randrproto fontconfig libfontenc libxcb mesalib xserver pixman xkeyboard-config git update 15 May 2015

xserver          commit bf6344e1913a5d24c2d68eaca999ea3d71e1b707
libxcb           commit cb621341a62e6d2233db3e337611f6fdd4f675a6
libxcb/xcb-proto commit 4c550465934164aab2449a125f75f4ca07816233
xkeyboard-config commit 5da6d510b460cad1b31288618cc364e586576826
libX11           commit d3415d1f052530760b4617db45affcb984cfe35c
libXdmcp         commit b10f382e3aa2e86cd5a2bc27d6758da55f0ab1f6
libXext          commit efdcbb7634501e1117d422636a0a75d7ea84b16b
libfontenc       commit 42f3a39c3085afd9ef904ae39102fd49bbc2e4a5
libXinerama      commit edd95182b26eb5d576d4878c559e0f17dddaa909
libXau           commit 1e4635be11154dd8262f37b379511bd627defa2a
xkbcomp          commit 1ae525b3d236b59e6437b2b5433d460e18370973
pixman           commit 82f9b4faaf1aa63ec26b0dfd227f1a8e5e139ae2
xextproto        commit 66afec3f49e8eb0d4c2e9af7088fc3116d4bafd7
randrproto       commit 895ee5264524c7c239ee4ef5e39c4e295323fb51
glproto          commit bd3d751e1eb17efb39f65093271bb4ac071aa9e0
mkfontscale      commit 87d628f8eec170ec13bb9feefb1ce05aed07d1d6
xwininfo         commit 0c49f8f2bd56b1e77721e81030ea948386dcdf4e
libXft           commit e8a83226bc10afb587f6f34daac44d2ef809c85e
libXmu           commit 4459e6940fe3fdf26a8d5d4c71989498bc400a62
libxtrans        commit 7cbad9fe2e61cd9d5caeaf361826a6f4bd320f03
fontconfig       commit 55ff8419274fd5ce59675f220b85035a3986d6cf
mesa             commit 3687d752e51829b4723c9abb07ae56d2bbcda570

14 files changed, 79 insertions, 82 deletions

diff --git a/xorg-server/dix/atom.c b/xorg-server/dix/atom.c
index 22cd0dc0e..7de7fb05e 100644
--- a/xorg-server/dix/atom.c
+++ b/xorg-server/dix/atom.c
@@ -119,7 +119,7 @@ MakeAtom(const char *string, unsigned len, Bool makeit)
         if ((lastAtom + 1) >= tableLength) {
             NodePtr *table;
 
-            table = realloc(nodeTable, tableLength * (2 * sizeof(NodePtr)));
+            table = reallocarray(nodeTable, tableLength, 2 * sizeof(NodePtr));
             if (!table) {
                 if (nd->string != string) {
                     /* nd->string has been strdup'ed */
@@ -200,7 +200,7 @@ InitAtoms(void)
 {
     FreeAllAtoms();
     tableLength = InitialTableSize;
-    nodeTable = malloc(InitialTableSize * sizeof(NodePtr));
+    nodeTable = xallocarray(InitialTableSize, sizeof(NodePtr));
     if (!nodeTable)
         AtomError();
     nodeTable[None] = NULL;
diff --git a/xorg-server/dix/colormap.c b/xorg-server/dix/colormap.c
index 4d408d5d2..a3e5a2c09 100644
--- a/xorg-server/dix/colormap.c
+++ b/xorg-server/dix/colormap.c
@@ -296,7 +296,7 @@ CreateColormap(Colormap mid, ScreenPtr pScreen, VisualPtr pVisual,
         for (pent = &pmap->red[size - 1]; pent >= pmap->red; pent--)
             pent->refcnt = AllocPrivate;
         pmap->freeRed = 0;
-        ppix = malloc(size * sizeof(Pixel));
+        ppix = xallocarray(size, sizeof(Pixel));
         if (!ppix) {
             free(pmap);
             return BadAlloc;
@@ -337,7 +337,7 @@ CreateColormap(Colormap mid, ScreenPtr pScreen, VisualPtr pVisual,
             for (pent = &pmap->green[size - 1]; pent >= pmap->green; pent--)
                 pent->refcnt = AllocPrivate;
             pmap->freeGreen = 0;
-            ppix = malloc(size * sizeof(Pixel));
+            ppix = xallocarray(size, sizeof(Pixel));
             if (!ppix) {
                 free(pmap->clientPixelsRed[client]);
                 free(pmap);
@@ -352,7 +352,7 @@ CreateColormap(Colormap mid, ScreenPtr pScreen, VisualPtr pVisual,
             for (pent = &pmap->blue[size - 1]; pent >= pmap->blue; pent--)
                 pent->refcnt = AllocPrivate;
             pmap->freeBlue = 0;
-            ppix = malloc(size * sizeof(Pixel));
+            ppix = xallocarray(size, sizeof(Pixel));
             if (!ppix) {
                 free(pmap->clientPixelsGreen[client]);
                 free(pmap->clientPixelsRed[client]);
@@ -702,7 +702,7 @@ UpdateColors(ColormapPtr pmap)
 
