 @@ -19,89 +19,110 @@ OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMA
 AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
 CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 Except as contained in this notice, the name of The Open Group shall not be
 used in advertising or otherwise to promote the sale, use or other dealings
 in this Software without prior written authorization from The Open Group.
 */
 /* $XFree86: xc/lib/X11/FontNames.c,v 1.7 2003/11/17 22:20:06 dawes Exp $ */
 #define NEED_REPLIES
 #include "Xlibint.h"
 #include <limits.h>
 char **
 XListFonts(
 register Display *dpy,
 _Xconst char *pattern,  /* null-terminated */
 int maxNames,
 int *actualCount)	/* RETURN */
+{
     register long nbytes;
     register unsigned i;
     register int length;
     char **flist;
-    char *ch;
+    char *ch = NULL;
     char *chend;
     int count = 0;
     xListFontsReply rep;
     register xListFontsReq *req;
     register long rlen;
     LockDisplay(dpy);
     GetReq(ListFonts, req);
     req->maxNames = maxNames;
     nbytes = req->nbytes = pattern ? strlen (pattern) : 0;
     req->length += (nbytes + 3) >> 2;
     _XSend (dpy, pattern, nbytes);
     /* use _XSend instead of Data, since following _XReply will flush buffer */
     if (!_XReply (dpy, (xReply *)&rep, 0, xFalse)) {
 	*actualCount = 0;
 	UnlockDisplay(dpy);
 	SyncHandle();
 	return (char **) NULL;
+    }
     if (rep.nFonts) {
 	flist = (char **)Xmalloc ((unsigned)rep.nFonts * sizeof(char *));
-	rlen = rep.length << 2;
+	if (rep.length > 0 && rep.length < (INT_MAX >> 2)) {
-	ch = (char *) Xmalloc((unsigned) (rlen + 1));
+	    rlen = rep.length << 2;
-	    /* +1 to leave room for last null-terminator */
+	    ch = (char *) Xmalloc((unsigned) (rlen + 1));
 	        /* +1 to leave room for last null-terminator */
+	}
 	if ((! flist) || (! ch)) {
 	    if (flist) Xfree((char *) flist);
 	    if (ch) Xfree(ch);
 	    _XEatData(dpy, (unsigned long) rlen);
 	    *actualCount = 0;
 	    UnlockDisplay(dpy);
 	    SyncHandle();
 	    return (char **) NULL;
+	}
 	_XReadPad (dpy, ch, rlen);
 	/*
 	 * unpack into null terminated strings.
 	 */
 	chend = ch + (rlen + 1);
 	length = *(unsigned char *)ch;
 	*ch = 1; /* make sure it is non-zero for XFreeFontNames */
 	for (i = 0; i < rep.nFonts; i++) {
-	    flist[i] = ch + 1;  /* skip over length */
+	    if (ch + length < chend) {
-	    ch += length + 1;  /* find next length ... */
+	        flist[i] = ch + 1;  /* skip over length */
-	    length = *(unsigned char *)ch;
+	        ch += length + 1;  /* find next length ... */
-	    *ch = '\0';  /* and replace with null-termination */
+		if (ch <= chend) {
 		    length = *(unsigned char *)ch;
 		    *ch = '\0';  /* and replace with null-termination */
 		    count++;
 	        } else {
 		    Xfree(flist);
 		    flist = NULL;
 		    count = 0;
 		    break;
+		}
 	    } else {
 	       Xfree(flist);
 	       flist = NULL;
 	       count = 0;
 	       break;
+	    }
+	}
+    }
     else flist = (char **) NULL;
-    *actualCount = rep.nFonts;
+    *actualCount = count;
     UnlockDisplay(dpy);
     SyncHandle();
     return (flist);
+}
 int
 XFreeFontNames(list)
 char **list;
+{
 	if (list) {
 		if (!*(list[0]-1)) { /* from ListFontsWithInfo */
 			register char **names;
 			for (names = list+1; *names; names++)

 @@ -20,52 +20,54 @@ AN ACTION OF CONTRACT, TORT OR OTHERWISE
 CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 Except as contained in this notice, the name of The Open Group shall not be
 used in advertising or otherwise to promote the sale, use or other dealings
 in this Software without prior written authorization from The Open Group.
 */
 /* $XFree86: xc/lib/X11/GetImage.c,v 1.5 2003/04/13 19:22:16 dawes Exp $ */
 #define NEED_REPLIES
 #include "Xlibint.h"
 #include <X11/Xutil.h>		/* for XDestroyImage */
 #include "ImUtil.h"
 #include <limits.h>
 #define ROUNDUP(nbytes, pad) (((((nbytes) - 1) + (pad)) / (pad)) * (pad))
 static unsigned int Ones(                /* HACKMEM 169 */
     unsigned long mask)
+{
     register unsigned long y;
     y = (mask >> 1) &033333333333;
     y = mask - y - ((y >>1) & 033333333333);
     return ((unsigned int) (((y + (y >> 3)) & 030707070707) % 077));
+}
 XImage *XGetImage (dpy, d, x, y, width, height, plane_mask, format)
      register Display *dpy;
      Drawable d;
      int x, y;
      unsigned int width, height;
      unsigned long plane_mask;
      int format;	/* either XYPixmap or ZPixmap */
+{
 	xGetImageReply rep;
 	register xGetImageReq *req;
 	char *data;
 	long nbytes;
 	XImage *image;
 	int planes;
 	LockDisplay(dpy);
 	GetReq (GetImage, req);
 	/*
 	 * first set up the standard stuff in the request
 	 */
 	req->drawable = d;
 	req->x = x;
 	req->y = y;
 	req->width = width;
 	req->height = height;
 	req->planeMask = plane_mask;
 	req->format = format;
 @@ -75,38 +77,48 @@ XImage *XGetImage (dpy, d, x, y, width,
 		SyncHandle();
 		return (XImage *)NULL;
+	}
 	nbytes = (long)rep.length << 2;
 	data = (char *) Xmalloc((unsigned) nbytes);
 	if (! data) {
 	    _XEatData(dpy, (unsigned long) nbytes);
 	    UnlockDisplay(dpy);
 	    SyncHandle();
 	    return (XImage *) NULL;
+	}
         _XReadPad (dpy, data, nbytes);
-        if (format == XYPixmap)
+        if (format == XYPixmap) {
-	   image = XCreateImage(dpy, _XVIDtoVisual(dpy, rep.visual),
+	    image = XCreateImage(dpy, _XVIDtoVisual(dpy, rep.visual),
-		  Ones (plane_mask &
+		Ones (plane_mask &
-			(((unsigned long)0xFFFFFFFF) >> (32 - rep.depth))),
+		    (((unsigned long)0xFFFFFFFF) >> (32 - rep.depth))),
-		  format, 0, data, width, height, dpy->bitmap_pad, 0);
+		format, 0, data, width, height, dpy->bitmap_pad, 0);
-	else /* format == ZPixmap */
+	    planes = image->depth;
-           image = XCreateImage (dpy, _XVIDtoVisual(dpy, rep.visual),
+	} else { /* format == ZPixmap */
-		 rep.depth, ZPixmap, 0, data, width, height,
+            image = XCreateImage (dpy, _XVIDtoVisual(dpy, rep.visual),
-		  _XGetScanlinePad(dpy, (int) rep.depth), 0);
+		rep.depth, ZPixmap, 0, data, width, height,
 		    _XGetScanlinePad(dpy, (int) rep.depth), 0);
 	    planes = 1;
+	}
 	if (!image)
 	    Xfree(data);
 	if (planes < 1 || image->height < 1 || image->bytes_per_line < 1 ||
 	    INT_MAX / image->height <= image->bytes_per_line ||
 	    INT_MAX / planes <= image->height * image->bytes_per_line ||
 	    nbytes < planes * image->height * image->bytes_per_line) {
 	    XDestroyImage(image);
 	    image = NULL;
+	}
 	UnlockDisplay(dpy);
 	SyncHandle();
 	return (image);
+}
 XImage *XGetSubImage(dpy, d, x, y, width, height, plane_mask, format,
 		     dest_image, dest_x, dest_y)
      register Display *dpy;
      Drawable d;
      int x, y;
      unsigned int width, height;
      unsigned long plane_mask;
      int format;	/* either XYPixmap or ZPixmap */

