Updated to libXfont 1.4.8

10 files changed, 441 insertions, 210 deletions

diff --git a/libXfont/src/FreeType/ftfuncs.c b/libXfont/src/FreeType/ftfuncs.c
index 44e5e0288..bca58188b 100644
--- a/libXfont/src/FreeType/ftfuncs.c
+++ b/libXfont/src/FreeType/ftfuncs.c
@@ -1865,7 +1865,7 @@ FreeTypeAddProperties(FTFontPtr font, FontScalablePtr vals, FontInfoPtr info,
     i++;
 
     info->props[i].name  = MakeAtom("RASTERIZER_NAME", 15, TRUE);
-    info->props[i].value = MakeAtom("FreeType", 10, TRUE);
+    info->props[i].value = MakeAtom("FreeType", 8, TRUE);
     info->isStringProp[i] = 1;
     i++;
 
diff --git a/libXfont/src/FreeType/xttcap.c b/libXfont/src/FreeType/xttcap.c
index 104dc89e4..cee752ebf 100644
--- a/libXfont/src/FreeType/xttcap.c
+++ b/libXfont/src/FreeType/xttcap.c
@@ -621,7 +621,6 @@ SPropRecValList_add_by_font_cap(SDynPropRecValList *pThisList,
                     int len = term-p-1;
                     char *value;
 
-                    len = term-p-1;
                     value=malloc(len+1);
                     memcpy(value, p+1, len);
                     value[len]='\0';
diff --git a/libXfont/src/builtins/fpe.c b/libXfont/src/builtins/fpe.c
index 403dbb7db..689f22a52 100644
--- a/libXfont/src/builtins/fpe.c
+++ b/libXfont/src/builtins/fpe.c
@@ -15,7 +15,7 @@
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL SuSE
  * BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN 
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
  * Author:  Keith Packard, SuSE, Inc.
@@ -54,9 +54,6 @@ BuiltinInitFPE (FontPathElementPtr fpe)
 static int
 BuiltinResetFPE (FontPathElementPtr fpe)
 {
-    FontDirectoryPtr	dir;
-
-    dir = (FontDirectoryPtr) fpe->private;
     /* builtins can't change! */
     return Successful;
 }
diff --git a/libXfont/src/fc/fsconvert.c b/libXfont/src/fc/fsconvert.c
index 15c5e4200..7a6033119 100644
--- a/libXfont/src/fc/fsconvert.c
+++ b/libXfont/src/fc/fsconvert.c
@@ -86,7 +86,7 @@ _fs_init_fontinfo(FSFpePtr conn, FontInfoPtr pfi)
 }
 
 int
-_fs_convert_props(fsPropInfo *pi, fsPropOffset *po, pointer pd, 
+_fs_convert_props(fsPropInfo *pi, fsPropOffset *po, pointer pd,
 		  FontInfoPtr pfi)
 {
     FontPropPtr dprop;
@@ -102,22 +102,26 @@ _fs_convert_props(fsPropInfo *pi, fsPropOffset *po, pointer pd,
 
     nprops = pfi->nprops = pi->num_offsets;
 
-    if (nprops < 0 
-	|| nprops > SIZE_MAX/(sizeof(FontPropRec) + sizeof(char))) 
+    if (nprops < 0
+	|| nprops > SIZE_MAX/(sizeof(FontPropRec) + sizeof(char)))
 	return -1;
-	   
+
     dprop = malloc(sizeof(FontPropRec) * nprops + sizeof (char) * nprops);
     if (!dprop)
 	return -1;
-    
+
     is_str = (char *) (dprop + nprops);
     pfi->props = dprop;
     pfi->isStringProp = is_str;
 
     off_adr = (char *)po;
-    for (i = 0; i < nprops; i++, dprop++, is_str++) 
+    for (i = 0; i < nprops; i++, dprop++, is_str++)
     {
 	memcpy(&local_off, off_adr, SIZEOF(fsPropOffset));
+	if ((local_off.name.position >= pi->data_len) ||
+		(local_off.name.length >
+		 (pi->data_len - local_off.name.position)))
+	    goto bail;
 	dprop->name = MakeAtom(&pdc[local_off.name.position],
 			       local_off.name.length, 1);
 	if (local_off.type != PropTypeString) {
@@ -125,10 +129,15 @@ _fs_convert_props(fsPropInfo *pi, fsPropOffset *po, pointer pd,
 	    dprop->value = local_off.value.position;
 	} else {
 	    *is_str = TRUE;
+	    if ((local_off.value.position >= pi->data_len) ||
+		(local_off.value.length >
+		 (pi->data_len - local_off.value.position)))
+		goto bail;
 	    dprop->value = (INT32) MakeAtom(&pdc[local_off.value.position],
 					    local_off.value.length, 1);
 	    if (dprop->value == BAD_RESOURCE)
 	    {
+	      bail:
 		free (pfi->props);
 		pfi->nprops = 0;
 		pfi->props = 0;
@@ -154,8 +163,8 @@ _fs_free_props (FontInfoPtr pfi)
 }
 
 int
-_fs_convert_lfwi_reply(FSFpePtr conn, FontInfoPtr pfi, 
-		       fsListFontsWithXInfoReply *fsrep, 
+_fs_convert_lfwi_reply(FSFpePtr conn, FontInfoPtr pfi,
+		       fsListFontsWithXInfoReply *fsrep,
 		       fsPropInfo *pi, fsPropOffset *po, pointer pd)
 {
     fsUnpack_XFontInfoHeader(fsrep, pfi);
@@ -188,8 +197,8 @@ _fs_convert_lfwi_reply(FSFpePtr conn, FontInfoPtr pfi,
  */
 /* ARGSUSED */
 int
-fs_build_range(FontPtr pfont, Bool range_flag, unsigned int count, 
-	       int item_size, unsigned char *data, int *nranges, 
+fs_build_range(FontPtr pfont, Bool range_flag, unsigned int count,
+	       int item_size, unsigned char *data, int *nranges,
 	       fsRange **ranges)
 {
     FSFontDataPtr fsd = (FSFontDataPtr) (pfont->fpePrivate);
@@ -350,7 +359,7 @@ fs_build_range(FontPtr pfont, Bool range_flag, unsigned int count,
    requests needs to be cancelled. */
 
 void
-_fs_clean_aborted_loadglyphs(FontPtr pfont, int num_expected_ranges, 
+_fs_clean_aborted_loadglyphs(FontPtr pfont, int num_expected_ranges,
 			     fsRange *expected_ranges)
 {
     register FSFontPtr fsfont;
@@ -396,8 +405,8 @@ _fs_clean_aborted_loadglyphs(FontPtr pfont, int num_expected_ranges,
 }
 
 static int
-_fs_get_glyphs(FontPtr pFont, unsigned long count, unsigned char *chars, 
-	       FontEncoding charEncoding, 
+_fs_get_glyphs(FontPtr pFont, unsigned long count, unsigned char *chars,
+	       FontEncoding charEncoding,
 	       unsigned long *glyphCount, /* RETURN */
 	       CharInfoPtr *glyphs) 	  /* RETURN  */
 {
@@ -508,8 +517,8 @@ _fs_get_glyphs(FontPtr pFont, unsigned long count, unsigned char *chars,
 
 
 static int
-_fs_get_metrics(FontPtr pFont, unsigned long count, unsigned char *chars, 
-		FontEncoding charEncoding, 
+_fs_get_metrics(FontPtr pFont, unsigned long count, unsigned char *chars,
+		FontEncoding charEncoding,
 		unsigned long *glyphCount, /* RETURN */
 		xCharInfo **glyphs) 	   /* RETURN */
 {
@@ -620,15 +629,15 @@ _fs_unload_font(FontPtr pfont)
 	fsdata->glyphs = glyphs->next;
 	free (glyphs);
     }
-    
+
     /* XXX we may get called after the resource DB has been cleaned out */
     if (find_old_font(fsd->fontid))
 	DeleteFontClientID (fsd->fontid);
-    
+
     _fs_free_props (&pfont->info);
-    
+
     free(fsdata);
-	    
+
     DestroyFontRec(pfont);
 }
 
@@ -656,11 +665,11 @@ fs_create_font (FontPathElementPtr  fpe,
     fsd = (FSFontDataPtr) (fsfont + 1);
     bzero((char *) fsfont, sizeof(FSFontRec));
     bzero((char *) fsd, sizeof(FSFontDataRec));
-    
+
     pfont->fpe = fpe;
     pfont->fontPrivate = (pointer) fsfont;
     pfont->fpePrivate = (pointer) fsd;
-    
+
     /* These font components will be needed in packGlyphs */
     CheckFSFormat(format, BitmapFormatMaskBit |
 		  BitmapFormatMaskByte |
@@ -676,17 +685,17 @@ fs_create_font (FontPathElementPtr  fpe,
     pfont->byte = byte;
     pfont->scan = scan;
     pfont->glyph = glyph;
-    
+
     pfont->info.nprops = 0;
     pfont->info.props = 0;
     pfont->info.isStringProp = 0;
-    
+
     /* set font function pointers */
     pfont->get_glyphs = _fs_get_glyphs;
     pfont->get_metrics = _fs_get_metrics;
     pfont->unload_font = _fs_unload_font;
     pfont->unload_glyphs = NULL;
-    
+
     /* set the FPE private information */
     fsd->format = format;
     fsd->fmask = fmask;
@@ -694,9 +703,9 @@ fs_create_font (FontPathElementPtr  fpe,
     memcpy (fsd->name, name, namelen);
     fsd->name[namelen] = '\0';
     fsd->fontid = GetNewFontClientID ();
-    
+
     /* save the ID */
-    if (!StoreFontClientFont(pfont, fsd->fontid)) 
+    if (!StoreFontClientFont(pfont, fsd->fontid))
     {
 	free (fsfont);
 	DestroyFontRec (pfont);
@@ -712,7 +721,12 @@ fs_alloc_glyphs (FontPtr pFont, int size)
     FSGlyphPtr	glyphs;
     FSFontPtr	fsfont = (FSFontPtr) pFont->fontPrivate;
 