     pVisual = pmap->pVisual;
     size = pVisual->ColormapEntries;
-    defs = malloc(size * sizeof(xColorItem));
+    defs = xallocarray(size, sizeof(xColorItem));
     if (!defs)
         return;
     n = 0;
@@ -792,8 +792,8 @@ AllocColor(ColormapPtr pmap,
         *pgreen = pmap->red[pixR].co.local.green;
         *pblue = pmap->red[pixR].co.local.blue;
         npix = pmap->numPixelsRed[client];
-        ppix = (Pixel *) realloc(pmap->clientPixelsRed[client],
-                                 (npix + 1) * sizeof(Pixel));
+        ppix = reallocarray(pmap->clientPixelsRed[client],
+                            npix + 1, sizeof(Pixel));
         if (!ppix)
             return BadAlloc;
         ppix[npix] = pixR;
@@ -814,22 +814,22 @@ AllocColor(ColormapPtr pmap,
         *pgreen = pmap->green[pixG].co.local.green;
         *pblue = pmap->blue[pixB].co.local.blue;
         npix = pmap->numPixelsRed[client];
-        ppix = (Pixel *) realloc(pmap->clientPixelsRed[client],
-                                 (npix + 1) * sizeof(Pixel));
+        ppix = reallocarray(pmap->clientPixelsRed[client],
+                            npix + 1, sizeof(Pixel));
         if (!ppix)
             return BadAlloc;
         ppix[npix] = pixR;
         pmap->clientPixelsRed[client] = ppix;
         npix = pmap->numPixelsGreen[client];
-        ppix = (Pixel *) realloc(pmap->clientPixelsGreen[client],
-                                 (npix + 1) * sizeof(Pixel));
+        ppix = reallocarray(pmap->clientPixelsGreen[client],
+                            npix + 1, sizeof(Pixel));
         if (!ppix)
             return BadAlloc;
         ppix[npix] = pixG;
         pmap->clientPixelsGreen[client] = ppix;
         npix = pmap->numPixelsBlue[client];
-        ppix = (Pixel *) realloc(pmap->clientPixelsBlue[client],
-                                 (npix + 1) * sizeof(Pixel));
+        ppix = reallocarray(pmap->clientPixelsBlue[client],
+                            npix + 1, sizeof(Pixel));
         if (!ppix)
             return BadAlloc;
         ppix[npix] = pixB;
@@ -1279,7 +1279,7 @@ FindColor(ColormapPtr pmap, EntryPtr pentFirst, int size, xrgb * prgb,
         break;
     }
     npix = nump[client];
-    ppix = (Pixel *) realloc(pixp[client], (npix + 1) * sizeof(Pixel));
+    ppix = reallocarray(pixp[client], npix + 1, sizeof(Pixel));
     if (!ppix) {
         pent->refcnt--;
         if (!pent->fShared)
@@ -1647,9 +1647,9 @@ AllocDirect(int client, ColormapPtr pmap, int c, int r, int g, int b,
     for (p = pixels; p < pixels + c; p++)
         *p = 0;
 
