_BRlen - 1) << 2); \
     memcpy(((char *)req) + 4, _BRdat, 4); \
     Data32(dpy, (long *)&_BRdat, 4); \
+    }
 #else
 #ifdef LONG64
 #define MakeBigReq(req,n) \
     { \
     CARD64 _BRdat; \
     CARD32 _BRlen = req->length - 1; \
     req->length = 0; \
     _BRdat = ((CARD32 *)req)[_BRlen]; \
     memmove(((char *)req) + 8, ((char *)req) + 4, (_BRlen - 1) << 2); \
     ((CARD32 *)req)[1] = _BRlen + n + 2; \

 @@ -101,27 +101,28 @@ XGetDeviceMotionEvents(
 	UnlockDisplay(dpy);
 	SyncHandle();
 	return (NULL);
+    }
     if (rep.length < (INT_MAX >> 2)) {
 	size = rep.length << 2;
 	savp = readp = Xmalloc(size);
     } else {
 	size = 0;
 	savp = readp = NULL;
+    }
     /* rep.axes is a CARD8, so assume max number of axes for bounds check */
     if (rep.nEvents <
-	(INT_MAX / (sizeof(XDeviceTimeCoord) + (UCHAR_MAX * sizeof(int))))) {
+	(INT_MAX / (sizeof(XDeviceTimeCoord) + (UCHAR_MAX * sizeof(int)))) &&
 	rep.nEvents * (rep.axes + 1) <= rep.length) {
 	size_t bsize = rep.nEvents *
 	    (sizeof(XDeviceTimeCoord) + (rep.axes * sizeof(int)));
 	bufp = Xmalloc(bsize);
     } else
 	bufp = NULL;
     if (!bufp || !savp) {
 	Xfree(bufp);
 	Xfree(savp);
 	*nEvents = 0;
 	_XEatData(dpy, (unsigned long)size);
 	UnlockDisplay(dpy);
 	SyncHandle();
 	return (NULL);

 @@ -78,27 +78,28 @@ XGetDeviceButtonMapping(
     xGetDeviceButtonMappingReply rep;
     LockDisplay(dpy);
     if (_XiCheckExtInit(dpy, XInput_Initial_Release, info) == -1)
 	return (NoSuchExtension);
     GetReq(GetDeviceButtonMapping, req);
     req->reqType = info->codes->major_opcode;
     req->ReqType = X_GetDeviceButtonMapping;
     req->deviceid = device->device_id;
     status = _XReply(dpy, (xReply *) & rep, 0, xFalse);
     if (status == 1) {
-	if (rep.length <= (sizeof(mapping) >> 2)) {
+	if (rep.length <= (sizeof(mapping) >> 2) &&
 	    rep.nElts <= (rep.length << 2)) {
 	    unsigned long nbytes = rep.length << 2;
 	    _XRead(dpy, (char *)mapping, nbytes);
 	    /* don't return more data than the user asked for. */
 	    if (rep.nElts)
 		memcpy(map, mapping, MIN((int)rep.nElts, nmap));
 	    status = rep.nElts;
 	} else {
 	    _XEatData(dpy, rep.length << 2);
 	    status = 0;
+	}
     } else
 	status = 0;