-    glyphs = malloc (sizeof (FSGlyphRec) + size);
+    if (size < (INT_MAX - sizeof (FSGlyphRec)))
+	glyphs = malloc (sizeof (FSGlyphRec) + size);
+    else
+	glyphs = NULL;
+    if (glyphs == NULL)
+	return NULL;
     glyphs->next = fsfont->glyphs;
     fsfont->glyphs = glyphs;
     return (pointer) (glyphs + 1);
diff --git a/libXfont/src/fc/fserve.c b/libXfont/src/fc/fserve.c
index b02b0b749..1e1093cd5 100644
--- a/libXfont/src/fc/fserve.c
+++ b/libXfont/src/fc/fserve.c
@@ -70,6 +70,7 @@ in this Software without prior written authorization from The Open Group.
 #include	"fservestr.h"
 #include	<X11/fonts/fontutil.h>
 #include	<errno.h>
+#include	<limits.h>
 
 #include	<time.h>
 #define Time_t time_t
@@ -84,28 +85,37 @@ in this Software without prior written authorization from The Open Group.
 #define MIN(a,b)    ((a)<(b)?(a):(b))
 #endif
 #define TimeCmp(a,c,b)	((int) ((a) - (b)) c 0)
-    
+
 #define NONZEROMETRICS(pci) ((pci)->leftSideBearing || \
 			     (pci)->rightSideBearing || \
 			     (pci)->ascent || \
 			     (pci)->descent || \
 			     (pci)->characterWidth)
 
+/*
+ * SIZEOF(r) is in bytes, length fields in the protocol are in 32-bit words,
+ * so this converts for doing size comparisons.
+ */
+#define LENGTHOF(r)	(SIZEOF(r) >> 2)
+
+/* Somewhat arbitrary limit on maximum reply size we'll try to read. */
+#define MAX_REPLY_LENGTH	((64 * 1024 * 1024) >> 2)
+
 extern void ErrorF(const char *f, ...);
 
 static int fs_read_glyphs ( FontPathElementPtr fpe, FSBlockDataPtr blockrec );
 static int fs_read_list ( FontPathElementPtr fpe, FSBlockDataPtr blockrec );
-static int fs_read_list_info ( FontPathElementPtr fpe, 
+static int fs_read_list_info ( FontPathElementPtr fpe,
 			       FSBlockDataPtr blockrec );
 
 extern fd_set _fs_fd_mask;
 
-static void fs_block_handler ( pointer data, OSTimePtr wt, 
+static void fs_block_handler ( pointer data, OSTimePtr wt,
 			       pointer LastSelectMask );
 static int fs_wakeup ( FontPathElementPtr fpe, unsigned long *mask );
 
 /*
- * List of all FPEs 
+ * List of all FPEs
  */
 static FSFpePtr fs_fpes;
 /*
@@ -114,7 +124,7 @@ static FSFpePtr fs_fpes;
 static CARD32	fs_blockState;
 
 static int _fs_restart_connection ( FSFpePtr conn );
-static void fs_send_query_bitmaps ( FontPathElementPtr fpe, 
+static void fs_send_query_bitmaps ( FontPathElementPtr fpe,
 				   FSBlockDataPtr blockrec );
 static int fs_send_close_font ( FontPathElementPtr fpe, Font id );
 static void fs_client_died ( pointer client, FontPathElementPtr fpe );
@@ -206,9 +216,22 @@ _fs_add_rep_log (FSFpePtr conn, fsGenericReply *rep)
 		 rep->sequenceNumber,
 		 conn->reqbuffer[i].opcode);
 }
+
+#define _fs_reply_failed(rep, name, op) do {                            \
+    if (rep) {                                                          \
+        if (rep->type == FS_Error)                                      \
+            fprintf (stderr, "Error: %d Request: %s\n",                 \
+                     ((fsError *)rep)->request, #name);                 \
+        else                                                            \
+            fprintf (stderr, "Bad Length for %s Reply: %d %s %d\n",     \
+                     #name, rep->length, op, LENGTHOF(name));           \
+    }                                                                   \
+} while (0)
+
 #else
 #define _fs_add_req_log(conn,op)    ((conn)->current_seq++)
 #define _fs_add_rep_log(conn,rep)
+#define _fs_reply_failed(rep,name,op)
 #endif
 
 static Bool
@@ -240,7 +263,7 @@ _fs_client_resolution(FSFpePtr conn)
     }
 }
 
-/* 
+/*
  * close font server and remove any state associated with
  * this connection - this includes any client records.
  */
@@ -251,8 +274,8 @@ fs_close_conn(FSFpePtr conn)
     FSClientPtr	client, nclient;
 
     _fs_close_server (conn);
-    
-    for (client = conn->clients; client; client = nclient) 
+
+    for (client = conn->clients; client; client = nclient)
     {
 	nclient = client->next;
 	free (client);
@@ -308,7 +331,7 @@ fs_init_fpe(FontPathElementPtr fpe)
 		err = Successful;
 	}
     }
-    
+
     if (err == Successful)
     {
 #ifdef NCD
@@ -348,7 +371,7 @@ static int
 fs_free_fpe(FontPathElementPtr fpe)
 {
     FSFpePtr    conn = (FSFpePtr) fpe->private, *prev;
-    
+
     /* unhook from chain of all font servers */
     for (prev = &fs_fpes; *prev; prev = &(*prev)->next)
     {
@@ -410,7 +433,7 @@ fs_new_block_rec(FontPathElementPtr fpe, pointer client, int type)
     blockrec->type = type;
     blockrec->depending = 0;
     blockrec->next = (FSBlockDataPtr) 0;
-    
+
     /* stick it on the end of the list (since its expected last) */
     for (prev = &conn->blockedRequests; *prev; prev = &(*prev)->next)
 	;
@@ -423,7 +446,7 @@ static void
 _fs_set_pending_reply (FSFpePtr conn)
 {
     FSBlockDataPtr  blockrec;
-    
+
     for (blockrec = conn->blockedRequests; blockrec; blockrec = blockrec->next)
 	if (blockrec->errcode == StillWorking)
 	    break;
@@ -442,7 +465,7 @@ _fs_remove_block_rec(FSFpePtr conn, FSBlockDataPtr blockrec)
     FSBlockDataPtr *prev;
 
     for (prev = &conn->blockedRequests; *prev; prev = &(*prev)->next)
-	if (*prev == blockrec) 
+	if (*prev == blockrec)
 	{
 	    *prev = blockrec->next;
 	    break;
@@ -461,7 +484,7 @@ static void
 _fs_signal_clients_depending(FSClientsDependingPtr *clients_depending)
 {
     FSClientsDependingPtr p;
-    
+
     while ((p = *clients_depending))
     {
 	*clients_depending = p->next;
@@ -474,14 +497,14 @@ static int
 _fs_add_clients_depending(FSClientsDependingPtr *clients_depending, pointer client)
 {
     FSClientsDependingPtr   new, cd;
-    
-    for (; (cd = *clients_depending); 
+
+    for (; (cd = *clients_depending);
 	 clients_depending = &(*clients_depending)->next)
     {
-	if (cd->client == client) 
+	if (cd->client == client)
 	    return Suspended;
     }
-    
+
     new = malloc (sizeof (FSClientsDependingRec));
     if (!new)
 	return BadAlloc;
@@ -503,17 +526,17 @@ _fs_clean_aborted_blockrec(FSFpePtr conn, FSBlockDataPtr blockrec)
     switch(blockrec->type) {
     case FS_OPEN_FONT: {
 	FSBlockedFontPtr bfont = (FSBlockedFontPtr)blockrec->data;
-	
+
 	fs_cleanup_bfont (bfont);
 	_fs_signal_clients_depending(&bfont->clients_depending);
 	break;
     }
     case FS_LOAD_GLYPHS: {
 	FSBlockedGlyphPtr bglyph = (FSBlockedGlyphPtr)blockrec->data;
-	
+
 	_fs_clean_aborted_loadglyphs(bglyph->pfont,
 				     bglyph->num_expected_ranges,
-				     bglyph->expected_ranges); 
+				     bglyph->expected_ranges);
 	_fs_signal_clients_depending(&bglyph->clients_depending);
 	break;
     }
@@ -550,12 +573,12 @@ fs_cleanup_bfont (FSBlockedFontPtr bfont)
     if (bfont->pfont)
     {
 	fsd = (FSFontDataRec *) bfont->pfont->fpePrivate;
-    
+
 	/* make sure the FS knows we choked on it */
 	fs_send_close_font(bfont->pfont->fpe, bfont->fontid);
-	
+
 	/*
-	 * Either unload the font if it's being opened for 
+	 * Either unload the font if it's being opened for
 	 * the first time, or smash the generation field to
 	 * mark this font as an orphan
 	 */
@@ -590,16 +613,31 @@ fs_get_reply (FSFpePtr conn, int *error)
 	*error = FSIO_BLOCK;
 	return 0;
     }
-    
+
     ret = _fs_start_read (conn, sizeof (fsGenericReply), &buf);
     if (ret != FSIO_READY)
     {
 	*error = FSIO_BLOCK;
 	return 0;
     }
-    
+
     rep = (fsGenericReply *) buf;
 