-    ppixRed = malloc(npixR * sizeof(Pixel));
-    ppixGreen = malloc(npixG * sizeof(Pixel));
-    ppixBlue = malloc(npixB * sizeof(Pixel));
+    ppixRed = xallocarray(npixR, sizeof(Pixel));
+    ppixGreen = xallocarray(npixG, sizeof(Pixel));
+    ppixBlue = xallocarray(npixB, sizeof(Pixel));
     if (!ppixRed || !ppixGreen || !ppixBlue) {
         free(ppixBlue);
         free(ppixGreen);
@@ -1662,19 +1662,19 @@ AllocDirect(int client, ColormapPtr pmap, int c, int r, int g, int b,
     okB = AllocCP(pmap, pmap->blue, c, b, contig, ppixBlue, pbmask);
 
     if (okR && okG && okB) {
-        rpix = (Pixel *) realloc(pmap->clientPixelsRed[client],
-                                 (pmap->numPixelsRed[client] + (c << r)) *
-                                 sizeof(Pixel));
+        rpix = reallocarray(pmap->clientPixelsRed[client],
+                            pmap->numPixelsRed[client] + (c << r),
+                            sizeof(Pixel));
         if (rpix)
             pmap->clientPixelsRed[client] = rpix;
-        gpix = (Pixel *) realloc(pmap->clientPixelsGreen[client],
-                                 (pmap->numPixelsGreen[client] + (c << g)) *
-                                 sizeof(Pixel));
+        gpix = reallocarray(pmap->clientPixelsGreen[client],
+                            pmap->numPixelsGreen[client] + (c << g),
+                            sizeof(Pixel));
         if (gpix)
             pmap->clientPixelsGreen[client] = gpix;
-        bpix = (Pixel *) realloc(pmap->clientPixelsBlue[client],
-                                 (pmap->numPixelsBlue[client] + (c << b)) *
-                                 sizeof(Pixel));
+        bpix = reallocarray(pmap->clientPixelsBlue[client],
+                            pmap->numPixelsBlue[client] + (c << b),
+                            sizeof(Pixel));
         if (bpix)
             pmap->clientPixelsBlue[client] = bpix;
     }
@@ -1747,7 +1747,7 @@ AllocPseudo(int client, ColormapPtr pmap, int c, int r, Bool contig,
     npix = c << r;
     if ((r >= 32) || (npix > pmap->freeRed) || (npix < c))
         return BadAlloc;
-    if (!(ppixTemp = malloc(npix * sizeof(Pixel))))
+    if (!(ppixTemp = xallocarray(npix, sizeof(Pixel))))
         return BadAlloc;
     ok = AllocCP(pmap, pmap->red, c, r, contig, ppixTemp, pmask);
 
@@ -1755,9 +1755,8 @@ AllocPseudo(int client, ColormapPtr pmap, int c, int r, Bool contig,
 
         /* all the allocated pixels are added to the client pixel list,
          * but only the unique ones are returned to the client */
-        ppix = (Pixel *) realloc(pmap->clientPixelsRed[client],
-                                 (pmap->numPixelsRed[client] +
-                                  npix) * sizeof(Pixel));
+        ppix = reallocarray(pmap->clientPixelsRed[client],
+                            pmap->numPixelsRed[client] + npix, sizeof(Pixel));
         if (!ppix) {
             for (p = ppixTemp; p < ppixTemp + npix; p++)
                 pmap->red[*p].refcnt = 0;
@@ -1960,7 +1959,7 @@ AllocShared(ColormapPtr pmap, Pixel * ppix, int c, int r, int g, int b,
 