 @@ -18,42 +18,48 @@ FITNESS FOR A PARTICULAR PURPOSE AND NON
 OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
 AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
 CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 Except as contained in this notice, the name of The Open Group shall not be
 used in advertising or otherwise to promote the sale, use or other dealings
 in this Software without prior written authorization from The Open Group.
 */
 /* $XFree86: xc/lib/X11/ModMap.c,v 1.5 2003/11/17 22:20:08 dawes Exp $ */
 #define NEED_REPLIES
 #include "Xlibint.h"
 #include <limits.h>
 XModifierKeymap *
 XGetModifierMapping(dpy)
      register Display *dpy;
+{
     xGetModifierMappingReply rep;
     register xReq *req;
     unsigned long nbytes;
     XModifierKeymap *res;
     LockDisplay(dpy);
     GetEmptyReq(GetModifierMapping, req);
     (void) _XReply (dpy, (xReply *)&rep, 0, xFalse);
-    nbytes = (unsigned long)rep.length << 2;
+    if (rep.length < (INT_MAX >> 2) &&
-    res = (XModifierKeymap *) Xmalloc(sizeof (XModifierKeymap));
+	(rep.length >> 1) == rep.numKeyPerModifier) {
         nbytes = (unsigned long)rep.length << 2;
         res = (XModifierKeymap *) Xmalloc(sizeof (XModifierKeymap));
     } else
 	res = NULL;
     if (res) res->modifiermap = (KeyCode *) Xmalloc ((unsigned) nbytes);
     if ((! res) || (! res->modifiermap)) {
 	if (res) Xfree((char *) res);
 	res = (XModifierKeymap *) NULL;
 	_XEatData(dpy, nbytes);
     } else {
 	_XReadPad(dpy, (char *) res->modifiermap, (long) nbytes);
 	res->max_keypermod = rep.numKeyPerModifier;
+    }
     UnlockDisplay(dpy);
     SyncHandle();
     return (res);

 @@ -18,79 +18,93 @@ FITNESS FOR A PARTICULAR PURPOSE AND NON
 OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
 AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
 CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 Except as contained in this notice, the name of The Open Group shall not be
 used in advertising or otherwise to promote the sale, use or other dealings
 in this Software without prior written authorization from The Open Group.
 */
 /* $XFree86: xc/lib/X11/ListExt.c,v 1.4 2001/12/14 19:54:02 dawes Exp $ */
 #define NEED_REPLIES
 #include "Xlibint.h"
 #include <limits.h>
 char **XListExtensions(dpy, nextensions)
 register Display *dpy;
 int *nextensions;	/* RETURN */
+{
 	xListExtensionsReply rep;
 	char **list;
-	char *ch;
+	char *ch = NULL;
 	char *chend;
 	int count = 0;
 	register unsigned i;
 	register int length;
 	register xReq *req;
 	register long rlen;
 	LockDisplay(dpy);
 	GetEmptyReq (ListExtensions, req);
 	if (! _XReply (dpy, (xReply *) &rep, 0, xFalse)) {
 	    UnlockDisplay(dpy);
 	    SyncHandle();
 	    return (char **) NULL;
+	}
 	if (rep.nExtensions) {
 	    list = (char **) Xmalloc (
                 (unsigned)(rep.nExtensions * sizeof (char *)));
-	    rlen = rep.length << 2;
+	    if (rep.length > 0 && rep.length < (INT_MAX >> 2)) {
-	    ch = (char *) Xmalloc ((unsigned) rlen + 1);
+	        rlen = rep.length << 2;
-                /* +1 to leave room for last null-terminator */
+	        ch = (char *) Xmalloc ((unsigned) rlen + 1);
                     /* +1 to leave room for last null-terminator */
+	    }
 	    if ((!list) || (!ch)) {
 		if (list) Xfree((char *) list);
 		if (ch)   Xfree((char *) ch);
 		_XEatData(dpy, (unsigned long) rlen);
 		UnlockDisplay(dpy);
 		SyncHandle();
 		return (char **) NULL;
+	    }
 	    _XReadPad (dpy, ch, rlen);
 	    /*
 	     * unpack into null terminated strings.
 	     */
 	    chend = ch + (rlen + 1);
 	    length = *ch;
 	    for (i = 0; i < rep.nExtensions; i++) {
-		list[i] = ch+1;  /* skip over length */
+		if (ch + length < chend) {
-		ch += length + 1; /* find next length ... */
+		    list[i] = ch+1;  /* skip over length */
-		length = *ch;
+		    ch += length + 1; /* find next length ... */
-		*ch = '\0'; /* and replace with null-termination */
+		    if (ch <= chend) {
 			length = *ch;
 			*ch = '\0'; /* and replace with null-termination */
 			count++;
 		    } else {
 			list[i] = NULL;
+		    }
 		} else
 		    list[i] = NULL;
+	    }
+	}
 	else list = (char **) NULL;
-	*nextensions = rep.nExtensions;
+	*nextensions = count;
 	UnlockDisplay(dpy);
 	SyncHandle();
 	return (list);
+}
 int
 XFreeExtensionList (list)
 char **list;
+{
 	if (list != NULL) {
 	    Xfree (list[0]-1);
 	    Xfree ((char *)list);
+	}