+    /*
+     * Refuse to accept replies longer than a maximum reasonable length,
+     * before we pass to _fs_start_read, since it will try to resize the
+     * incoming connection buffer to this size.  Also avoids integer overflow
+     * on 32-bit systems.
+     */
+    if (rep->length > MAX_REPLY_LENGTH)
+    {
+	ErrorF("fserve: reply length %d > MAX_REPLY_LENGTH, disconnecting"
+	       " from font server\n", rep->length);
+	_fs_connection_died (conn);
+	*error = FSIO_ERROR;
+	return 0;
+    }
+
     ret = _fs_start_read (conn, rep->length << 2, &buf);
     if (ret != FSIO_READY)
     {
@@ -608,7 +646,7 @@ fs_get_reply (FSFpePtr conn, int *error)
     }
 
     *error = FSIO_READY;
-    
+
     return (fsGenericReply *) buf;
 }
 
@@ -616,7 +654,7 @@ static Bool
 fs_reply_ready (FSFpePtr conn)
 {
     fsGenericReply  *rep;
-    
+
     if (conn->fs_fd == -1 || !FD_ISSET (conn->fs_fd, &_fs_fd_mask))
 	return FALSE;
     if (fs_data_read (conn) < sizeof (fsGenericReply))
@@ -651,10 +689,10 @@ static int
 fs_await_reply (FSFpePtr conn)
 {
     int		    ret;
-    
+
     if (conn->blockState & FS_COMPLETE_REPLY)
 	return FSIO_READY;
-    
+
     while (!fs_get_reply (conn, &ret))
     {
 	if (ret != FSIO_BLOCK)
@@ -682,16 +720,18 @@ fs_read_open_font(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
     int			    ret;
 
     rep = (fsOpenBitmapFontReply *) fs_get_reply (conn, &ret);
-    if (!rep || rep->type == FS_Error)
+    if (!rep || rep->type == FS_Error ||
+	(rep->length != LENGTHOF(fsOpenBitmapFontReply)))
     {
 	if (ret == FSIO_BLOCK)
 	    return StillWorking;
 	if (rep)
 	    _fs_done_read (conn, rep->length << 2);
 	fs_cleanup_bfont (bfont);
+	_fs_reply_failed (rep, fsOpenBitmapFontReply, "!=");
 	return BadFontName;
     }
-	   
+
     /* If we're not reopening a font and FS detected a duplicate font
        open request, replace our reference to the new font with a
        reference to an existing font (possibly one not finished
@@ -701,10 +741,10 @@ fs_read_open_font(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
        if we we decide (in fs_read_query_info()) that we don't like what
        we got. */
 
-    if (rep->otherid && !(bfont->flags & FontReopen)) 
+    if (rep->otherid && !(bfont->flags & FontReopen))
     {
 	fs_cleanup_bfont (bfont);
-	
+
 	/* Find old font if we're completely done getting it from server. */
 	bfont->pfont = find_old_font(rep->otherid);
 	bfont->freeFont = FALSE;
@@ -715,12 +755,12 @@ fs_read_open_font(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
 	 */
 	for (blockOrig = conn->blockedRequests;
 		blockOrig;
-		blockOrig = blockOrig->next) 
+		blockOrig = blockOrig->next)
 	{
-	    if (blockOrig != blockrec && blockOrig->type == FS_OPEN_FONT) 
+	    if (blockOrig != blockrec && blockOrig->type == FS_OPEN_FONT)
 	    {
 		origBfont = (FSBlockedFontPtr) blockOrig->data;
-		if (origBfont->fontid == rep->otherid) 
+		if (origBfont->fontid == rep->otherid)
 		{
 		    blockrec->depending = blockOrig->depending;
 		    blockOrig->depending = blockrec;
@@ -757,7 +797,7 @@ static Bool
 fs_fonts_match (FontInfoPtr pInfo1, FontInfoPtr pInfo2)
 {
     int	    i;
-    
+
     if (pInfo1->firstCol != pInfo2->firstCol ||
 	pInfo1->lastCol != pInfo2->lastCol ||
 	pInfo1->firstRow != pInfo2->firstRow ||
@@ -815,6 +855,7 @@ fs_read_query_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
     FSFpePtr		conn = (FSFpePtr) fpe->private;
     fsQueryXInfoReply	*rep;
     char		*buf;
+    long		bufleft; /* length of reply left to use */
     fsPropInfo		*pi;
     fsPropOffset	*po;
     pointer		pd;
@@ -824,16 +865,18 @@ fs_read_query_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
     int			ret;
 
     rep = (fsQueryXInfoReply *) fs_get_reply (conn, &ret);
-    if (!rep || rep->type == FS_Error)
+    if (!rep || rep->type == FS_Error ||
+	(rep->length < LENGTHOF(fsQueryXInfoReply)))
     {
 	if (ret == FSIO_BLOCK)
 	    return StillWorking;
 	if (rep)
 	    _fs_done_read (conn, rep->length << 2);
 	fs_cleanup_bfont (bfont);
+	_fs_reply_failed (rep, fsQueryXInfoReply, "<");
 	return BadFontName;
     }
-	
+
     /* If this is a reopen, accumulate the query info into a dummy
        font and compare to our original data. */
     if (bfont->flags & FontReopen)
@@ -843,27 +886,63 @@ fs_read_query_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
 
     buf = (char *) rep;
     buf += SIZEOF(fsQueryXInfoReply);
-    
+
+    bufleft = rep->length << 2;
+    bufleft -= SIZEOF(fsQueryXInfoReply);
+
     /* move the data over */
     fsUnpack_XFontInfoHeader(rep, pInfo);
-    
+
     /* compute accelerators */
     _fs_init_fontinfo(conn, pInfo);
 
     /* Compute offsets into the reply */
+    if (bufleft < SIZEOF(fsPropInfo))
+    {
+	ret = -1;
+#ifdef DEBUG
+	fprintf(stderr, "fsQueryXInfo: bufleft (%ld) < SIZEOF(fsPropInfo)\n",
+		bufleft);
+#endif
+	goto bail;
+    }
     pi = (fsPropInfo *) buf;
     buf += SIZEOF (fsPropInfo);
-    
+    bufleft -= SIZEOF(fsPropInfo);
+
+    if ((bufleft / SIZEOF(fsPropOffset)) < pi->num_offsets)
+    {
+	ret = -1;
+#ifdef DEBUG
+	fprintf(stderr,
+		"fsQueryXInfo: bufleft (%ld) / SIZEOF(fsPropOffset) < %d\n",
+		bufleft, pi->num_offsets);
+#endif
+	goto bail;
+    }
     po = (fsPropOffset *) buf;
     buf += pi->num_offsets * SIZEOF(fsPropOffset);
+    bufleft -= pi->num_offsets * SIZEOF(fsPropOffset);
 
+    if (bufleft < pi->data_len)
+    {
+	ret = -1;
+#ifdef DEBUG
+	fprintf(stderr,
+		"fsQueryXInfo: bufleft (%ld) < data_len (%d)\n",
+		bufleft, pi->data_len);
+#endif
+	goto bail;
+    }
     pd = (pointer) buf;
     buf += pi->data_len;
-    
+    bufleft -= pi->data_len;
+
     /* convert the properties and step over the reply */
     ret = _fs_convert_props(pi, po, pd, pInfo);
+  bail:
     _fs_done_read (conn, rep->length << 2);
-    
+
     if (ret == -1)
     {
 	fs_cleanup_bfont (bfont);
@@ -889,7 +968,7 @@ fs_read_query_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
 	    err = BadFontName;
 	}
 	_fs_free_props (pInfo);
-	
+
 	return err;
     }
 
@@ -904,14 +983,14 @@ fs_read_query_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
      * Figure out if the whole font should get loaded right now.
      */
     if (glyphCachingMode == CACHING_OFF ||
-	(glyphCachingMode == CACHE_16_BIT_GLYPHS 
+	(glyphCachingMode == CACHE_16_BIT_GLYPHS
 	 && !bfont->pfont->info.lastRow))
     {
 	bfont->flags |= FontLoadAll;
     }
-    
+
     /*
-     * Ready to send the query bitmaps; the terminal font bit has 
+     * Ready to send the query bitmaps; the terminal font bit has
      * been computed and glyphCaching has been considered
      */
     if (bfont->flags & FontLoadBitmaps)
@@ -927,7 +1006,7 @@ fs_read_query_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
      */
     blockrec->sequenceNumber = bfont->queryExtentsSequence;
     conn->blockedReplyTime = GetTimeInMillis () + FontServerRequestTimeout;
-    
+
     return StillWorking;
 }
 