     npixClientNew = c << (r + g + b);
     npixShared = (c << r) + (c << g) + (c << b);
-    psharedList = malloc(npixShared * sizeof(SHAREDCOLOR *));
+    psharedList = xallocarray(npixShared, sizeof(SHAREDCOLOR *));
     if (!psharedList)
         return FALSE;
     ppshared = psharedList;
@@ -2204,7 +2203,7 @@ FreeCo(ColormapPtr pmap, int client, int color, int npixIn, Pixel * ppixIn,
                     npix++;
                 }
             }
-            pptr = (Pixel *) realloc(ppixClient, npixNew * sizeof(Pixel));
+            pptr = reallocarray(ppixClient, npixNew, sizeof(Pixel));
             if (pptr)
                 ppixClient = pptr;
             npixClient = npixNew;
@@ -2469,8 +2468,8 @@ IsMapInstalled(Colormap map, WindowPtr pWin)
     Colormap *pmaps;
     int imap, nummaps, found;
 
-    pmaps =
-        malloc(pWin->drawable.pScreen->maxInstalledCmaps * sizeof(Colormap));
+    pmaps = xallocarray(pWin->drawable.pScreen->maxInstalledCmaps,
+                        sizeof(Colormap));
     if (!pmaps)
         return FALSE;
     nummaps = (*pWin->drawable.pScreen->ListInstalledColormaps)
@@ -2521,8 +2520,8 @@ ResizeVisualArray(ScreenPtr pScreen, int new_visual_count, DepthPtr depth)
     first_new_vid = depth->numVids;
     first_new_visual = pScreen->numVisuals;
 
-    vids =
-        realloc(depth->vids, (depth->numVids + new_visual_count) * sizeof(XID));
+    vids = reallocarray(depth->vids, depth->numVids + new_visual_count,
+                        sizeof(XID));
     if (!vids)
         return FALSE;
 
@@ -2530,7 +2529,7 @@ ResizeVisualArray(ScreenPtr pScreen, int new_visual_count, DepthPtr depth)
     depth->vids = vids;
 
     numVisuals = pScreen->numVisuals + new_visual_count;
-    visuals = realloc(pScreen->visuals, numVisuals * sizeof(VisualRec));
+    visuals = reallocarray(pScreen->visuals, numVisuals, sizeof(VisualRec));
     if (!visuals) {
         return FALSE;
     }
diff --git a/xorg-server/dix/devices.c b/xorg-server/dix/devices.c
index d8e7f9c40..1f8dabddd 100644
--- a/xorg-server/dix/devices.c
+++ b/xorg-server/dix/devices.c
@@ -177,6 +177,9 @@ DeviceSetProperty(DeviceIntPtr dev, Atom property, XIPropertyValuePtr prop,
             if (!isfinite(f[i]))
                 return BadValue;
 
+	if (!dev->valuator)
+		return BadMatch;
+
         if (!checkonly)
             DeviceSetTransform(dev, f);
     }
@@ -1469,8 +1472,8 @@ InitStringFeedbackClassDeviceStruct(DeviceIntPtr dev,
     feedc->ctrl.num_symbols_displayed = 0;
     feedc->ctrl.max_symbols = max_symbols;
     feedc->ctrl.symbols_supported =
-        malloc(sizeof(KeySym) * num_symbols_supported);
-    feedc->ctrl.symbols_displayed = malloc(sizeof(KeySym) * max_symbols);
+        xallocarray(num_symbols_supported, sizeof(KeySym));
+    feedc->ctrl.symbols_displayed = xallocarray(max_symbols, sizeof(KeySym));
     if (!feedc->ctrl.symbols_supported || !feedc->ctrl.symbols_displayed) {
         free(feedc->ctrl.symbols_supported);
         free(feedc->ctrl.symbols_displayed);
diff --git a/xorg-server/dix/dispatch.c b/xorg-server/dix/dispatch.c
index 17fa75e19..9208582a6 100644
--- a/xorg-server/dix/dispatch.c
+++ b/xorg-server/dix/dispatch.c
@@ -344,7 +344,7 @@ Dispatch(void)
     nextFreeClientID = 1;
     nClients = 0;
 