 @@ -49,42 +49,43 @@ SOFTWARE.
 /***********************************************************************
+ *
  * XGetDeviceMotionEvents - Get the motion history of an input device.
+ *
  */
 #include <X11/extensions/XI.h>
 #include <X11/extensions/XIproto.h>
 #include <X11/Xlibint.h>
 #include <X11/extensions/XInput.h>
 #include <X11/extensions/extutil.h>
 #include "XIint.h"
 #include <limits.h>
 XDeviceTimeCoord
 *XGetDeviceMotionEvents (dpy, dev, start, stop, nEvents, mode, axis_count)
     register 	Display	*dpy;
     XDevice		*dev;
     Time 		start;
     Time 		stop;
     int 		*nEvents;
     int 		*mode;
     int 		*axis_count;
+    {
     xGetDeviceMotionEventsReq 	*req;
     xGetDeviceMotionEventsReply 	rep;
     XDeviceTimeCoord *tc;
     int *data, *bufp, *readp, *savp;
-    long size, size2;
+    long size;
     int	 i, j;
     XExtDisplayInfo *info = XInput_find_display (dpy);
     LockDisplay (dpy);
     if (_XiCheckExtInit(dpy, XInput_Initial_Release) == -1)
 	return ((XDeviceTimeCoord *) NoSuchExtension);
     GetReq(GetDeviceMotionEvents,req);
     req->reqType = info->codes->major_opcode;
     req->ReqType = X_GetDeviceMotionEvents;
     req->start = start;
     req->stop = stop;
     req->deviceid = dev->device_id;
 @@ -95,31 +96,43 @@ XDeviceTimeCoord
 	*nEvents = 0;
 	return (NULL);
+	}
     *mode = rep.mode;
     *axis_count = rep.axes;
     *nEvents = rep.nEvents;
     if (!rep.nEvents)
+	{
 	UnlockDisplay(dpy);
         SyncHandle();
 	return (NULL);
+	}
-    size = rep.length << 2;
+    if (rep.length < (INT_MAX >> 2)) {
-    size2 = rep.nEvents *
+	size = rep.length << 2;
-	(sizeof (XDeviceTimeCoord) + (rep.axes * sizeof (int)));
+	savp = readp = Xmalloc(size);
-    savp = readp = (int *) Xmalloc (size);
+    } else {
-    bufp = (int *) Xmalloc (size2);
+	size = 0;
 	savp = readp = NULL;
+    }
     /* rep.axes is a CARD8, so assume max number of axes for bounds check */
     if (rep.nEvents <
         (INT_MAX / (sizeof(XDeviceTimeCoord) + (UCHAR_MAX * sizeof(int)))) &&
         rep.nEvents * (rep.axes + 1) <= rep.length) {
         size_t bsize = rep.nEvents *
             (sizeof(XDeviceTimeCoord) + (rep.axes * sizeof(int)));
         bufp = Xmalloc(bsize);
     } else
         bufp = NULL;
     if (!bufp || !savp)
+	{
 	*nEvents = 0;
 	_XEatData (dpy, (unsigned long) size);
 	UnlockDisplay(dpy);
 	SyncHandle();
 	return (NULL);
+	}
     _XRead (dpy, (char *) readp, size);
     tc = (XDeviceTimeCoord *) bufp;
     data = (int *) (tc + rep.nEvents);
     for (i=0; i<*nEvents; i++,tc++)

 @@ -50,26 +50,27 @@ SOFTWARE.
 /***********************************************************************
+ *
  * XGetDeviceControl - get the Device control state of an extension device.
+ *
  */
 #include <X11/extensions/XI.h>
 #include <X11/extensions/XIproto.h>
 #include <X11/Xlibint.h>
 #include <X11/Xlib.h>
 #include <X11/extensions/XInput.h>
 #include <X11/extensions/extutil.h>
 #include "XIint.h"
 #include <limits.h>
 XDeviceControl
 *XGetDeviceControl (dpy, dev, control)
     register	Display 	*dpy;
     XDevice			*dev;
     int				control;
+    {
     int	size = 0;
     int	nbytes, i;
     XDeviceControl *Device = NULL;
     XDeviceControl *Sav = NULL;
     xDeviceState *d = NULL;
     xDeviceState *sav = NULL;
 @@ -85,47 +86,56 @@ XDeviceControl
     req->reqType = info->codes->major_opcode;
     req->ReqType = X_GetDeviceControl;
     req->deviceid = dev->device_id;
     req->control = control;
     if (! _XReply (dpy, (xReply *) &rep, 0, xFalse))
+	{
 	UnlockDisplay(dpy);
 	SyncHandle();
 	return (XDeviceControl *) NULL;
+	}
     if (rep.length > 0)
+	{
-	nbytes = (long)rep.length << 2;
+	if (rep.length < (INT_MAX >> 2) &&
-	d = (xDeviceState *) Xmalloc((unsigned) nbytes);
+	    (rep.length << 2) >= sizeof(xDeviceState)) {
 	    nbytes = (long)rep.length << 2;
 	    d = (xDeviceState *) Xmalloc((unsigned) nbytes);
+	}
         if (!d)
+	    {
 	    _XEatData (dpy, (unsigned long) nbytes);
 	    UnlockDisplay(dpy);
 	    SyncHandle();
 	    return (XDeviceControl *) NULL;
+	    }
 	sav = d;
 	_XRead (dpy, (char *) d, nbytes);
 	switch (d->control)
+	    {
 	    case DEVICE_RESOLUTION:
+		{
 		xDeviceResolutionState *r;
 		size_t val_size;
 		r = (xDeviceResolutionState *) d;
-		size += sizeof (XDeviceResolutionState) +
+	        if (sizeof(xDeviceResolutionState) > nbytes ||
-			(3 * sizeof(int) * r->num_valuators);
+		    r->num_valuators >= (INT_MAX / (3 * sizeof(int))))
  		    goto out;
 		val_size = 3 * sizeof(int) * r->num_valuators;
 		if ((sizeof(xDeviceResolutionState) + val_size) > nbytes)
 		    goto out;
 		size = sizeof(XDeviceResolutionState) + val_size;
 		break;
+		}
 	    default:
 		size += d->length;
 		break;
+	    }
 	Device = (XDeviceControl *) Xmalloc((unsigned) size);
         if (!Device)
+	    {
 	    UnlockDisplay(dpy);
 	    SyncHandle();
 	    return (XDeviceControl *) NULL;
 @@ -148,26 +158,27 @@ XDeviceControl
 		R->num_valuators = r->num_valuators;
 		iptr = (int *) (R+1);
 		iptr2 = (int *) (r+1);
 		R->resolutions = iptr;
 		R->min_resolutions = iptr + R->num_valuators;
 		R->max_resolutions = iptr + (2 * R->num_valuators);
 		for (i=0; i < (3 * R->num_valuators); i++)
 		    *iptr++ = *iptr2++;
 		break;
+		}
 	    default:
 		break;
+	    }
 out:
 	XFree (sav);
+	}
     UnlockDisplay(dpy);
     SyncHandle();
     return (Sav);
+    }
 void XFreeDeviceControl (control)
     XDeviceControl *control;
+    {
     XFree (control);
+    }