@@ -951,16 +1030,18 @@ fs_read_extent_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
     FontInfoRec		    *fi = &bfont->pfont->info;
 
     rep = (fsQueryXExtents16Reply *) fs_get_reply (conn, &ret);
-    if (!rep || rep->type == FS_Error)
+    if (!rep || rep->type == FS_Error ||
+	(rep->length < LENGTHOF(fsQueryXExtents16Reply)))
     {
 	if (ret == FSIO_BLOCK)
 	    return StillWorking;
 	if (rep)
 	    _fs_done_read (conn, rep->length << 2);
 	fs_cleanup_bfont (bfont);
+	_fs_reply_failed (rep, fsQueryXExtents16Reply, "<");
 	return BadFontName;
     }
-	
+
     /* move the data over */
     /* need separate inkMetrics for fixed font server protocol version */
     numExtents = rep->num_extents;
@@ -970,9 +1051,28 @@ fs_read_extent_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
 	numInfos *= 2;
 	haveInk = TRUE;
     }
-    ci = pCI = malloc(sizeof(CharInfoRec) * numInfos);
+    if (numInfos >= (INT_MAX / sizeof(CharInfoRec))) {
+#ifdef DEBUG
+	fprintf(stderr,
+		"fsQueryXExtents16: numInfos (%d) >= %ld\n",
+		numInfos, (INT_MAX / sizeof(CharInfoRec)));
+#endif
+	pCI = NULL;
+    }
+    else if (numExtents > ((rep->length - LENGTHOF(fsQueryXExtents16Reply))
+			    / LENGTHOF(fsXCharInfo))) {
+#ifdef DEBUG
+	fprintf(stderr,
+		"fsQueryXExtents16: numExtents (%d) > (%d - %d) / %d\n",
+		numExtents, rep->length,
+		LENGTHOF(fsQueryXExtents16Reply), LENGTHOF(fsXCharInfo));
+#endif
+	pCI = NULL;
+    }
+    else
+	pCI = malloc(sizeof(CharInfoRec) * numInfos);
 
-    if (!pCI) 
+    if (!pCI)
     {
 	_fs_done_read (conn, rep->length << 2);
 	fs_cleanup_bfont(bfont);
@@ -987,10 +1087,10 @@ fs_read_extent_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
     buf = (char *) rep;
     buf += SIZEOF (fsQueryXExtents16Reply);
     fsci = buf;
-    
+
     fsd->glyphs_to_get = 0;
     ci = fsfont->inkMetrics;
-    for (i = 0; i < numExtents; i++) 
+    for (i = 0; i < numExtents; i++)
     {
 	memcpy(&fscilocal, fsci, SIZEOF(fsXCharInfo)); /* align it */
 	_fs_convert_char_info(&fscilocal, &ci->metrics);
@@ -1030,7 +1130,7 @@ fs_read_extent_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
 
     /* Done with reply */
     _fs_done_read (conn, rep->length << 2);
-    
+
     /* build bitmap metrics, ImageRectMax style */
     if (haveInk)
     {
@@ -1098,7 +1198,7 @@ fs_read_extent_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
     }
     bfont->state = FS_GLYPHS_REPLY;
 
-    if (bfont->flags & FontLoadBitmaps) 
+    if (bfont->flags & FontLoadBitmaps)
     {
 	/*
 	 * Reset the blockrec for the next reply
@@ -1111,7 +1211,7 @@ fs_read_extent_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
 }
 
 #ifdef DEBUG
-static char *fs_open_states[] = {
+static const char *fs_open_states[] = {
     "OPEN_REPLY  ",
     "INFO_REPLY  ",
     "EXTENT_REPLY",
@@ -1129,7 +1229,7 @@ fs_do_open_font(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
 
 #ifdef DEBUG
     fprintf (stderr, "fs_do_open_font state %s %s\n",
-	     fs_open_states[bfont->state], 
+	     fs_open_states[bfont->state],
 	     ((FSFontDataPtr) (bfont->pfont->fpePrivate))->name);
 #endif
     err = BadFontName;
@@ -1165,10 +1265,10 @@ fs_do_open_font(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
 #ifdef DEBUG
     fprintf (stderr, "fs_do_open_font err %d\n", err);
 #endif
-    if (err != StillWorking) 
+    if (err != StillWorking)
     {
 	bfont->state = FS_DONE_REPLY;	/* for _fs_load_glyphs() */
-	while ((blockrec = blockrec->depending)) 
+	while ((blockrec = blockrec->depending))
 	{
 	    bfont = (FSBlockedFontPtr) blockrec->data;
 	    bfont->state = FS_DONE_REPLY;	/* for _fs_load_glyphs() */
@@ -1188,7 +1288,7 @@ void
 _fs_unmark_block (FSFpePtr conn, CARD32 mask)
 {
     FSFpePtr	c;
-    
+
     if (conn->blockState & mask)
     {
 	conn->blockState &= ~mask;
@@ -1207,7 +1307,7 @@ fs_block_handler(pointer data, OSTimePtr wt, pointer LastSelectMask)
     int		soonest;
     FSFpePtr    conn;
 
-    XFD_ORSET((fd_set *)LastSelectMask, (fd_set *)LastSelectMask, 
+    XFD_ORSET((fd_set *)LastSelectMask, (fd_set *)LastSelectMask,
 	      &_fs_fd_mask);
     /*
      * Flush all pending output
@@ -1280,7 +1380,7 @@ fs_block_handler(pointer data, OSTimePtr wt, pointer LastSelectMask)
 static void
 fs_handle_unexpected(FSFpePtr conn, fsGenericReply *rep)
 {
-    if (rep->type == FS_Event && rep->data1 == KeepAlive) 
+    if (rep->type == FS_Event && rep->data1 == KeepAlive)
     {
 	fsNoopReq   req;
 
@@ -1302,27 +1402,27 @@ fs_read_reply (FontPathElementPtr fpe, pointer client)
     int		    ret;
     int		    err;
     fsGenericReply  *rep;
-    
+
     if ((rep = fs_get_reply (conn, &ret)))
     {
 	_fs_add_rep_log (conn, rep);
-	for (blockrec = conn->blockedRequests; 
-	     blockrec; 
-	     blockrec = blockrec->next) 
+	for (blockrec = conn->blockedRequests;
+	     blockrec;
+	     blockrec = blockrec->next)
 	{
 	    if (blockrec->sequenceNumber == rep->sequenceNumber)
 		break;
 	}
 	err = Successful;
-	if (!blockrec) 
+	if (!blockrec)
 	{
 	    fs_handle_unexpected(conn, rep);
 	}
 	else
 	{
-	    /* 
-	     * go read it, and if we're done, 
-	     * wake up the appropriate client 
+	    /*
+	     * go read it, and if we're done,
+	     * wake up the appropriate client
 	     */
 	    switch (blockrec->type) {
 	    case FS_OPEN_FONT:
@@ -1343,7 +1443,7 @@ fs_read_reply (FontPathElementPtr fpe, pointer client)
 	    err = blockrec->errcode;
 	    if (err != StillWorking)
 	    {
-		while (blockrec) 
+		while (blockrec)
 		{
 		    blockrec->errcode = err;
 		    if (client != blockrec->client)
@@ -1366,7 +1466,7 @@ fs_wakeup(FontPathElementPtr fpe, unsigned long *mask)
     fd_set	    *LastSelectMask = (fd_set *) mask;
     FSFpePtr	    conn = (FSFpePtr) fpe->private;
 
-    /* 
+    /*
      * Don't continue if the fd is -1 (which will be true when the
      * font server terminates
      */
@@ -1381,7 +1481,6 @@ fs_wakeup(FontPathElementPtr fpe, unsigned long *mask)
     {
 	FSBlockDataPtr	    blockrec;
 	FSBlockedFontPtr    bfont;
-	FSBlockedListPtr    blist;
 	static CARD32	    lastState;
 	static FSBlockDataPtr	lastBlock;
 
@@ -1400,12 +1499,11 @@ fs_wakeup(FontPathElementPtr fpe, unsigned long *mask)
 			 blockrec->errcode,
 			 blockrec->sequenceNumber,
 			 fs_open_states[bfont->state],
-			 bfont->pfont ? 
+			 bfont->pfont ?
 			 ((FSFontDataPtr) (bfont->pfont->fpePrivate))->name :
 			 "<freed>");
 		break;
 	    case FS_LIST_FONTS:
-		blist = (FSBlockedListPtr) blockrec->data;
 		fprintf (stderr, "  Blocked list errcode %d sequence %d\n",
 			 blockrec->errcode, blockrec->sequenceNumber);
 		break;
@@ -1418,7 +1516,7 @@ fs_wakeup(FontPathElementPtr fpe, unsigned long *mask)
 	    }
 	}
     }
-#endif			 
+#endif
     return FALSE;
 }
 
@@ -1446,7 +1544,7 @@ _fs_restart_connection(FSFpePtr conn)
     FSBlockDataPtr block;
 