-    clientReady = malloc(sizeof(int) * MaxClients);
+    clientReady = xallocarray(MaxClients, sizeof(int));
     if (!clientReady)
         return;
 
@@ -963,7 +963,7 @@ ProcQueryTree(ClientPtr client)
     if (numChildren) {
         int curChild = 0;
 
-        childIDs = malloc(numChildren * sizeof(Window));
+        childIDs = xallocarray(numChildren, sizeof(Window));
         if (!childIDs)
             return BadAlloc;
         for (pChild = pWin->lastChild; pChild != pHead;
@@ -2786,7 +2786,7 @@ ProcQueryColors(ClientPtr client)
 
         count =
             bytes_to_int32((client->req_len << 2) - sizeof(xQueryColorsReq));
-        prgbs = calloc(1, count * sizeof(xrgb));
+        prgbs = calloc(count, sizeof(xrgb));
         if (!prgbs && count)
             return BadAlloc;
         if ((rc =
@@ -2908,10 +2908,10 @@ ProcCreateCursor(ClientPtr client)
     if (stuff->x > width || stuff->y > height)
         return BadMatch;
 
-    n = BitmapBytePad(width) * height;
-    srcbits = calloc(1, n);
+    srcbits = calloc(BitmapBytePad(width), height);
     if (!srcbits)
         return BadAlloc;
+    n = BitmapBytePad(width) * height;
     mskbits = malloc(n);
     if (!mskbits) {
         free(srcbits);
diff --git a/xorg-server/dix/dixfonts.c b/xorg-server/dix/dixfonts.c
index bc2732fb9..be389e82f 100644
--- a/xorg-server/dix/dixfonts.c
+++ b/xorg-server/dix/dixfonts.c
@@ -168,9 +168,8 @@ QueueFontWakeup(FontPathElementPtr fpe)
         }
     }
     if (num_slept_fpes == size_slept_fpes) {
-        new = (FontPathElementPtr *)
-            realloc(slept_fpes,
-                    sizeof(FontPathElementPtr) * (size_slept_fpes + 4));
+        new = reallocarray(slept_fpes, size_slept_fpes + 4,
+                           sizeof(FontPathElementPtr));
         if (!new)
             return;
         slept_fpes = new;
@@ -424,7 +423,7 @@ OpenFont(ClientPtr client, XID fid, Mask flags, unsigned lenfname,
      * copy the current FPE list, so that if it gets changed by another client
      * while we're blocking, the request still appears atomic
      */
-    c->fpe_list = malloc(sizeof(FontPathElementPtr) * num_fpes);
+    c->fpe_list = xallocarray(num_fpes, sizeof(FontPathElementPtr));
     if (!c->fpe_list) {
         free((void *) c->fontname);
         free(c);
@@ -821,7 +820,7 @@ ListFonts(ClientPtr client, unsigned char *pattern, unsigned length,
 
     if (!(c = malloc(sizeof *c)))
         return BadAlloc;
-    c->fpe_list = malloc(sizeof(FontPathElementPtr) * num_fpes);
+    c->fpe_list = xallocarray(num_fpes, sizeof(FontPathElementPtr));
     if (!c->fpe_list) {
         free(c);
         return BadAlloc;
@@ -1072,7 +1071,7 @@ StartListFontsWithInfo(ClientPtr client, int length, unsigned char *pattern,
 
     if (!(c = malloc(sizeof *c)))
         goto badAlloc;
-    c->fpe_list = malloc(sizeof(FontPathElementPtr) * num_fpes);
+    c->fpe_list = xallocarray(num_fpes, sizeof(FontPathElementPtr));
     if (!c->fpe_list) {
         free(c);
         goto badAlloc;
@@ -1441,7 +1440,7 @@ doImageText(ClientPtr client, ITclosurePtr c)
             *new_closure = *c;
             c = new_closure;
 