 @@ -50,75 +50,84 @@ SOFTWARE.
 /***********************************************************************
+ *
  * XGetFeedbackControl - get the feedback attributes of an extension device.
+ *
  */
 #include <X11/extensions/XI.h>
 #include <X11/extensions/XIproto.h>
 #include <X11/Xlibint.h>
 #include <X11/Xlib.h>
 #include <X11/extensions/XInput.h>
 #include <X11/extensions/extutil.h>
 #include "XIint.h"
 #include <limits.h>
 XFeedbackState
 *XGetFeedbackControl (dpy, dev, num_feedbacks)
     register	Display 	*dpy;
     XDevice			*dev;
     int				*num_feedbacks;
+    {
     int	size = 0;
     int	nbytes, i;
     XFeedbackState *Feedback = NULL;
     XFeedbackState *Sav = NULL;
     xFeedbackState *f = NULL;
     xFeedbackState *sav = NULL;
     char *end = NULL;
     xGetFeedbackControlReq *req;
     xGetFeedbackControlReply rep;
     XExtDisplayInfo *info = XInput_find_display (dpy);
     LockDisplay (dpy);
     if (_XiCheckExtInit(dpy, XInput_Initial_Release) == -1)
 	return ((XFeedbackState *) NoSuchExtension);
     GetReq(GetFeedbackControl,req);
     req->reqType = info->codes->major_opcode;
     req->ReqType = X_GetFeedbackControl;
     req->deviceid = dev->device_id;
     if (! _XReply (dpy, (xReply *) &rep, 0, xFalse))
+	{
 	UnlockDisplay(dpy);
 	SyncHandle();
 	return (XFeedbackState *) NULL;
+	}
     if (rep.length > 0)
+	{
 	*num_feedbacks = rep.num_feedbacks;
 	nbytes = (long)rep.length << 2;
-	f = (xFeedbackState *) Xmalloc((unsigned) nbytes);
+	if (rep.length < (INT_MAX >> 2)) {
 	    nbytes = (long)rep.length << 2;
 	    f = (xFeedbackState *) Xmalloc((unsigned) nbytes);
+	}
         if (!f)
+	    {
 	    _XEatData (dpy, (unsigned long) nbytes);
 	    UnlockDisplay(dpy);
 	    SyncHandle();
 	    return (XFeedbackState *) NULL;
+	    }
 	sav = f;
 	end = (char *)f + nbytes;
 	_XRead (dpy, (char *) f, nbytes);
 	for (i=0; i<*num_feedbacks; i++)
+	    {
 	    if ((char *)f + sizeof(*f) > end ||
 	        f->length == 0 || f->length > nbytes)
  		goto out;
 	    switch (f->class)
+		{
 		case KbdFeedbackClass:
 		    size += sizeof (XKbdFeedbackState);
 		    break;
 		case PtrFeedbackClass:
 		    size += sizeof (XPtrFeedbackState);
 		    break;
 		case IntegerFeedbackClass:
 		    size += sizeof (XIntegerFeedbackState);
 		    break;
 		case StringFeedbackClass:
+		    {
 @@ -248,26 +257,27 @@ XFeedbackState
 		    B->length = sizeof (XBellFeedbackState);
 		    B->id = b->id;
 		    B->percent = b->percent;
 		    B->pitch = b->pitch;
 		    B->duration = b->duration;
 		    break;
+		    }
 		default:
 		    break;
+		}
 	    f = (xFeedbackState *) ((char *) f + f->length);
 	    Feedback = (XFeedbackState *) ((char *) Feedback+Feedback->length);
+	    }
 out:
 	XFree ((char *)sav);
+	}
     UnlockDisplay(dpy);
     SyncHandle();
     return (Sav);
+    }
 void XFreeFeedbackList (list)
     XFeedbackState *list;
+    {
     XFree ((char *)list);
+    }

 @@ -43,26 +43,27 @@ ANY DAMAGES WHATSOEVER RESULTING FROM LO
 WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
 ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
 SOFTWARE.
 ********************************************************/
 /* $XFree86: xc/lib/Xi/XGetMMap.c,v 3.4 2002/10/16 00:37:29 dawes Exp $ */
 /***********************************************************************
+ *
  * XGetDeviceModifierMapping - get the modifier map of an extension device.
+ *
  */
 #include <limits.h>
 #include <X11/extensions/XI.h>
 #include <X11/extensions/XIproto.h>
 #include <X11/Xlibint.h>
 #include <X11/extensions/XInput.h>
 #include <X11/extensions/extutil.h>
 #include "XIint.h"
 XModifierKeymap
 *XGetDeviceModifierMapping (dpy, dev)
     register	Display 	*dpy;
     XDevice			*dev;
+    {
     unsigned long nbytes;
 @@ -76,28 +77,34 @@ XModifierKeymap
 	return ((XModifierKeymap *) NoSuchExtension);
     GetReq(GetDeviceModifierMapping,req);
     req->reqType = info->codes->major_opcode;
     req->ReqType = X_GetDeviceModifierMapping;
     req->deviceid = dev->device_id;
     if (! _XReply (dpy, (xReply *) &rep, 0, xFalse))
+	{
 	UnlockDisplay(dpy);
 	SyncHandle();
 	return (XModifierKeymap *) NULL;
+	}
-    nbytes = (unsigned long)rep.length << 2;
+    if (rep.length < (INT_MAX >> 2) &&
-    res = (XModifierKeymap *) Xmalloc(sizeof (XModifierKeymap));
+	rep.numKeyPerModifier == rep.length >> 1) {
         nbytes = (unsigned long)rep.length << 2;
         res = (XModifierKeymap *) Xmalloc(sizeof (XModifierKeymap));
     } else {
 	nbytes = 0;
 	res = NULL;
+    }
     if (res)
+	{
         res->modifiermap = (KeyCode *) Xmalloc (nbytes);
 	if (res->modifiermap)
 	    _XReadPad(dpy, (char *) res->modifiermap, nbytes);
 	else
 	    _XEatData (dpy, (unsigned long) nbytes);
 	res->max_keypermod = rep.numKeyPerModifier;
+	}
     UnlockDisplay(dpy);
     SyncHandle();
     return (res);

 @@ -43,26 +43,27 @@ ANY DAMAGES WHATSOEVER RESULTING FROM LO
 WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
 ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
 SOFTWARE.
 ********************************************************/
 /* $XFree86: xc/lib/Xi/XOpenDev.c,v 3.4 2002/10/16 00:37:29 dawes Exp $ */
 /***********************************************************************
+ *
  * XOpenDevice - Request the server to open and extension input device.
+ *
  */
 #include <limits.h>
 #include <X11/extensions/XI.h>
 #include <X11/extensions/XIproto.h>
 #include <X11/Xlibint.h>
 #include <X11/extensions/XInput.h>
 #include <X11/extensions/extutil.h>
 #include "XIint.h"
 XDevice
 *XOpenDevice(dpy, id)
     register Display 	*dpy;
     register XID	id;
+    {
     register long	rlen; /* raw length */
 @@ -77,29 +78,35 @@ XDevice
     GetReq(OpenDevice,req);
     req->reqType = info->codes->major_opcode;
     req->ReqType = X_OpenDevice;
     req->deviceid = id;
     if (! _XReply (dpy, (xReply *) &rep, 0, xFalse))
+	{
 	UnlockDisplay(dpy);
 	SyncHandle();
 	return (XDevice *) NULL;
+	}
-    rlen = rep.length << 2;
+    if (rep.length < INT_MAX >> 2 &&
-    dev = (XDevice *) Xmalloc (sizeof(XDevice) + rep.num_classes *
+	(rep.length << 2) >= rep.num_classes * sizeof(xInputClassInfo)) {
-	sizeof (XInputClassInfo));
+        rlen = rep.length << 2;
         dev = (XDevice *) Xmalloc (sizeof(XDevice) + rep.num_classes *
 	    sizeof (XInputClassInfo));
     } else {
 	rlen = 0;
 	dev = NULL;
+    }
     if (dev)
+	{
 	int dlen; /* data length */
 	dev->device_id = req->deviceid;
 	dev->num_classes = rep.num_classes;
 	dev->classes = (XInputClassInfo *) ((char *) dev + sizeof (XDevice));
 	dlen = rep.num_classes * sizeof(xInputClassInfo);
 	_XRead (dpy, (char *)dev->classes, dlen);
 	/* could be padding that we still need to eat (yummy!) */
 	if(rlen - dlen > 0)
 	    _XEatData (dpy, (unsigned long) rlen - dlen);
+	}