     _fs_unmark_block (conn, FS_GIVE_UP);
-    while ((block = (FSBlockDataPtr) conn->blockedRequests)) 
+    while ((block = (FSBlockDataPtr) conn->blockedRequests))
     {
 	if (block->errcode == StillWorking)
 	{
@@ -1471,7 +1569,7 @@ _fs_giveup (FSFpePtr conn)
     fprintf (stderr, "give up on FS \"%s\"\n", conn->servername);
 #endif
     _fs_mark_block (conn, FS_GIVE_UP);
-    while ((block = (FSBlockDataPtr) conn->blockedRequests)) 
+    while ((block = (FSBlockDataPtr) conn->blockedRequests))
     {
 	if (block->errcode == StillWorking)
 	{
@@ -1494,7 +1592,7 @@ _fs_do_blocked (FSFpePtr conn)
     {
 	_fs_giveup (conn);
     }
-    else 
+    else
     {
 	if (conn->blockState & FS_BROKEN_CONNECTION)
 	{
@@ -1516,9 +1614,9 @@ _fs_do_blocked (FSFpePtr conn)
  */
 /* ARGSUSED */
 static int
-fs_send_open_font(pointer client, FontPathElementPtr fpe, Mask flags, 
-		  char *name, int namelen, 
-		  fsBitmapFormat format, fsBitmapFormatMask fmask, 
+fs_send_open_font(pointer client, FontPathElementPtr fpe, Mask flags,
+		  char *name, int namelen,
+		  fsBitmapFormat format, fsBitmapFormatMask fmask,
 		  XID id, FontPtr *ppfont)
 {
     FSFpePtr		    conn = (FSFpePtr) fpe->private;
@@ -1534,10 +1632,10 @@ fs_send_open_font(pointer client, FontPathElementPtr fpe, Mask flags,
 
     if (conn->blockState & FS_GIVE_UP)
 	return BadFontName;
- 
+
     if (namelen <= 0 || namelen > sizeof (buf) - 1)
 	return BadFontName;
-    
+
     /*
      * Get the font structure put together, either by reusing
      * the existing one or creating a new one
@@ -1574,10 +1672,10 @@ fs_send_open_font(pointer client, FontPathElementPtr fpe, Mask flags,
 	font = fs_create_font (fpe, name, namelen, format, fmask);
 	if (!font)
 	    return AllocError;
-	
+
 	fsd = (FSFontDataPtr)font->fpePrivate;
     }
-    
+
     /* make a new block record, and add it to the end of the list */
     blockrec = fs_new_block_rec(font->fpe, client, FS_OPEN_FONT);
     if (!blockrec)
@@ -1586,7 +1684,7 @@ fs_send_open_font(pointer client, FontPathElementPtr fpe, Mask flags,
 	    (*font->unload_font) (font);
 	return AllocError;
     }
-    
+
     /*
      * Must check this before generating any protocol, otherwise we'll
      * mess up a reconnect in progress
@@ -1596,7 +1694,7 @@ fs_send_open_font(pointer client, FontPathElementPtr fpe, Mask flags,
 	_fs_pending_reply (conn);
 	return Suspended;
     }
-	
+
     fsd->generation = conn->generation;
 
     bfont = (FSBlockedFontPtr) blockrec->data;
@@ -1626,17 +1724,17 @@ fs_send_open_font(pointer client, FontPathElementPtr fpe, Mask flags,
     _fs_write_pad(conn, (char *) buf, namelen + 1);
 
     blockrec->sequenceNumber = conn->current_seq;
-    
+
     inforeq.reqType = FS_QueryXInfo;
     inforeq.pad = 0;
     inforeq.id = fsd->fontid;
     inforeq.length = SIZEOF(fsQueryXInfoReq) >> 2;
 
     bfont->queryInfoSequence = conn->current_seq + 1;
-    
+
     _fs_add_req_log(conn, FS_QueryXInfo);
     _fs_write(conn, (char *) &inforeq, SIZEOF(fsQueryXInfoReq));
-    
+
     if (!(bfont->flags & FontReopen))
     {
 	extreq.reqType = FS_QueryXExtents16;
@@ -1644,15 +1742,15 @@ fs_send_open_font(pointer client, FontPathElementPtr fpe, Mask flags,
 	extreq.fid = fsd->fontid;
 	extreq.num_ranges = 0;
 	extreq.length = SIZEOF(fsQueryXExtents16Req) >> 2;
-	
+
 	bfont->queryExtentsSequence = conn->current_seq + 1;
-	
+
 	_fs_add_req_log(conn, FS_QueryXExtents16);
 	_fs_write(conn, (char *) &extreq, SIZEOF(fsQueryXExtents16Req));
     }
-    
+
 #ifdef NCD
-    if (configData.ExtendedFontDiags) 
+    if (configData.ExtendedFontDiags)
     {
 	memcpy(buf, name, MIN(256, namelen));
 	buf[MIN(256, namelen)] = '\0';
@@ -1661,7 +1759,7 @@ fs_send_open_font(pointer client, FontPathElementPtr fpe, Mask flags,
     }
 #endif
     _fs_prepare_for_reply (conn);
-    
+
     err = blockrec->errcode;
     if (bfont->flags & FontOpenSync)
     {
@@ -1701,16 +1799,16 @@ fs_send_query_bitmaps(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
     bitreq.num_ranges = 0;
 
     bfont->queryBitmapsSequence = conn->current_seq + 1;
-    
+
     _fs_add_req_log(conn, FS_QueryXBitmaps16);
     _fs_write(conn, (char *) &bitreq, SIZEOF(fsQueryXBitmaps16Req));
 }
 
 /* ARGSUSED */
 static int
-fs_open_font(pointer client, FontPathElementPtr fpe, Mask flags, 
-	     char *name, int namelen, 
-	     fsBitmapFormat format, fsBitmapFormatMask fmask, 
+fs_open_font(pointer client, FontPathElementPtr fpe, Mask flags,
+	     char *name, int namelen,
+	     fsBitmapFormat format, fsBitmapFormatMask fmask,
 	     XID id, FontPtr *ppfont,
 	     char **alias, FontPtr non_cachable_font)
 {
@@ -1725,12 +1823,12 @@ fs_open_font(pointer client, FontPathElementPtr fpe, Mask flags,
     *alias = (char *) 0;
     for (blockrec = conn->blockedRequests; blockrec; blockrec = blockrec->next)
     {
-	if (blockrec->type == FS_OPEN_FONT && blockrec->client == client) 
+	if (blockrec->type == FS_OPEN_FONT && blockrec->client == client)
 	{
 	    err = blockrec->errcode;
 	    if (err == StillWorking)
 		return Suspended;
-	    
+
 	    bfont = (FSBlockedFontPtr) blockrec->data;
 	    if (err == Successful)
 		*ppfont = bfont->pfont;
@@ -1809,6 +1907,7 @@ fs_read_glyphs(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
     FontInfoPtr		    pfi = &pfont->info;
     fsQueryXBitmaps16Reply  *rep;
     char		    *buf;
+    long		    bufleft; /* length of reply left to use */
     fsOffset32		    *ppbits;
     fsOffset32		    local_off;
     char		    *off_adr;
@@ -1825,22 +1924,48 @@ fs_read_glyphs(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
     unsigned long	    minchar, maxchar;
 
     rep = (fsQueryXBitmaps16Reply *) fs_get_reply (conn, &ret);
-    if (!rep || rep->type == FS_Error)
+    if (!rep || rep->type == FS_Error ||
+	(rep->length < LENGTHOF(fsQueryXBitmaps16Reply)))
     {
 	if (ret == FSIO_BLOCK)
 	    return StillWorking;
 	if (rep)
 	    _fs_done_read (conn, rep->length << 2);
 	err = AllocError;
+	_fs_reply_failed (rep, fsQueryXBitmaps16Reply, "<");
 	goto bail;
     }
 
     buf = (char *) rep;
     buf += SIZEOF (fsQueryXBitmaps16Reply);
 
+    bufleft = rep->length << 2;
+    bufleft -= SIZEOF (fsQueryXBitmaps16Reply);
+
+    if ((bufleft / SIZEOF (fsOffset32)) < rep->num_chars)
+    {
+#ifdef DEBUG
+	fprintf(stderr,
+		"fsQueryXBitmaps16: num_chars (%d) > bufleft (%ld) / %d\n",
+		rep->num_chars, bufleft, SIZEOF (fsOffset32));
+#endif
+	err = AllocError;
+	goto bail;
+    }
     ppbits = (fsOffset32 *) buf;
     buf += SIZEOF (fsOffset32) * (rep->num_chars);
+    bufleft -= SIZEOF (fsOffset32) * (rep->num_chars);
 