-            data = malloc(c->nChars * itemSize);
+            data = xallocarray(c->nChars, itemSize);
             if (!data) {
                 free(c);
                 c = old_closure;
@@ -1597,7 +1596,7 @@ SetFontPathElements(int npaths, unsigned char *paths, int *bad, Bool persist)
     unsigned char *cp = paths;
     FontPathElementPtr fpe = NULL, *fplist;
 
-    fplist = malloc(sizeof(FontPathElementPtr) * npaths);
+    fplist = xallocarray(npaths, sizeof(FontPathElementPtr));
     if (!fplist) {
         *bad = 0;
         return BadAlloc;
@@ -1894,8 +1893,7 @@ RegisterFPEFunctions(NameCheckFunc name_func,
     FPEFunctions *new;
 
     /* grow the list */
-    new = (FPEFunctions *) realloc(fpe_functions,
-                                   (num_fpe_types + 1) * sizeof(FPEFunctions));
+    new = reallocarray(fpe_functions, num_fpe_types + 1, sizeof(FPEFunctions));
     if (!new)
         return -1;
     fpe_functions = new;
diff --git a/xorg-server/dix/enterleave.c b/xorg-server/dix/enterleave.c
index 54f4b8554..7f1f94165 100644
--- a/xorg-server/dix/enterleave.c
+++ b/xorg-server/dix/enterleave.c
@@ -714,7 +714,7 @@ DeliverStateNotifyEvent(DeviceIntPtr dev, WindowPtr win)
         }
     }
 
-    sev = ev = (deviceStateNotify *) malloc(evcount * sizeof(xEvent));
+    sev = ev = xallocarray(evcount, sizeof(xEvent));
     FixDeviceStateNotify(dev, ev, NULL, NULL, NULL, first);
 
     if (b != NULL) {
diff --git a/xorg-server/dix/events.c b/xorg-server/dix/events.c
index c232ebadc..efaf91d2b 100644
--- a/xorg-server/dix/events.c
+++ b/xorg-server/dix/events.c
@@ -1057,6 +1057,7 @@ MonthChangedOrBadTime(CARD32 *ms)
 void
 NoticeTime(const DeviceIntPtr dev, TimeStamp time)
 {
+    currentTime = time;
     lastDeviceEventTime[XIAllDevices].time = currentTime;
     lastDeviceEventTime[dev->id].time = currentTime;
 
@@ -4785,8 +4786,8 @@ SetInputFocus(ClientPtr client,
             depth++;
         if (depth > focus->traceSize) {
             focus->traceSize = depth + 1;
-            focus->trace = realloc(focus->trace,
-                                   focus->traceSize * sizeof(WindowPtr));
+            focus->trace = reallocarray(focus->trace, focus->traceSize,
+                                        sizeof(WindowPtr));
         }
         focus->traceGood = depth;
         for (pWin = focusWin, depth--; pWin; pWin = pWin->parent, depth--)
diff --git a/xorg-server/dix/extension.c b/xorg-server/dix/extension.c
index 56e3abc14..e81f673b2 100644
--- a/xorg-server/dix/extension.c
+++ b/xorg-server/dix/extension.c
@@ -103,8 +103,7 @@ AddExtension(const char *name, int NumEvents, int NumErrors,
         return ((ExtensionEntry *) NULL);
     }
     i = NumExtensions;
-    newexts = (ExtensionEntry **) realloc(extensions,
-                                          (i + 1) * sizeof(ExtensionEntry *));
+    newexts = reallocarray(extensions, i + 1, sizeof(ExtensionEntry *));
     if (!newexts) {
         free((void *) ext->name);
         dixFreePrivates(ext->devPrivates, PRIVATE_EXTENSION);
@@ -153,8 +152,7 @@ AddExtensionAlias(const char *alias, ExtensionEntry * ext)
 
