--- XFree86-4.3.0/xc/programs/Xserver/Xi/chgprop.c.da	2007-12-14 10:33:13.000000000 +1000
+++ XFree86-4.3.0/xc/programs/Xserver/Xi/chgprop.c	2007-12-14 10:33:54.000000000 +1000
@@ -81,20 +81,15 @@
     register ClientPtr client;
     {
     register char n;
-    register long *p;
-    register int i;
 
     REQUEST(xChangeDeviceDontPropagateListReq);
     swaps(&stuff->length, n);
     REQUEST_AT_LEAST_SIZE(xChangeDeviceDontPropagateListReq);
     swapl(&stuff->window, n);
     swaps(&stuff->count, n);
-    p = (long *) &stuff[1];
-    for (i=0; i<stuff->count; i++)
-        {
-        swapl(p, n);
-	p++;
-        }
+    REQUEST_FIXED_SIZE(xChangeDeviceDontPropagateListReq,
+                       stuff->count * sizeof(CARD32));
+    SwapLongs((CARD32 *) (&stuff[1]), stuff->count);
     return(ProcXChangeDeviceDontPropagateList(client));
     }
 
--- XFree86-4.3.0/xc/programs/Xserver/Xi/sendexev.c.da	2007-12-14 10:40:35.000000000 +1000
+++ XFree86-4.3.0/xc/programs/Xserver/Xi/sendexev.c	2007-12-14 10:42:54.000000000 +1000
@@ -83,7 +83,7 @@
     register ClientPtr client;
     {
     register char n;
-    register long *p;
+    register CARD32 *p;
     register int i;
     xEvent eventT;
     xEvent *eventP;
@@ -94,6 +94,11 @@
     REQUEST_AT_LEAST_SIZE(xSendExtensionEventReq);
     swapl(&stuff->destination, n);
     swaps(&stuff->count, n);
+
+    if (stuff->length != (sizeof(xSendExtensionEventReq) >> 2) + stuff->count +
+       (stuff->num_events * (sizeof(xEvent) >> 2)))
+       return BadLength;
+
     eventP = (xEvent *) &stuff[1];
     for (i=0; i<stuff->num_events; i++,eventP++)
         {
@@ -104,12 +109,8 @@
 	*eventP = eventT;
 	}
 
-    p = (long *) (((xEvent *) &stuff[1]) + stuff->num_events);
-    for (i=0; i<stuff->count; i++)
-        {
-        swapl(p, n);
-	p++;
-        }
+    p = (CARD32 *) (((xEvent *) &stuff[1]) + stuff->num_events);
+    SwapLongs(p, stuff->count);
     return(ProcXSendExtensionEvent(client));
     }
 
--- XFree86-4.3.0/xc/programs/Xserver/Xi/chgkmap.c.da	2007-12-14 10:30:31.000000000 +1000
+++ XFree86-4.3.0/xc/programs/Xserver/Xi/chgkmap.c	2007-12-14 10:33:06.000000000 +1000
@@ -79,19 +79,14 @@
     register ClientPtr client;
     {
     register char n;
-    register long *p;
-    register int i, count;
+    register unsigned int count;
 
     REQUEST(xChangeDeviceKeyMappingReq);
     swaps(&stuff->length, n);
     REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq);
-    p = (long *) &stuff[1];
     count = stuff->keyCodes * stuff->keySymsPerKeyCode;
-    for (i = 0; i < count; i++)
-        {
-        swapl(p, n);
-	p++;
-        }
+    REQUEST_FIXED_SIZE(xChangeDeviceKeyMappingReq, count * sizeof(CARD32));
+    SwapLongs((CARD32 *) (&stuff[1]), count);
     return(ProcXChangeDeviceKeyMapping(client));
     }
 
@@ -108,10 +103,14 @@
     int	ret;
     unsigned len;
     DeviceIntPtr dev;
+    unsigned int count;
 
     REQUEST(xChangeDeviceKeyMappingReq);
     REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq);
 
+    count = stuff->keyCodes * stuff->keySymsPerKeyCode;
+    REQUEST_FIXED_SIZE(xChangeDeviceKeyMappingReq, count * sizeof(CARD32));
+
     dev = LookupDeviceIntRec (stuff->deviceid);
     if (dev == NULL)
 	{
--- XFree86-4.3.0/xc/programs/Xserver/Xi/grabdevb.c.da	2007-12-14 10:36:17.000000000 +1000
+++ XFree86-4.3.0/xc/programs/Xserver/Xi/grabdevb.c	2007-12-14 10:36:54.000000000 +1000
@@ -80,8 +80,6 @@
     register ClientPtr client;
     {
     register char n;
-    register long *p;
-    register int i;
 