+    if (bufleft < rep->nbytes)
+    {
+#ifdef DEBUG
+	fprintf(stderr,
+		"fsQueryXBitmaps16: nbytes (%d) > bufleft (%ld)\n",
+		rep->nbytes, bufleft);
+#endif
+	err = AllocError;
+	goto bail;
+    }
     pbitmaps = (pointer ) buf;
 
     if (blockrec->type == FS_LOAD_GLYPHS)
@@ -1871,21 +1996,21 @@ fs_read_glyphs(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
     }
 
     off_adr = (char *)ppbits;
-    
+
     allbits = fs_alloc_glyphs (pfont, rep->nbytes);
-    
+
     if (!allbits)
     {
 	err = AllocError;
 	goto bail;
     }
-    
+
 #ifdef DEBUG
     origallbits = allbits;
     fprintf (stderr, "Reading %d glyphs in %d bytes for %s\n",
 	     (int) rep->num_chars, (int) rep->nbytes, fsd->name);
 #endif
-    
+
     for (i = 0; i < rep->num_chars; i++)
     {
 	memcpy(&local_off, off_adr, SIZEOF(fsOffset32));	/* align it */
@@ -1898,7 +2023,9 @@ fs_read_glyphs(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
 	     */
 	    if (NONZEROMETRICS(&fsdata->encoding[minchar].metrics))
 	    {
-		if (local_off.length)
+		if (local_off.length &&
+		    (local_off.position < rep->nbytes) &&
+		    (local_off.length <= (rep->nbytes - local_off.position)))
 		{
 		    bits = allbits;
 		    allbits += local_off.length;
@@ -1945,7 +2072,7 @@ bail:
 }
 
 static int
-fs_send_load_glyphs(pointer client, FontPtr pfont, 
+fs_send_load_glyphs(pointer client, FontPtr pfont,
 		    int nranges, fsRange *ranges)
 {
     FontPathElementPtr	    fpe = pfont->fpe;
@@ -1956,7 +2083,7 @@ fs_send_load_glyphs(pointer client, FontPtr pfont,
 
     if (conn->blockState & FS_GIVE_UP)
 	return BadCharRange;
-    
+
     /* make a new block record, and add it to the end of the list */
     blockrec = fs_new_block_rec(fpe, client, FS_LOAD_GLYPHS);
     if (!blockrec)
@@ -1973,7 +2100,7 @@ fs_send_load_glyphs(pointer client, FontPtr pfont,
 	_fs_pending_reply (conn);
 	return Suspended;
     }
-    
+
     /* send the request */
     req.reqType = FS_QueryXBitmaps16;
     req.fid = ((FSFontDataPtr) pfont->fpePrivate)->fontid;
@@ -1989,7 +2116,7 @@ fs_send_load_glyphs(pointer client, FontPtr pfont,
     _fs_write(conn, (char *) &req, SIZEOF(fsQueryXBitmaps16Req));
 
     blockrec->sequenceNumber = conn->current_seq;
-    
+
     /* Send ranges to the server... pack into a char array by hand
        to avoid structure-packing portability problems and to
        handle swapping for version1 protocol */
@@ -2039,7 +2166,7 @@ extern pointer serverClient;	/* This could be any number that
 				   client values. */
 
 static int
-_fs_load_glyphs(pointer client, FontPtr pfont, Bool range_flag, 
+_fs_load_glyphs(pointer client, FontPtr pfont, Bool range_flag,
 		unsigned int nchars, int item_size, unsigned char *data)
 {
     FSFpePtr		    conn = (FSFpePtr) pfont->fpe->private;
@@ -2095,7 +2222,7 @@ _fs_load_glyphs(pointer client, FontPtr pfont, Bool range_flag,
 		    err = blockrec->errcode;
 		    if (err == StillWorking)
 			return Suspended;
-		    
+
 		    _fs_signal_clients_depending(&bfont->clients_depending);
 		    _fs_remove_block_rec(conn, blockrec);
 		    if (err != Successful)
@@ -2228,38 +2355,55 @@ fs_read_list(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
     FSBlockedListPtr	blist = (FSBlockedListPtr) blockrec->data;
     fsListFontsReply	*rep;
     char		*data;
+    long		dataleft; /* length of reply left to use */
     int			length,
 			i,
 			ret;
     int			err;
 
     rep = (fsListFontsReply *) fs_get_reply (conn, &ret);
-    if (!rep || rep->type == FS_Error)
+    if (!rep || rep->type == FS_Error ||
+	(rep->length < LENGTHOF(fsListFontsReply)))
     {
 	if (ret == FSIO_BLOCK)
 	    return StillWorking;
 	if (rep)
 	    _fs_done_read (conn, rep->length << 2);
+	_fs_reply_failed (rep, fsListFontsReply, "<");
 	return AllocError;
     }
     data = (char *) rep + SIZEOF (fsListFontsReply);
+    dataleft = (rep->length << 2) - SIZEOF (fsListFontsReply);
 
     err = Successful;
     /* copy data into FontPathRecord */
-    for (i = 0; i < rep->nFonts; i++) 
+    for (i = 0; i < rep->nFonts; i++)
     {
+	if (dataleft < 1)
+	    break;
 	length = *(unsigned char *)data++;
+	dataleft--; /* used length byte */
+	if (length > dataleft) {
+#ifdef DEBUG
+	    fprintf(stderr,
+		    "fsListFonts: name length (%d) > dataleft (%ld)\n",
+		    length, dataleft);
+#endif
+	    err = BadFontName;
+	    break;
+	}
 	err = AddFontNamesName(blist->names, data, length);
 	if (err != Successful)
 	    break;
 	data += length;
+	dataleft -= length;
     }
     _fs_done_read (conn, rep->length << 2);
     return err;
 }
 
 static int
-fs_send_list_fonts(pointer client, FontPathElementPtr fpe, char *pattern, 
+fs_send_list_fonts(pointer client, FontPathElementPtr fpe, char *pattern,
 		   int patlen, int maxnames, FontNamesPtr newnames)
 {
     FSFpePtr		conn = (FSFpePtr) fpe->private;
@@ -2269,7 +2413,7 @@ fs_send_list_fonts(pointer client, FontPathElementPtr fpe, char *pattern,
 
     if (conn->blockState & FS_GIVE_UP)
 	return BadFontName;
-    
+
     /* make a new block record, and add it to the end of the list */
     blockrec = fs_new_block_rec(fpe, client, FS_LIST_FONTS);
     if (!blockrec)
@@ -2282,7 +2426,7 @@ fs_send_list_fonts(pointer client, FontPathElementPtr fpe, char *pattern,
 	_fs_pending_reply (conn);
 	return Suspended;
     }
-	
+
     _fs_client_access (conn, client, FALSE);
     _fs_client_resolution(conn);
 
@@ -2297,7 +2441,7 @@ fs_send_list_fonts(pointer client, FontPathElementPtr fpe, char *pattern,
     _fs_write_pad(conn, (char *) pattern, patlen);
 
     blockrec->sequenceNumber = conn->current_seq;
-    
+
 #ifdef NCD
     if (configData.ExtendedFontDiags) {
 	char        buf[256];
@@ -2314,7 +2458,7 @@ fs_send_list_fonts(pointer client, FontPathElementPtr fpe, char *pattern,
 }
 
 static int
-fs_list_fonts(pointer client, FontPathElementPtr fpe, 
+fs_list_fonts(pointer client, FontPathElementPtr fpe,
 	      char *pattern, int patlen, int maxnames, FontNamesPtr newnames)
 {
     FSFpePtr		conn = (FSFpePtr) fpe->private;
@@ -2324,7 +2468,7 @@ fs_list_fonts(pointer client, FontPathElementPtr fpe,
     /* see if the result is already there */
     for (blockrec = conn->blockedRequests; blockrec; blockrec = blockrec->next)
     {
-	if (blockrec->type == FS_LIST_FONTS && blockrec->client == client) 
+	if (blockrec->type == FS_LIST_FONTS && blockrec->client == client)
 	{
 	    err = blockrec->errcode;
 	    if (err == StillWorking)
@@ -2347,6 +2491,7 @@ fs_read_list_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
     FSBlockedListInfoPtr	binfo = (FSBlockedListInfoPtr) blockrec->data;
     fsListFontsWithXInfoReply	*rep;
     char			*buf;
+    long			bufleft;
     FSFpePtr			conn = (FSFpePtr) fpe->private;
     fsPropInfo			*pi;
     fsPropOffset		*po;
@@ -2358,12 +2503,15 @@ fs_read_list_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
     _fs_free_props (&binfo->info);
 
     rep = (fsListFontsWithXInfoReply *) fs_get_reply (conn, &ret);
-    if (!rep || rep->type == FS_Error)
+    if (!rep || rep->type == FS_Error ||
+	((rep->nameLength != 0) &&
+	 (rep->length < LENGTHOF(fsListFontsWithXInfoReply))))
     {
 	if (ret == FSIO_BLOCK)
 	    return StillWorking;
 	binfo->status = FS_LFWI_FINISHED;
 	err = AllocError;
+	_fs_reply_failed (rep, fsListFontsWithXInfoReply, "<");
 	goto done;
     }
     /*
@@ -2380,7 +2528,8 @@ fs_read_list_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
     }
 
