--- XFree86-4.3.0/xc/programs/Xserver/Xi/chgprop.c.da 2007-12-14 10:33:13.000000000 +1000 +++ XFree86-4.3.0/xc/programs/Xserver/Xi/chgprop.c 2007-12-14 10:33:54.000000000 +1000 @@ -81,20 +81,15 @@ register ClientPtr client; { register char n; - register long *p; - register int i; REQUEST(xChangeDeviceDontPropagateListReq); swaps(&stuff->length, n); REQUEST_AT_LEAST_SIZE(xChangeDeviceDontPropagateListReq); swapl(&stuff->window, n); swaps(&stuff->count, n); - p = (long *) &stuff[1]; - for (i=0; icount; i++) - { - swapl(p, n); - p++; - } + REQUEST_FIXED_SIZE(xChangeDeviceDontPropagateListReq, + stuff->count * sizeof(CARD32)); + SwapLongs((CARD32 *) (&stuff[1]), stuff->count); return(ProcXChangeDeviceDontPropagateList(client)); } --- XFree86-4.3.0/xc/programs/Xserver/Xi/sendexev.c.da 2007-12-14 10:40:35.000000000 +1000 +++ XFree86-4.3.0/xc/programs/Xserver/Xi/sendexev.c 2007-12-14 10:42:54.000000000 +1000 @@ -83,7 +83,7 @@ register ClientPtr client; { register char n; - register long *p; + register CARD32 *p; register int i; xEvent eventT; xEvent *eventP; @@ -94,6 +94,11 @@ REQUEST_AT_LEAST_SIZE(xSendExtensionEventReq); swapl(&stuff->destination, n); swaps(&stuff->count, n); + + if (stuff->length != (sizeof(xSendExtensionEventReq) >> 2) + stuff->count + + (stuff->num_events * (sizeof(xEvent) >> 2))) + return BadLength; + eventP = (xEvent *) &stuff[1]; for (i=0; inum_events; i++,eventP++) { @@ -104,12 +109,8 @@ *eventP = eventT; } - p = (long *) (((xEvent *) &stuff[1]) + stuff->num_events); - for (i=0; icount; i++) - { - swapl(p, n); - p++; - } + p = (CARD32 *) (((xEvent *) &stuff[1]) + stuff->num_events); + SwapLongs(p, stuff->count); return(ProcXSendExtensionEvent(client)); } --- XFree86-4.3.0/xc/programs/Xserver/Xi/chgkmap.c.da 2007-12-14 10:30:31.000000000 +1000 +++ XFree86-4.3.0/xc/programs/Xserver/Xi/chgkmap.c 2007-12-14 10:33:06.000000000 +1000 @@ -79,19 +79,14 @@ register ClientPtr client; { register char n; - register long *p; - register int i, count; + register unsigned int count; REQUEST(xChangeDeviceKeyMappingReq); swaps(&stuff->length, n); REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq); - p = (long *) &stuff[1]; count = stuff->keyCodes * stuff->keySymsPerKeyCode; - for (i = 0; i < count; i++) - { - swapl(p, n); - p++; - } + REQUEST_FIXED_SIZE(xChangeDeviceKeyMappingReq, count * sizeof(CARD32)); + SwapLongs((CARD32 *) (&stuff[1]), count); return(ProcXChangeDeviceKeyMapping(client)); } @@ -108,10 +103,14 @@ int ret; unsigned len; DeviceIntPtr dev; + unsigned int count; REQUEST(xChangeDeviceKeyMappingReq); REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq); + count = stuff->keyCodes * stuff->keySymsPerKeyCode; + REQUEST_FIXED_SIZE(xChangeDeviceKeyMappingReq, count * sizeof(CARD32)); + dev = LookupDeviceIntRec (stuff->deviceid); if (dev == NULL) { --- XFree86-4.3.0/xc/programs/Xserver/Xi/grabdevb.c.da 2007-12-14 10:36:17.000000000 +1000 +++ XFree86-4.3.0/xc/programs/Xserver/Xi/grabdevb.c 2007-12-14 10:36:54.000000000 +1000 @@ -80,8 +80,6 @@ register ClientPtr client; { register char n; - register long *p; - register int