     REQUEST(xGrabDeviceButtonReq);
     swaps(&stuff->length, n);
@@ -89,13 +87,9 @@
     swapl(&stuff->grabWindow, n);
     swaps(&stuff->modifiers, n);
     swaps(&stuff->event_count, n);
-    p = (long *) &stuff[1];
-    for (i=0; i<stuff->event_count; i++)
-        {
-        swapl(p, n);
-	p++;
-        }
-
+    REQUEST_FIXED_SIZE(xGrabDeviceButtonReq,
+                      stuff->event_count * sizeof(CARD32));
+    SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);
     return(ProcXGrabDeviceButton(client));
     }
 
--- XFree86-4.3.0/xc/programs/Xserver/Xi/selectev.c.da	2007-12-14 10:39:21.000000000 +1000
+++ XFree86-4.3.0/xc/programs/Xserver/Xi/selectev.c	2007-12-14 10:40:29.000000000 +1000
@@ -84,20 +84,15 @@
 register ClientPtr client;
     {
     register char n;
-    register long *p;
-    register int i;
 
     REQUEST(xSelectExtensionEventReq);
     swaps(&stuff->length, n);
     REQUEST_AT_LEAST_SIZE(xSelectExtensionEventReq);
     swapl(&stuff->window, n);
     swaps(&stuff->count, n);
-    p = (long *) &stuff[1];
-    for (i=0; i<stuff->count; i++)
-        {
-        swapl(p, n);
-	p++;
-        }
+    REQUEST_FIXED_SIZE(xSelectExtensionEventReq,
+                      stuff->count * sizeof(CARD32));
+    SwapLongs((CARD32 *) (&stuff[1]), stuff->count);
     return(ProcXSelectExtensionEvent(client));
     }
 
--- XFree86-4.3.0/xc/programs/Xserver/Xi/grabdevk.c.da	2007-12-14 10:37:46.000000000 +1000
+++ XFree86-4.3.0/xc/programs/Xserver/Xi/grabdevk.c	2007-12-14 10:38:15.000000000 +1000
@@ -80,8 +80,6 @@
     register ClientPtr client;
     {
     register char n;
-    register long *p;
-    register int i;
 
     REQUEST(xGrabDeviceKeyReq);
     swaps(&stuff->length, n);
@@ -89,12 +87,8 @@
     swapl(&stuff->grabWindow, n);
     swaps(&stuff->modifiers, n);
     swaps(&stuff->event_count, n);
-    p = (long *) &stuff[1];
-    for (i=0; i<stuff->event_count; i++)
-        {
-        swapl(p, n);
-	p++;
-        }
+    REQUEST_FIXED_SIZE(xGrabDeviceKeyReq, stuff->event_count * sizeof(CARD32));
+    SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);
     return(ProcXGrabDeviceKey(client));
     }
 
--- XFree86-4.3.0/xc/programs/Xserver/Xi/grabdev.c.da	2007-12-14 10:34:05.000000000 +1000
+++ XFree86-4.3.0/xc/programs/Xserver/Xi/grabdev.c	2007-12-14 10:36:08.000000000 +1000
@@ -83,8 +83,6 @@
     register ClientPtr client;
     {
     register char n;
-    register long *p;
-    register int i;
 
     REQUEST(xGrabDeviceReq);
     swaps(&stuff->length, n);
@@ -92,13 +90,11 @@
     swapl(&stuff->grabWindow, n);
     swapl(&stuff->time, n);
     swaps(&stuff->event_count, n);
-    p = (long *) &stuff[1];
-    for (i=0; i<stuff->event_count; i++)
-        {
-        swapl(p, n);
-	p++;
-        }
 
+    if (stuff->length != (sizeof(xGrabDeviceReq) >> 2) + stuff->event_count)
+       return BadLength;
+    
+    SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);
     return(ProcXGrabDevice(client));
     }
 
--- XFree86-4.3.0/xc/programs/Xserver/Xi/chgfctl.c.da	2007-12-14 10:29:58.000000000 +1000
+++ XFree86-4.3.0/xc/programs/Xserver/Xi/chgfctl.c	2007-12-14 10:30:19.000000000 +1000
@@ -502,7 +502,6 @@
     xStringFeedbackCtl 	*f;
     {
     register char n;
-    register long *p;
     int		i, j;
     KeySym	*syms, *sup_syms;
 
@@ -510,12 +509,7 @@
     if (client->swapped)
 	{
 	swaps(&f->length,n);	/* swapped num_keysyms in calling proc */
-	p = (long *) (syms);
-	for (i=0; i<f->num_keysyms; i++)
-	    {
-	    swapl(p, n);
-	    p++;
-	    }
+	SwapLongs((CARD32 *) syms, f->num_keysyms);
 	}
 
     if (f->num_keysyms > s->ctrl.max_symbols)