     buf = (char *) rep + SIZEOF (fsListFontsWithXInfoReply);
-    
+    bufleft = (rep->length << 2) - SIZEOF (fsListFontsWithXInfoReply);
+
     /*
      * The original FS implementation didn't match
      * the spec, version 1 was respecified to match the FS.
@@ -2388,19 +2537,71 @@ fs_read_list_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
      */
     if (conn->fsMajorVersion <= 1)
     {
+	if (rep->nameLength > bufleft) {
+#ifdef DEBUG
+	    fprintf(stderr,
+		    "fsListFontsWithXInfo: name length (%d) > bufleft (%ld)\n",
+		    (int) rep->nameLength, bufleft);
+#endif
+	    err = AllocError;
+	    goto done;
+	}
+	/* binfo->name is a 256 char array, rep->nameLength is a CARD8 */
 	memcpy (binfo->name, buf, rep->nameLength);
 	buf += _fs_pad_length (rep->nameLength);
+	bufleft -= _fs_pad_length (rep->nameLength);
     }
     pi = (fsPropInfo *) buf;
+    if (SIZEOF (fsPropInfo) > bufleft) {
+#ifdef DEBUG
+	fprintf(stderr,
+		"fsListFontsWithXInfo: PropInfo length (%d) > bufleft (%ld)\n",
+		(int) SIZEOF (fsPropInfo), bufleft);
+#endif
+	err = AllocError;
+	goto done;
+    }
+    bufleft -= SIZEOF (fsPropInfo);
     buf += SIZEOF (fsPropInfo);
     po = (fsPropOffset *) buf;
+    if (pi->num_offsets > (bufleft / SIZEOF (fsPropOffset))) {
+#ifdef DEBUG
+	fprintf(stderr,
+		"fsListFontsWithXInfo: offset length (%d * %d) > bufleft (%ld)\n",
+		pi->num_offsets, (int) SIZEOF (fsPropOffset), bufleft);
+#endif
+	err = AllocError;
+	goto done;
+    }
+    bufleft -= pi->num_offsets * SIZEOF (fsPropOffset);
     buf += pi->num_offsets * SIZEOF (fsPropOffset);
     pd = (pointer) buf;
+    if (pi->data_len > bufleft) {
+#ifdef DEBUG
+	fprintf(stderr,
+		"fsListFontsWithXInfo: data length (%d) > bufleft (%ld)\n",
+		pi->data_len, bufleft);
+#endif
+	err = AllocError;
+	goto done;
+    }
+    bufleft -= pi->data_len;
     buf += pi->data_len;
     if (conn->fsMajorVersion > 1)
     {
+	if (rep->nameLength > bufleft) {
+#ifdef DEBUG
+	    fprintf(stderr,
+		    "fsListFontsWithXInfo: name length (%d) > bufleft (%ld)\n",
+		    (int) rep->nameLength, bufleft);
+#endif
+	    err = AllocError;
+	    goto done;
+	}
+	/* binfo->name is a 256 char array, rep->nameLength is a CARD8 */
 	memcpy (binfo->name, buf, rep->nameLength);
 	buf += _fs_pad_length (rep->nameLength);
+	bufleft -= _fs_pad_length (rep->nameLength);
     }
 
 #ifdef DEBUG
@@ -2417,18 +2618,18 @@ fs_read_list_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
     binfo->remaining = rep->nReplies;
 
     binfo->status = FS_LFWI_REPLY;
-    
+
     /* disable this font server until we've processed this response */
     _fs_unmark_block (conn, FS_COMPLETE_REPLY);
     FD_CLR(conn->fs_fd, &_fs_fd_mask);
-done:    
+done:
     _fs_done_read (conn, rep->length << 2);
     return err;
 }
 
 /* ARGSUSED */
 static int
-fs_start_list_with_info(pointer client, FontPathElementPtr fpe, 
+fs_start_list_with_info(pointer client, FontPathElementPtr fpe,
 			char *pattern, int len, int maxnames, pointer *pdata)
 {
     FSFpePtr		    conn = (FSFpePtr) fpe->private;
@@ -2443,7 +2644,7 @@ fs_start_list_with_info(pointer client, FontPathElementPtr fpe,
     blockrec = fs_new_block_rec(fpe, client, FS_LIST_WITH_INFO);
     if (!blockrec)
 	return AllocError;
-    
+
     binfo = (FSBlockedListInfoPtr) blockrec->data;
     bzero((char *) binfo, sizeof(FSBlockedListInfoRec));
     binfo->status = FS_LFWI_WAITING;
@@ -2453,7 +2654,7 @@ fs_start_list_with_info(pointer client, FontPathElementPtr fpe,
 	_fs_pending_reply (conn);
 	return Suspended;
     }
-    
+
     _fs_client_access (conn, client, FALSE);
     _fs_client_resolution(conn);
 
@@ -2468,7 +2669,7 @@ fs_start_list_with_info(pointer client, FontPathElementPtr fpe,
     (void) _fs_write_pad(conn, pattern, len);
 
     blockrec->sequenceNumber = conn->current_seq;
-    
+
 #ifdef NCD
     if (configData.ExtendedFontDiags) {
 	char        buf[256];
@@ -2486,8 +2687,8 @@ fs_start_list_with_info(pointer client, FontPathElementPtr fpe,
 
 /* ARGSUSED */
 static int
-fs_next_list_with_info(pointer client, FontPathElementPtr fpe, 
-		       char **namep, int *namelenp, 
+fs_next_list_with_info(pointer client, FontPathElementPtr fpe,
+		       char **namep, int *namelenp,
 		       FontInfoPtr *pFontInfo, int *numFonts,
 		       pointer private)
 {
@@ -2498,7 +2699,7 @@ fs_next_list_with_info(pointer client, FontPathElementPtr fpe,
 
     /* see if the result is already there */
     for (blockrec = conn->blockedRequests; blockrec; blockrec = blockrec->next)
-	if (blockrec->type == FS_LIST_WITH_INFO && blockrec->client == client) 
+	if (blockrec->type == FS_LIST_WITH_INFO && blockrec->client == client)
 	    break;
 
     if (!blockrec)
@@ -2513,7 +2714,7 @@ fs_next_list_with_info(pointer client, FontPathElementPtr fpe,
     }
 
     binfo = (FSBlockedListInfoPtr) blockrec->data;
-    
+
     if (binfo->status == FS_LFWI_WAITING)
 	return Suspended;
 
@@ -2521,12 +2722,12 @@ fs_next_list_with_info(pointer client, FontPathElementPtr fpe,
     *namelenp = binfo->namelen;
     *pFontInfo = &binfo->info;
     *numFonts = binfo->remaining;
-    
+
     /* Restart reply processing from this font server */
     FD_SET(conn->fs_fd, &_fs_fd_mask);
     if (fs_reply_ready (conn))
 	_fs_mark_block (conn, FS_COMPLETE_REPLY);
-    
+
     err = blockrec->errcode;
     switch (binfo->status) {
     case FS_LFWI_FINISHED:
@@ -2539,7 +2740,7 @@ fs_next_list_with_info(pointer client, FontPathElementPtr fpe,
 	_fs_mark_block (conn, FS_PENDING_REPLY);
 	break;
     }
-    
+
     return err;
 }
 
@@ -2574,12 +2775,12 @@ fs_client_died(pointer client, FontPathElementPtr fpe)
     for (blockrec = conn->blockedRequests; blockrec; blockrec = blockrec->next)
 	if (blockrec->client == client)
 	    break;
-    
+
     if (!blockrec)
 	return;
-    
+
     /* replace the client pointers in this block rec with the chained one */
-    if ((depending = blockrec->depending)) 
+    if ((depending = blockrec->depending))
     {
 	blockrec->client = depending->client;
 	blockrec->depending = depending->depending;
@@ -2681,7 +2882,7 @@ static int
 _fs_check_connect (FSFpePtr conn)
 {
     int	    ret;
-    
+
     ret = _fs_poll_connect (conn->trans_conn, 0);
     switch (ret) {
     case FSIO_READY:
@@ -2715,7 +2916,7 @@ _fs_get_conn_setup (FSFpePtr conn, int *error, int *setup_len)
 	*error = ret;
 	return 0;
     }
-    
+
     setup = (fsConnSetup *) data;
     if (setup->major_version > FS_PROTOCOL)
     {
@@ -2786,10 +2987,10 @@ _fs_recv_conn_setup (FSFpePtr conn)
     int			ret = FSIO_ERROR;
     fsConnSetup		*setup;
     FSFpeAltPtr		alts;
-    int			i, alt_len;
+    unsigned int	i, alt_len;
     int			setup_len;
     char		*alt_save, *alt_names;
-    
+
     setup = _fs_get_conn_setup (conn, &ret, &setup_len);
     if (!setup)
 	return ret;
@@ -2813,8 +3014,9 @@ _fs_recv_conn_setup (FSFpePtr conn)
 	}
 	if (setup->num_alternates)
 	{
+	    size_t alt_name_len = setup->alternate_len << 2;
 	    alts = malloc (setup->num_alternates * sizeof (FSFpeAltRec) +
-			   (setup->alternate_len << 2));
+			   alt_name_len);
 	    if (alts)
 	    {
 		alt_names = (char *) (setup + 1);
@@ -2823,10 +3025,25 @@ _fs_recv_conn_setup (FSFpePtr conn)
 		{
 		    alts[i].subset = alt_names[0];
 		    alt_len = alt_names[1];
+		    if (alt_len >= alt_name_len) {
+			/*
+			 * Length is longer than setup->alternate_len
+			 * told us to allocate room for, assume entire
+			 * alternate list is corrupted.
+			 */
+#ifdef DEBUG
+			fprintf (stderr,
+				 "invalid alt list (length %lx >= %lx)\n",
+				 (long) alt_len, (long) alt_name_len);
+#endif
+			free(alts);
+			return FSIO_ERROR;
+		    }
 		    alts[i].name = alt_save;
 		    memcpy (alt_save, alt_names + 2, alt_len);
 		    alt_save[alt_len] = '\0';
 		    alt_save += alt_len + 1;
+		    alt_name_len -= alt_len + 1;
 		    alt_names += _fs_pad_length (alt_len + 2);
 		}
 		conn->numAlts = setup->num_alternates;
@@ -2845,7 +3062,7 @@ _fs_open_server (FSFpePtr conn)
 {
     int	    ret;
     char    *servername;
-    
+
     if (conn->alternate == 0)
 	servername = conn->servername;
     else
@@ -2877,13 +3094,13 @@ _fs_send_init_packets (FSFpePtr conn)
     char		    *cat;
     char		    len;
     char		    *end;
-    int			    num_res;    
+    int			    num_res;
     FontResolutionPtr	    res;
 