i; REQUEST(xGrabDeviceButtonReq); swaps(&stuff->length, n); @@ -89,13 +87,9 @@ swapl(&stuff->grabWindow, n); swaps(&stuff->modifiers, n); swaps(&stuff->event_count, n); - p = (long *) &stuff[1]; - for (i=0; ievent_count; i++) - { - swapl(p, n); - p++; - } - + REQUEST_FIXED_SIZE(xGrabDeviceButtonReq, + stuff->event_count * sizeof(CARD32)); + SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count); return(ProcXGrabDeviceButton(client)); } --- XFree86-4.3.0/xc/programs/Xserver/Xi/selectev.c.da 2007-12-14 10:39:21.000000000 +1000 +++ XFree86-4.3.0/xc/programs/Xserver/Xi/selectev.c 2007-12-14 10:40:29.000000000 +1000 @@ -84,20 +84,15 @@ register ClientPtr client; { register char n; - register long *p; - register int i; REQUEST(xSelectExtensionEventReq); swaps(&stuff->length, n); REQUEST_AT_LEAST_SIZE(xSelectExtensionEventReq); swapl(&stuff->window, n); swaps(&stuff->count, n); - p = (long *) &stuff[1]; - for (i=0; icount; i++) - { - swapl(p, n); - p++; - } + REQUEST_FIXED_SIZE(xSelectExtensionEventReq, + stuff->count * sizeof(CARD32)); + SwapLongs((CARD32 *) (&stuff[1]), stuff->count); return(ProcXSelectExtensionEvent(client)); } --- XFree86-4.3.0/xc/programs/Xserver/Xi/grabdevk.c.da 2007-12-14 10:37:46.000000000 +1000 +++ XFree86-4.3.0/xc/programs/Xserver/Xi/grabdevk.c 2007-12-14 10:38:15.000000000 +1000 @@ -80,8 +80,6 @@ register ClientPtr client; { register char n; - register long *p; - register int i; REQUEST(xGrabDeviceKeyReq); swaps(&stuff->length, n); @@ -89,12 +87,8 @@ swapl(&stuff->grabWindow, n); swaps(&stuff->modifiers, n); swaps(&stuff->event_count, n); - p = (long *) &stuff[1]; - for (i=0; ievent_count; i++) - { - swapl(p, n); - p++; - } + REQUEST_FIXED_SIZE(xGrabDeviceKeyReq, stuff->event_count * sizeof(CARD32)); + SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count); return(ProcXGrabDeviceKey(client)); } --- XFree86-4.3.0/xc/programs/Xserver/Xi/grabdev.c.da 2007-12-14 10:34:05.000000000 +1000 +++ XFree86-4.3.0/xc/programs/Xserver/Xi/grabdev.c 2007-12-14 10:36:08.000000000 +1000 @@ -83,8 +83,6 @@ register ClientPtr client; { register char n; - register long *p; - register int i; REQUEST(xGrabDeviceReq); swaps(&stuff->length, n); @@ -92,13 +90,11 @@ swapl(&stuff->grabWindow, n); swapl(&stuff->time, n); swaps(&stuff->event_count, n); - p = (long *) &stuff[1]; - for (i=0; ievent_count; i++) - { - swapl(p, n); - p++; - } + if (stuff->length != (sizeof(xGrabDeviceReq) >> 2) + stuff->event_count) + return BadLength; + + SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count); return(ProcXGrabDevice(client)); } --- XFree86-4.3.0/xc/programs/Xserver/Xi/chgfctl.c.da 2007-12-14 10:29:58.000000000 +1000 +++ XFree86-4.3.0/xc/programs/Xserver/Xi/chgfctl.c 2007-12-14 10:30:19.000000000 +1000 @@ -502,7 +502,6 @@ xStringFeedbackCtl *f; { register char n; - register long *p; int i, j; KeySym *syms, *sup_syms; @@ -510,12 +509,7 @@ if (client->swapped) { swaps(&f->length,n); /* swapped num_keysyms in calling proc */ - p = (long *) (syms); - for (i=0; inum_keysyms; i++) - { - swapl(p, n); - p++; - } + SwapLongs((CARD32 *) syms, f->num_keysyms); } if (f->num_keysyms > s->ctrl.max_symbols)