 @@ -49,84 +49,93 @@ SOFTWARE.
 /***********************************************************************
+ *
  * XQueryDeviceState - Query the state of an extension input device.
+ *
  */
 #include <X11/extensions/XI.h>
 #include <X11/extensions/XIproto.h>
 #include <X11/Xlibint.h>
 #include <X11/extensions/XInput.h>
 #include <X11/extensions/extutil.h>
 #include "XIint.h"
 #include <limits.h>
 XDeviceState
 *XQueryDeviceState (dpy, dev)
     register Display *dpy;
     XDevice *dev;
+    {
     int				i,j;
-    int				rlen;
+    int				rlen = 0;
     int				size = 0;
     xQueryDeviceStateReq 	*req;
     xQueryDeviceStateReply 	rep;
     XDeviceState		*state = NULL;
     XInputClass			*any, *Any;
-    char			*data;
+    char			*data = NULL, *end = NULL;
     XExtDisplayInfo *info = XInput_find_display (dpy);
     LockDisplay (dpy);
     if (_XiCheckExtInit(dpy, XInput_Initial_Release) == -1)
 	return ((XDeviceState *) NoSuchExtension);
     GetReq(QueryDeviceState,req);
     req->reqType = info->codes->major_opcode;
     req->ReqType = X_QueryDeviceState;
     req->deviceid = dev->device_id;
     if (! _XReply (dpy, (xReply *) &rep, 0, xFalse))
+	{
 	UnlockDisplay(dpy);
 	SyncHandle();
 	return (XDeviceState *) NULL;
+	}
-    rlen = rep.length << 2;
+    if (rep.length > 0) {
-    if (rlen > 0)
+	if (rep.length < (INT_MAX >> 2)) {
 	    rlen = (unsigned long) rep.length << 2;
-	data = Xmalloc (rlen);
+	    data = Xmalloc(rlen);
 	    end = data + rlen;
+	}
 	if (!data)
+	    {
 	    _XEatData (dpy, (unsigned long) rlen);
     	    UnlockDisplay(dpy);
     	    SyncHandle();
     	    return ((XDeviceState *) NULL);
+	    }
         end = data + rlen;
 	_XRead (dpy, data, rlen);
 	for (i=0, any=(XInputClass *) data; i<(int)rep.num_classes; i++)
+	    {
 	    if ((char *)any + sizeof(XInputClass) > end ||
 		any->length == 0 || any->length > rlen)
  		goto out;
 	    switch (any->class)
+		{
 		case KeyClass:
 		    size += sizeof (XKeyState);
 		    break;
 		case ButtonClass:
 		    size += sizeof (XButtonState);
 		    break;
 		case ValuatorClass:
+		    {
 		    xValuatorState *v = (xValuatorState *) any;
 		    if ((char *)any + sizeof(xValuatorState) > end)
 		        goto out;
 		    size += (sizeof (XValuatorState) +
 			(v->num_valuators * sizeof(int)));
+		    }
 		    break;
+		}
 	    any = (XInputClass *) ((char *) any + any->length);
+	    }
 	state = (XDeviceState *) Xmalloc (size + sizeof(XDeviceState));
 	if (!state)
+	    {
     	    UnlockDisplay(dpy);
     	    SyncHandle();
     	    return ((XDeviceState *) NULL);
 @@ -176,23 +185,24 @@ XDeviceState
 		    V->valuators = (int *) Any;
 		    for (j=0; j<(int)V->num_valuators; j++)
 			*(V->valuators + j) = *valuators++;
 		    Any = (XInputClass *)((char *) Any +
 			V->num_valuators * sizeof (int));
+		    }
 		    break;
+		}
 	    any = (XInputClass *) ((char *) any + any->length);
+	    }
 	Xfree(data);
+	}
 out:
     UnlockDisplay(dpy);
     SyncHandle();
     return (state);
+    }
 void XFreeDeviceState (list)
     XDeviceState *list;
+    {
     XFree ((char *)list);
+    }

 @@ -43,26 +43,27 @@ ANY DAMAGES WHATSOEVER RESULTING FROM LO
 WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
 ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
 SOFTWARE.
 ********************************************************/
 /* $XFree86: xc/lib/Xi/XGetKMap.c,v 3.5 2003/11/17 22:20:21 dawes Exp $ */
 /***********************************************************************
+ *
  * XGetDeviceKeyMapping - get the keymap of an extension device.
+ *
  */
 #include <limits.h>
 #include <X11/extensions/XI.h>
 #include <X11/extensions/XIproto.h>
 #include <X11/Xlibint.h>
 #include <X11/extensions/XInput.h>
 #include <X11/extensions/extutil.h>
 #include "XIint.h"
 KeySym *
 XGetDeviceKeyMapping (
     register	Display 	*dpy,
     XDevice			*dev,
 #if NeedWidePrototypes
     unsigned int                first,
 @@ -86,26 +87,33 @@ XGetDeviceKeyMapping (
     req->reqType = info->codes->major_opcode;
     req->ReqType = X_GetDeviceKeyMapping;
     req->deviceid = dev->device_id;
     req->firstKeyCode = first;
     req->count = keycount;
     if (! _XReply (dpy, (xReply *) &rep, 0, xFalse))
+	{
 	UnlockDisplay(dpy);
 	SyncHandle();
 	return (KeySym *) NULL;
+	}
     if (rep.length > 0) {
-        *syms_per_code = rep.keySymsPerKeyCode;
+	if (rep.length < INT_MAX >> 2 &&
-	nbytes = (long)rep.length << 2;
+	    rep.length == rep.keySymsPerKeyCode * keycount) {
-	mapping = (KeySym *) Xmalloc((unsigned) nbytes);
+            *syms_per_code = rep.keySymsPerKeyCode;
 	    nbytes = (long)rep.length << 2;
 	    mapping = (KeySym *) Xmalloc((unsigned) nbytes);
 	} else {
 	    *syms_per_code = 0;
 	    nbytes = 0;
 	    mapping = NULL;
+	}
 	if (mapping)
 	    _XRead (dpy, (char *)mapping, nbytes);
 	else
 	    _XEatData (dpy, (unsigned long) nbytes);
+      }
     UnlockDisplay(dpy);
     SyncHandle();
     return (mapping);
+    }

 @@ -25,27 +25,27 @@
 #include "Xrenderint.h"
 XFilters *
 XRenderQueryFilters (Display *dpy, Drawable drawable)
+{
     XExtDisplayInfo		*info = XRenderFindDisplay (dpy);
     XRenderInfo			*xri;
     xRenderQueryFiltersReq	*req;
     xRenderQueryFiltersReply	rep;
     XFilters			*filters;
     char			*name;
     char			len;
     int				i;
-    long			nbytes, nbytesAlias, nbytesName;
+    long			nbytes, nbytesAlias, nbytesName, reply_left;
     if (!XextHasExtension (info))
 	return 0;
     if (!XRenderQueryFormats (dpy))
 	return 0;
     xri = (XRenderInfo *) info->data;
     if (xri->minor_version < 6)
 	return 0;
     LockDisplay (dpy);
     GetReq (RenderQueryFilters, req);
 @@ -91,37 +91,47 @@ XRenderQueryFilters (Display *dpy, Drawa
      *	nbytesName  char strings
      */
     filters->nfilter = rep.numFilters;
     filters->nalias = rep.numAliases;
     filters->filter = (char **) (filters + 1);
     filters->alias = (short *) (filters->filter + rep.numFilters);
     name = (char *) (filters->alias + rep.numAliases);
     /*
      * Read the filter aliases
      */
     _XRead16Pad (dpy, filters->alias, 2 * rep.numAliases);
     reply_left = 8 + rep.length - 2 * rep.numAliases;;
     /*
      * Read the filter names
      */
     for (i = 0; i < rep.numFilters; i++)
+    {
 	int	l;
 	_XRead (dpy, &len, 1);
 	reply_left--;
 	l = len & 0xff;
 	if ((unsigned long)l + 1 > nbytesName) {
 	    Xfree(filters);
 	    UnlockDisplay (dpy);
 	    SyncHandle ();
 	    return NULL;
+	}
 	nbytesName -= l + 1;
 	filters->filter[i] = name;
 	_XRead (dpy, name, l);
         reply_left -= l;
 	name[l] = '\0';
 	name += l + 1;
+    }
     i = name - (char *) (filters->alias + rep.numAliases);
     if (i & 3)
 	_XEatData (dpy, 4 - (i & 3));
     UnlockDisplay (dpy);
     return filters;
+}
 void