 #define	CATALOGUE_SEP	'+'
 
     res = GetClientResolutions(&num_res);
-    if (num_res) 
+    if (num_res)
     {
 	srreq.reqType = FS_SetResolution;
 	srreq.num_resolutions = num_res;
@@ -2902,14 +3119,14 @@ _fs_send_init_packets (FSFpePtr conn)
 	catalogues = _fs_catalog_name (conn->alts[conn->alternate-1].name);
     if (!catalogues)
 	catalogues = _fs_catalog_name (conn->servername);
-    
+
     if (!catalogues)
     {
 	conn->has_catalogues = FALSE;
 	return FSIO_READY;
     }
     conn->has_catalogues = TRUE;
-    
+
     /* turn cats into counted list */
     catalogues++;
 
@@ -2929,11 +3146,11 @@ _fs_send_init_packets (FSFpePtr conn)
     screq.reqType = FS_SetCatalogues;
     screq.num_catalogues = num_cats;
     screq.length = (SIZEOF(fsSetCataloguesReq) + clen + 3) >> 2;
-    
+
     _fs_add_req_log(conn, FS_SetCatalogues);
     if (_fs_write(conn, (char *) &screq, SIZEOF(fsSetCataloguesReq)) != FSIO_READY)
 	return FSIO_ERROR;
-    
+
     while (*cat)
     {
 	num_cats++;
@@ -2947,10 +3164,10 @@ _fs_send_init_packets (FSFpePtr conn)
 	    return FSIO_ERROR;
 	cat = end;
     }
-    
+
     if (_fs_write (conn, "....", _fs_pad_length (clen) - clen) != FSIO_READY)
 	return FSIO_ERROR;
-    
+
     return FSIO_READY;
 }
 
@@ -2958,12 +3175,13 @@ static int
 _fs_send_cat_sync (FSFpePtr conn)
 {
     fsListCataloguesReq	    lcreq;
-    
+
     /*
      * now sync up with the font server, to see if an error was generated
      * by a bogus catalogue
      */
     lcreq.reqType = FS_ListCatalogues;
+    lcreq.data = 0;
     lcreq.length = (SIZEOF(fsListCataloguesReq)) >> 2;
     lcreq.maxNames = 0;
     lcreq.nbytes = 0;
@@ -2986,7 +3204,7 @@ _fs_recv_cat_sync (FSFpePtr conn)
     reply = fs_get_reply (conn, &err);
     if (!reply)
 	return err;
-    
+
     ret = FSIO_READY;
     if (reply->type == FS_Error)
     {
@@ -3020,7 +3238,7 @@ static int
 _fs_do_setup_connection (FSFpePtr conn)
 {
     int	    ret;
-    
+
     do
     {
 #ifdef DEBUG
@@ -3113,7 +3331,7 @@ static void
 _fs_check_reconnect (FSFpePtr conn)
 {
     int	    ret;
-    
+
     ret = _fs_do_setup_connection (conn);
     switch (ret) {
     case FSIO_READY:
diff --git a/libXfont/src/fc/fsio.h b/libXfont/src/fc/fsio.h
index 2bb8e0b73..fa1e7d8f9 100644
--- a/libXfont/src/fc/fsio.h
+++ b/libXfont/src/fc/fsio.h
@@ -26,8 +26,9 @@
 #ifndef	_FSIO_H_
 #define	_FSIO_H_
 
-#undef DEBUG
+#ifdef DEBUG
 #define	REQUEST_LOG_SIZE	100
+#endif
 
 typedef struct _fs_fpe_alternate {
     char       *name;
diff --git a/libXfont/src/fontfile/bufio.c b/libXfont/src/fontfile/bufio.c
index 34b7f3665..d8d4f2964 100644
--- a/libXfont/src/fontfile/bufio.c
+++ b/libXfont/src/fontfile/bufio.c
@@ -162,8 +162,10 @@ BufFileOpenWrite (int fd)
     setmode(fd,O_BINARY);
 #endif
     f = BufFileCreate ((char *)(long) fd, 0, BufFileRawFlush, 0, BufFileFlush);
-    f->bufp = f->buffer;
-    f->left = BUFFILESIZE;
+    if (f != NULL) {
+	f->bufp = f->buffer;
+	f->left = BUFFILESIZE;
+    }
     return f;
 }
 
diff --git a/libXfont/src/fontfile/catalogue.c b/libXfont/src/fontfile/catalogue.c
index 09ca2ae8a..623093011 100644
--- a/libXfont/src/fontfile/catalogue.c
+++ b/libXfont/src/fontfile/catalogue.c
@@ -287,7 +287,6 @@ CatalogueOpenFont (pointer client, FontPathElementPtr fpe, Mask flags,
 {
     CataloguePtr cat = fpe->private;
     FontPathElementPtr subfpe;
-    FontDirectoryPtr dir;
     int i, status;
 
     CatalogueRescan (fpe, FALSE);
@@ -295,7 +294,6 @@ CatalogueOpenFont (pointer client, FontPathElementPtr fpe, Mask flags,
     for (i = 0; i < cat->fpeCount; i++)
     {
 	subfpe = cat->fpeList[i];
-	dir = subfpe->private;
 	status = FontFileOpenFont(client, subfpe, flags,
 				  name, namelen, format, fmask, id,
 				  pFont, aliasName, non_cachable_font);
@@ -321,7 +319,6 @@ CatalogueListFonts (pointer client, FontPathElementPtr fpe, char *pat,
 {
     CataloguePtr cat = fpe->private;
     FontPathElementPtr subfpe;
-    FontDirectoryPtr dir;
     int i;
 
     CatalogueRescan (fpe, FALSE);
@@ -329,18 +326,12 @@ CatalogueListFonts (pointer client, FontPathElementPtr fpe, char *pat,
     for (i = 0; i < cat->fpeCount; i++)
     {
 	subfpe = cat->fpeList[i];
-	dir = subfpe->private;
 	FontFileListFonts(client, subfpe, pat, len, max, names);
     }
 
     return Successful;
 }
 
-int
-FontFileStartListFonts(pointer client, FontPathElementPtr fpe,
-		       char *pat, int len, int max,
-		       pointer *privatep, int mark_aliases);
-
 typedef struct _LFWIData {
     pointer		*privates;
     int			current;
diff --git a/libXfont/src/fontfile/dirfile.c b/libXfont/src/fontfile/dirfile.c
index c8aff6f4f..639310c31 100644
--- a/libXfont/src/fontfile/dirfile.c
+++ b/libXfont/src/fontfile/dirfile.c
@@ -42,6 +42,7 @@ in this Software without prior written authorization from The Open Group.
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <errno.h>
+#include <limits.h>
 
 static Bool AddFileNameAliases ( FontDirectoryPtr dir );
 static int ReadFontAlias ( char *directory, Bool isFile,
@@ -90,7 +91,7 @@ FontFileReadDirectory (char *directory, FontDirectoryPtr *pdir)
     strcat(dir_file, FontDirFile);
     file = fopen(dir_file, "rt");
     if (file) {
-#ifndef WIN32        
+#ifndef WIN32
 	if (fstat (fileno(file), &statb) == -1)
 #else
 	if (stat (dir_file, &statb) == -1)
@@ -135,7 +136,7 @@ FontFileReadDirectory (char *directory, FontDirectoryPtr *pdir)
 	    FontFileAddFontFile (dir, font_name, file_name);
 	}
 	fclose(file);
-	
+
     } else if (errno != ENOENT) {
 	return BadFontPath;
     }
@@ -188,7 +189,7 @@ FontFileDirectoryChanged(FontDirectoryPtr dir)
 	return TRUE;
     return FALSE;
 }
-    
+
 /*
  * Make each of the file names an automatic alias for each of the files.
  */
@@ -212,7 +213,7 @@ AddFileNameAliases(FontDirectoryPtr dir)
 	renderer = FontFileMatchRenderer (fileName);
 	if (!renderer)
 	    continue;
-	
+
 	len = strlen (fileName) - renderer->fileSuffixLen;
 	if (len >= sizeof(copy))
 	    continue;
@@ -374,6 +375,9 @@ lexAlias(FILE *file, char **lexToken)
 	    int         nsize;
 	    char       *nbuf;
 
+	    if (tokenSize >= (INT_MAX >> 2))
+		/* Stop before we overflow */
+		return EALLOC;
 	    nsize = tokenSize ? (tokenSize << 1) : 64;
 	    nbuf = realloc(tokenBuf, nsize);
 	    if (!nbuf)
diff --git a/libXfont/src/fontfile/fontdir.c b/libXfont/src/fontfile/fontdir.c
index ef7ffa561..7271603ec 100644
--- a/libXfont/src/fontfile/fontdir.c
+++ b/libXfont/src/fontfile/fontdir.c
@@ -177,6 +177,11 @@ FontFileAddEntry(FontTablePtr table, FontEntryPtr prototype)
     if (table->sorted)
 	return (FontEntryPtr) 0;    /* "cannot" happen */
     if (table->used == table->size) {
+	if (table->size >= ((INT32_MAX / sizeof(FontEntryRec)) - 100))
+	    /* If we've read so many entries we're going to ask for 2gb
+	       or more of memory, something is so wrong with this font
+	       directory that we should just give up before we overflow. */
+	    return NULL;
 	newsize = table->size + 100;
 	entry = realloc(table->entries, newsize * sizeof(FontEntryRec));
 	if (!entry)