 @@ -522,32 +522,48 @@ XRenderQueryFormats (Display *dpy)
 	xFormat++;
+    }
     xScreen = (xPictScreen *) xFormat;
     screen = xri->screen;
     depth = xri->depth;
     visual = xri->visual;
     for (ns = 0; ns < xri->nscreen; ns++)
+    {
 	screen->depths = depth;
 	screen->ndepths = xScreen->nDepth;
 	screen->fallback = _XRenderFindFormat (xri, xScreen->fallback);
 	screen->subpixel = SubPixelUnknown;
 	xDepth = (xPictDepth *) (xScreen + 1);
 	if (screen->ndepths > rep.numDepths) {
 	    Xfree (xri);
 	    Xfree (xData);
 	    UnlockDisplay (dpy);
 	    SyncHandle ();
 	    return 0;
+	}
 	rep.numDepths -= screen->ndepths;
 	for (nd = 0; nd < screen->ndepths; nd++)
+	{
 	    depth->depth = xDepth->depth;
 	    depth->nvisuals = xDepth->nPictVisuals;
 	    depth->visuals = visual;
 	    xVisual = (xPictVisual *) (xDepth + 1);
 	    if (depth->nvisuals > rep.numVisuals) {
 		Xfree (xri);
 		Xfree (xData);
 		UnlockDisplay (dpy);
 		SyncHandle ();
 		return 0;
+	    }
 	    rep.numVisuals -= depth->nvisuals;
 	    for (nv = 0; nv < depth->nvisuals; nv++)
+	    {
 		visual->visual = _XRenderFindVisual (dpy, xVisual->visual);
 		visual->format = _XRenderFindFormat (xri, xVisual->format);
 		visual++;
 		xVisual++;
+	    }
 	    depth++;
 	    xDepth = (xPictDepth *) xVisual;
+	}
 	screen++;
 	xScreen = (xPictScreen *) xDepth;
+    }

 @@ -562,29 +562,29 @@ Status XvMCGetDRInfo(Display *dpy, XvPor
 	if (rep.length < (INT_MAX >> 2)) {
 	    realSize = rep.length << 2;
 	    if (realSize >= (rep.nameLen + rep.busIDLen)) {
 		tmpBuf = Xmalloc(realSize);
 		*name = Xmalloc(rep.nameLen);
 		*busID = Xmalloc(rep.busIDLen);
+	    }
+	}
 	if (*name && *busID && tmpBuf) {
 	    _XRead(dpy, tmpBuf, realSize);
 	    strncpy(*name,tmpBuf,rep.nameLen);
-	    name[rep.nameLen - 1] = '\0';
+	    (*name)[rep.nameLen == 0 ? 0 : rep.nameLen - 1] = '\0';
 	    strncpy(*busID,tmpBuf+rep.nameLen,rep.busIDLen);
-	    busID[rep.busIDLen - 1] = '\0';
+	    busID[rep.busIDLen == 0 ? 0 : rep.busIDLen - 1] = '\0';
 	    XFree(tmpBuf);
 	} else {
 	    XFree(*name);
 	    *name = NULL;
 	    XFree(*busID);
 	    *name = NULL;
 	    XFree(tmpBuf);
 	    _XEatData(dpy, realSize);
 	    UnlockDisplay (dpy);
 	    SyncHandle ();
 	    return -1;

 @@ -32,27 +32,28 @@ in this Software without prior written a
 XModifierKeymap *
 XGetModifierMapping(register Display *dpy)
+{
     xGetModifierMappingReply rep;
     register xReq *req;
     unsigned long nbytes;
     XModifierKeymap *res;
     LockDisplay(dpy);
     GetEmptyReq(GetModifierMapping, req);
     (void) _XReply (dpy, (xReply *)&rep, 0, xFalse);
-    if (rep.length < (LONG_MAX >> 2)) {
+    if (rep.length < (INT_MAX >> 2) &&
 	(rep.length >> 1) == rep.numKeyPerModifier) {
 	nbytes = (unsigned long)rep.length << 2;
 	res = Xmalloc(sizeof (XModifierKeymap));
 	if (res)
 	    res->modifiermap = Xmalloc (nbytes);
     } else
 	res = NULL;
     if ((! res) || (! res->modifiermap)) {
 	if (res) Xfree((char *) res);
 	res = (XModifierKeymap *) NULL;
 	_XEatData(dpy, rep.length << 2);
     } else {
 	_XReadPad(dpy, (char *) res->modifiermap, (long) nbytes);
 	res->max_keypermod = rep.numKeyPerModifier;