 @@ -41,26 +41,27 @@ from The Open Group.
  * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
  * AND FITNESS, IN NO EVENT SHALL NETWORK COMPUTING DEVICES BE LIABLE
  * FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN
  * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
  * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  **************************************************************************/
 /*
  * By Stephen Gildea, X Consortium, and Martha Zimet, NCD.
  */
 /* $XFree86: xc/lib/Xtst/XRecord.c,v 1.8 2005/01/27 02:28:59 dawes Exp $ */
 #include <stdio.h>
 #include <limits.h>
 #include <assert.h>
 #define NEED_EVENTS
 #define NEED_REPLIES
 #include <X11/Xlibint.h>
 #include <X11/extensions/Xext.h>
 #include <X11/Xtrans.h>
 #include <X11/extensions/extutil.h>
 #include <X11/extensions/recordstr.h>
 static XExtensionInfo _xrecord_info_data;
 static XExtensionInfo *xrecord_info = &_xrecord_info_data;
 static /* const */ char *xrecord_extension_name = RECORD_NAME;
 @@ -718,89 +719,118 @@ parse_reply_call_callback(Display *dpy,
 	    return Error;
 	data->id_base = rep->idBase;
 	data->category = rep->category;
 	data->client_swapped = rep->clientSwapped;
 	data->server_time = rep->serverTime;
 	data->client_seq = rep->recordedSequenceNumber;
 	/*
 	 * compute the size of this protocol element.
 	 */
 	switch (rep->category) {
 	case XRecordFromServer:
 	    if (rep->elementHeader&XRecordFromServerTime) {
 		if (current_index + 4 > rep->length << 2)
 		    return Error;
 		EXTRACT_CARD32(rep->clientSwapped,
 			       reply->buf+current_index,
 			       data->server_time);
 		current_index += 4;
+	    }
 	    if (current_index + 1 > rep->length << 2)
 		return Error;
 	    switch (reply->buf[current_index]) {
 	    case X_Reply: /* reply */
 		if (current_index + 8 > rep->length << 2)
 		    return Error;
 		EXTRACT_CARD32(rep->clientSwapped,
 			       reply->buf+current_index+4, datum_bytes);
 		if (datum_bytes < 0 || datum_bytes > ((INT_MAX >> 2) - 8))
 		    return Error;
 		datum_bytes = (datum_bytes+8) << 2;
 		break;
 	    default: /* error or event */
 		datum_bytes = 32;
+	    }
 	    break;
 	case XRecordFromClient:
 	    if (rep->elementHeader&XRecordFromClientTime) {
 		if (current_index + 4 > rep->length << 2)
 		    return Error;
 		EXTRACT_CARD32(rep->clientSwapped,
 			       reply->buf+current_index,
 			       data->server_time);
 		current_index += 4;
+	    }
 	    if (rep->elementHeader&XRecordFromClientSequence) {
 		if (current_index + 4 > rep->length << 2)
 		    return Error;
 		EXTRACT_CARD32(rep->clientSwapped,
 			       reply->buf+current_index,
 			       data->client_seq);
 		current_index += 4;
+	    }
 	    if (current_index + 4 > rep->length<<2)
 		return Error;
 	    if (reply->buf[current_index+2] == 0
 		&& reply->buf[current_index+3] == 0) /* needn't swap 0 */
 	    {	/* BIG-REQUESTS */
 		if (current_index + 8 > rep->length << 2)
 		    return Error;
 		EXTRACT_CARD32(rep->clientSwapped,
 			       reply->buf+current_index+4, datum_bytes);
 	    } else {
 		EXTRACT_CARD16(rep->clientSwapped,
 			       reply->buf+current_index+2, datum_bytes);
+	    }
 	    if (datum_bytes < 0 || datum_bytes > INT_MAX >> 2)
 		return Error;
 	    datum_bytes <<= 2;
 	    break;
 	case XRecordClientStarted:
 	    if (current_index + 8 > rep->length << 2)
 		return Error;
 	    EXTRACT_CARD16(rep->clientSwapped,
 			   reply->buf+current_index+6, datum_bytes);
 	    datum_bytes = (datum_bytes+2) << 2;
 	    break;
 	case XRecordClientDied:
 	    if (rep->elementHeader&XRecordFromClientSequence) {
 		if (current_index + 4 > rep->length << 2)
 		    return Error;
 		EXTRACT_CARD32(rep->clientSwapped,
 			       reply->buf+current_index,
 			       data->client_seq);
 		current_index += 4;
 	    } else if (current_index < rep->length << 2)
-	    /* fall through */
+		return Error;
 	    datum_bytes = 0;
 	    break;
 	case XRecordStartOfData:
 	case XRecordEndOfData:
 	    if (current_index < rep->length << 2)
 		return Error;
 	    datum_bytes = 0;
 	    break;
+	}
 	if (datum_bytes > 0) {
-	    if (current_index + datum_bytes > rep->length << 2)
+	    if (INT_MAX - datum_bytes < (rep->length << 2) - current_index) {
 		fprintf(stderr,
 			"XRecord: %lu-byte reply claims %d-byte element (seq %lu)\n",
-			(long)rep->length << 2, current_index + datum_bytes,
+			(unsigned long)rep->length << 2, current_index + datum_bytes,
 			dpy->last_request_read);
 		return Error;
+	    }
 	    /*
 	     * This assignment (and indeed the whole buffer sharing
 	     * scheme) assumes arbitrary 4-byte boundaries are
 	     * addressable.
 	     */
 	    data->data = reply->buf+current_index;
 	    reply->ref_count++;
 	} else {
 	    data->data = NULL;
+	}
 	data->data_len = datum_bytes >> 2;
 	(*callback)(closure, data);
 @@ -832,26 +862,32 @@ XRecordEnableContext(Display *dpy, XReco
     req->recordReqType = X_RecordEnableContext;
     req->context = context;
     while (1)
+    {
 	/* This code should match that in XRecordEnableContextAsync */
 	if (!_XReply (dpy, (xReply *)&rep, 0, xFalse))
+	{
 	    UnlockDisplay(dpy);
 	    SyncHandle();
 	    return 0;
+	}
 	if (rep.length > INT_MAX >> 2) {
 	    UnlockDisplay(dpy);
 	    SyncHandle();
 	    return 0;
+	}
 	if (rep.length > 0) {
 	    reply = alloc_reply_buffer(info, rep.length<<2);
 	    if (!reply) {
 		UnlockDisplay(dpy);
 		SyncHandle();
 		return 0;
+	    }
 	    _XRead (dpy, (char *)reply->buf, rep.length<<2);
 	} else {
 	    reply = NULL;
+	}
 	status = parse_reply_call_callback(dpy, info, &rep, reply,

 @@ -140,61 +140,66 @@ XvQueryExtension(
 int
 XvQueryAdaptors(
      Display *dpy,
      Window window,
      unsigned int *p_nAdaptors,
      XvAdaptorInfo **p_pAdaptors
 ){
   XExtDisplayInfo *info = xv_find_display(dpy);
   xvQueryAdaptorsReq *req;
   xvQueryAdaptorsReply rep;
   int size,ii,jj;
   char *name;
   char *end;
   XvAdaptorInfo *pas, *pa;
   XvFormat *pfs, *pf;
   char *buffer;
   int status;
   union
+    {
       char *buffer;
       char *string;
       xvAdaptorInfo *pa;
       xvFormat *pf;
     } u;
   XvCheckExtension(dpy, info, XvBadExtension);
   LockDisplay(dpy);
   XvGetReq(QueryAdaptors, req);
   req->window = window;
   /* READ THE REPLY */
   if (_XReply(dpy, (xReply *)&rep, 0, xFalse) == 0) {
       UnlockDisplay(dpy);
       SyncHandle();
       return(XvBadReply);
+  }
   size = rep.length << 2;
-  if ( (buffer = (char *)Xmalloc ((unsigned) size)) == NULL) {
+  if (size > 0) {
     if ((buffer = Xmalloc(size)) == NULL) {
       UnlockDisplay(dpy);
       SyncHandle();
       return(XvBadAlloc);
+    }
     _XRead(dpy, buffer, (long) size);
+  }
   _XRead (dpy, buffer, size);
   u.buffer = buffer;
   end = buffer + size;
   /* GET INPUT ADAPTORS */
   if (rep.num_adaptors == 0) {
       pas = NULL;
   } else {
       size = rep.num_adaptors*sizeof(XvAdaptorInfo);
       if ((pas=(XvAdaptorInfo *)Xmalloc(size))==NULL) {
           Xfree(buffer);
           UnlockDisplay(dpy);
           SyncHandle();
           return(XvBadAlloc);
+      }
 @@ -202,37 +207,46 @@ XvQueryAdaptors(
   /* INIT ADAPTOR FIELDS */
   pa = pas;
   for (ii=0; ii<rep.num_adaptors; ii++) {
       pa->num_adaptors = 0;
       pa->name = (char *)NULL;
       pa->formats = (XvFormat *)NULL;
       pa++;
+  }
   pa = pas;
   for (ii=0; ii<rep.num_adaptors; ii++) {
       if (u.buffer + sz_xvAdaptorInfo > end) {
         status = XvBadReply;
         goto out;
+      }
       pa->type = u.pa->type;
       pa->base_id = u.pa->base_id;
       pa->num_ports = u.pa->num_ports;
       pa->num_formats = u.pa->num_formats;
       pa->num_adaptors = rep.num_adaptors - ii;
       /* GET ADAPTOR NAME */
       size = u.pa->name_size;
       u.buffer += (sz_xvAdaptorInfo + 3) & ~3;
       if (u.buffer + size > end) {
         status = XvBadReply;
         goto out;
+      }
       if ( (name = (char *)Xmalloc(size+1)) == NULL)
+	{
 	  XvFreeAdaptorInfo(pas);
 	  Xfree(buffer);
           UnlockDisplay(dpy);
           SyncHandle();
 	  return(XvBadAlloc);
+	}
       (void)strncpy(name, u.string, size);
       name[size] = '\0';
       pa->name = name;
       u.buffer += (size + 3) & ~3;
 @@ -240,47 +254,55 @@ XvQueryAdaptors(
       /* GET FORMATS */
       size = pa->num_formats*sizeof(XvFormat);
       if ((pfs=(XvFormat *)Xmalloc(size))==NULL) {
 	  XvFreeAdaptorInfo(pas);
 	  Xfree(buffer);
           UnlockDisplay(dpy);
           SyncHandle();
 	  return(XvBadAlloc);
+      }
       pf = pfs;
       for (jj=0; jj<pa->num_formats; jj++) {
           if (u.buffer + sz_xvFormat > end) {
             Xfree(pfs);
             status = XvBadReply;
             goto out;
+          }
 	  pf->depth = u.pf->depth;
 	  pf->visual_id = u.pf->visual;
 	  pf++;
 	  u.buffer += (sz_xvFormat + 3) & ~3;
+      }
       pa->formats = pfs;
       pa++;
+  }
   *p_nAdaptors = rep.num_adaptors;
   *p_pAdaptors = pas;
   status = Success;
 out:
   Xfree(buffer);
   UnlockDisplay(dpy);
   SyncHandle();
-  return (Success);
+  return (status);
+}
 void
 XvFreeAdaptorInfo(XvAdaptorInfo *pAdaptors)
+{
   XvAdaptorInfo *pa;
   int ii;
   if (!pAdaptors) return;
   pa = pAdaptors;
 @@ -302,113 +324,129 @@ XvFreeAdaptorInfo(XvAdaptorInfo *pAdapto
 int
 XvQueryEncodings(
      Display *dpy,
      XvPortID port,
      unsigned int *p_nEncodings,
      XvEncodingInfo **p_pEncodings
 ){
   XExtDisplayInfo *info = xv_find_display(dpy);
   xvQueryEncodingsReq *req;
   xvQueryEncodingsReply rep;
   int size, jj;
   char *name;
   char *end;
   int status;
   XvEncodingInfo *pes, *pe;
   char *buffer;
   union
+    {
       char *buffer;
       char *string;
       xvEncodingInfo *pe;
     } u;
   XvCheckExtension(dpy, info, XvBadExtension);
   LockDisplay(dpy);
   XvGetReq(QueryEncodings, req);
   req->port = port;
   /* READ THE REPLY */
   if (_XReply(dpy, (xReply *)&rep, 0, xFalse) == 0) {
       UnlockDisplay(dpy);
       SyncHandle();
       return(XvBadReply);
+  }
   size = rep.length << 2;
-  if ( (buffer = (char *)Xmalloc ((unsigned) size)) == NULL) {
+  if (size > 0) {
     if ( (buffer = (char *)Xmalloc ((unsigned) size)) == NULL) {
       UnlockDisplay(dpy);
       SyncHandle();
       return(XvBadAlloc);
+    }
     _XRead (dpy, buffer, size);
+  }
   _XRead (dpy, buffer, size);
   u.buffer = buffer;
   end = buffer + size;
   /* GET ENCODINGS */
   size = rep.num_encodings*sizeof(XvEncodingInfo);
   if ( (pes = (XvEncodingInfo *)Xmalloc(size)) == NULL) {
       Xfree(buffer);
       UnlockDisplay(dpy);
       SyncHandle();
       return(XvBadAlloc);
+  }
   /* INITIALIZE THE ENCODING POINTER */
   pe = pes;
   for (jj=0; jj<rep.num_encodings; jj++) {
       pe->name = (char *)NULL;
       pe->num_encodings = 0;
       pe++;
+  }
   pe = pes;
   for (jj=0; jj<rep.num_encodings; jj++) {
       if (u.buffer + sz_xvEncodingInfo > end) {
         status = XvBadReply;
         goto out;
+      }
       pe->encoding_id = u.pe->encoding;
       pe->width = u.pe->width;
       pe->height = u.pe->height;
       pe->rate.numerator = u.pe->rate.numerator;
       pe->rate.denominator = u.pe->rate.denominator;
       pe->num_encodings = rep.num_encodings - jj;
       size = u.pe->name_size;
       u.buffer += (sz_xvEncodingInfo + 3) & ~3;
       if (u.buffer + size > end) {
         status = XvBadReply;
         goto out;
+      }
       if ( (name = (char *)Xmalloc(size+1)) == NULL) {
 	  Xfree(buffer);
           UnlockDisplay(dpy);
           SyncHandle();
 	  return(XvBadAlloc);
+      }
       strncpy(name, u.string, size);
       name[size] = '\0';
       pe->name = name;
       pe++;
       u.buffer += (size + 3) & ~3;
+  }
   *p_nEncodings = rep.num_encodings;
   *p_pEncodings = pes;
   status = Success;
 out:
   Xfree(buffer);
   UnlockDisplay(dpy);
   SyncHandle();
-  return (Success);
+  return (status);
+}
 void
 XvFreeEncodingInfo(XvEncodingInfo *pEncodings)
+{
   XvEncodingInfo *pe;
   int ii;
   if (!pEncodings) return;
   pe = pEncodings;

 @@ -532,27 +532,27 @@ extern LockInfoPtr _Xglobal_lock;
  * MakeBigReq sets the CARD16 "req->length" to 0 and inserts a new CARD32
  * length, after req->length, before the data in the request.  The new length
  * includes the "n" extra 32-bit words.
+ *
  * Do not use MakeBigReq if there is no data already in the request.
  * req->length must already be >= 2.
  */
 #define MakeBigReq(req,n) \
     { \
     char _BRdat[4]; \
     unsigned long _BRlen = req->length - 1; \
     req->length = 0; \
     memcpy(_BRdat, ((char *)req) + (_BRlen << 2), 4); \
-    memmove(((char *)req) + 8, ((char *)req) + 4, _BRlen << 2); \
+    memmove(((char *)req) + 8, ((char *)req) + 4, (_BRlen - 1) << 2); \
     memcpy(((char *)req) + 4, _BRdat, 4); \
     Data32(dpy, (long *)&_BRdat, 4); \
+    }
 #else
 #ifdef LONG64
 #define MakeBigReq(req,n) \
     { \
     CARD64 _BRdat; \
     CARD32 _BRlen = req->length - 1; \
     req->length = 0; \
     _BRdat = ((CARD32 *)req)[_BRlen]; \
     memmove(((char *)req) + 8, ((char *)req) + 4, (_BRlen - 1) << 2); \
     ((CARD32 *)req)[1] = _BRlen + n + 2; \

 @@ -80,29 +80,33 @@ XGetDeviceButtonMapping (dpy, device, ma
     register xGetDeviceButtonMappingReq *req;
     xGetDeviceButtonMappingReply rep;
     LockDisplay(dpy);
     if (_XiCheckExtInit(dpy, XInput_Initial_Release) == -1)
 	return (NoSuchExtension);
     GetReq(GetDeviceButtonMapping, req);
     req->reqType = info->codes->major_opcode;
     req->ReqType = X_GetDeviceButtonMapping;
     req->deviceid = device->device_id;
     status = _XReply (dpy, (xReply *)&rep, 0, xFalse);
-    if (status == 1)
+    if (status == 1) {
 	if (rep.length <= (sizeof(mapping) >> 2) &&
-	nbytes = (long)rep.length << 2;
+	    rep.nElts <= (rep.length << 2)) {
-	_XRead (dpy, (char *)mapping, nbytes);
+	    nbytes = (long)rep.length << 2;
 	    _XRead (dpy, (char *)mapping, nbytes);
-	/* don't return more data than the user asked for. */
+	    /* don't return more data than the user asked for. */
-	if (rep.nElts)
+	    if (rep.nElts)
-	    memcpy ((char *) map, (char *) mapping, MIN((int)rep.nElts, nmap));
+	        memcpy ((char *) map, (char *) mapping, MIN((int)rep.nElts, nmap));
-	status = rep.nElts;
+	    status = rep.nElts;
 	} else {
 	    status = 0;
+	}
+    }
     else
 	status = 0;
     UnlockDisplay(dpy);
     SyncHandle();
     return (status);
+    }

 @@ -279,32 +279,48 @@ XRenderQueryFormats (Display *dpy)
 	xFormat++;
+    }
     xScreen = (xPictScreen *) xFormat;
     screen = xri->screen;
     depth = xri->depth;
     visual = xri->visual;
     for (ns = 0; ns < xri->nscreen; ns++)
+    {
 	screen->depths = depth;
 	screen->ndepths = xScreen->nDepth;
 	screen->fallback = _XRenderFindFormat (xri, xScreen->fallback);
 	screen->subpixel = SubPixelUnknown;
 	xDepth = (xPictDepth *) (xScreen + 1);
 	if (screen->ndepths > rep.numDepths) {
 	    Xfree (xri);
 	    Xfree (xData);
 	    UnlockDisplay (dpy);
 	    SyncHandle ();
 	    return 0;
+	}
 	rep.numDepths -= screen->ndepths;
 	for (nd = 0; nd < screen->ndepths; nd++)
+	{
 	    depth->depth = xDepth->depth;
 	    depth->nvisuals = xDepth->nPictVisuals;
 	    depth->visuals = visual;
 	    xVisual = (xPictVisual *) (xDepth + 1);
 	    if (depth->nvisuals > rep.numVisuals) {
 		Xfree (xri);
 		Xfree (xData);
 		UnlockDisplay (dpy);
 		SyncHandle ();
 		return 0;
+	    }
 	    rep.numVisuals -= depth->nvisuals;
 	    for (nv = 0; nv < depth->nvisuals; nv++)
+	    {
 		visual->visual = _XRenderFindVisual (dpy, xVisual->visual);
 		visual->format = _XRenderFindFormat (xri, xVisual->format);
 		visual++;
 		xVisual++;
+	    }
 	    depth++;
 	    xDepth = (xPictDepth *) xVisual;
+	}
 	screen++;
 	xScreen = (xPictScreen *) xDepth;
+    }

 @@ -43,26 +43,27 @@ ANY DAMAGES WHATSOEVER RESULTING FROM LO
 WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
 ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
 SOFTWARE.
 ******************************************************************/
 /* $Xorg: dix.h,v 1.4 2001/02/09 02:05:15 xorgcvs Exp $ */
 #ifndef DIX_H
 #define DIX_H
 #include "gc.h"
 #include "window.h"
 #include "input.h"
 #include <stdint.h>
 #define EARLIER -1
 #define SAMETIME 0
 #define LATER 1
 #define NullClient ((ClientPtr) 0)
 #define REQUEST(type) \
 	register type *stuff = (type *)client->requestBuffer
 #define REQUEST_SIZE_MATCH(req)\
     if ((sizeof(req) >> 2) != client->req_len)\
          return(BadLength)