     if (!ext)
         return FALSE;
-    aliases = realloc(ext->aliases,
-                      (ext->num_aliases + 1) * sizeof(char *));
+    aliases = reallocarray(ext->aliases, ext->num_aliases + 1, sizeof(char *));
     if (!aliases)
         return FALSE;
     ext->aliases = aliases;
diff --git a/xorg-server/dix/glyphcurs.c b/xorg-server/dix/glyphcurs.c
index eca6a4cb8..3ff6ae83e 100644
--- a/xorg-server/dix/glyphcurs.c
+++ b/xorg-server/dix/glyphcurs.c
@@ -78,7 +78,6 @@ ServerBitsFromGlyph(FontPtr pfont, unsigned ch, CursorMetricPtr cm,
     GCPtr pGC;
     xRectangle rect;
     PixmapPtr ppix;
-    long nby;
     char *pbits;
     ChangeGCVal gcval[3];
     unsigned char char2b[2];
@@ -88,8 +87,7 @@ ServerBitsFromGlyph(FontPtr pfont, unsigned ch, CursorMetricPtr cm,
     char2b[1] = (unsigned char) (ch & 0xff);
 
     pScreen = screenInfo.screens[0];
-    nby = BitmapBytePad(cm->width) * (long) cm->height;
-    pbits = calloc(1, nby);
+    pbits = calloc(BitmapBytePad(cm->width), cm->height);
     if (!pbits)
         return BadAlloc;
 
diff --git a/xorg-server/dix/grabs.c b/xorg-server/dix/grabs.c
index b92f1e7ce..2a307a2b9 100644
--- a/xorg-server/dix/grabs.c
+++ b/xorg-server/dix/grabs.c
@@ -594,10 +594,10 @@ DeletePassiveGrabFromList(GrabPtr pMinuendGrab)
         i++;
     if (!i)
         return TRUE;
-    deletes = malloc(i * sizeof(GrabPtr));
-    adds = malloc(i * sizeof(GrabPtr));
-    updates = malloc(i * sizeof(Mask **));
-    details = malloc(i * sizeof(Mask *));
+    deletes = xallocarray(i, sizeof(GrabPtr));
+    adds = xallocarray(i, sizeof(GrabPtr));
+    updates = xallocarray(i, sizeof(Mask **));
+    details = xallocarray(i, sizeof(Mask *));
     if (!deletes || !adds || !updates || !details) {
         free(details);
         free(updates);
diff --git a/xorg-server/dix/property.c b/xorg-server/dix/property.c
index ff7f31aa9..99608af72 100644
--- a/xorg-server/dix/property.c
+++ b/xorg-server/dix/property.c
@@ -136,8 +136,8 @@ ProcRotateProperties(ClientPtr client)
         return rc;
 
     atoms = (Atom *) &stuff[1];
-    props = malloc(stuff->nAtoms * sizeof(PropertyPtr));
-    saved = malloc(stuff->nAtoms * sizeof(PropertyRec));
+    props = xallocarray(stuff->nAtoms, sizeof(PropertyPtr));
+    saved = xallocarray(stuff->nAtoms, sizeof(PropertyRec));
     if (!props || !saved) {
         rc = BadAlloc;
         goto out;
@@ -313,7 +313,7 @@ dixChangeWindowProperty(ClientPtr pClient, WindowPtr pWin, Atom property,
             /* do nothing */
         }
         else if (mode == PropModeAppend) {
-            data = malloc((pProp->size + len) * sizeInBytes);
+            data = xallocarray(pProp->size + len, sizeInBytes);
             if (!data)
                 return BadAlloc;
             memcpy(data, pProp->data, pProp->size * sizeInBytes);
@@ -322,7 +322,7 @@ dixChangeWindowProperty(ClientPtr pClient, WindowPtr pWin, Atom property,
             pProp->size += len;
         }
         else if (mode == PropModePrepend) {
-            data = malloc(sizeInBytes * (len + pProp->size));
+            data = xallocarray(len + pProp->size, sizeInBytes);
             if (!data)
                 return BadAlloc;
             memcpy(data + totalSize, pProp->data, pProp->size * sizeInBytes);
@@ -581,7 +581,7 @@ ProcListProperties(ClientPtr client)
     for (pProp = wUserProps(pWin); pProp; pProp = pProp->next)
         numProps++;
 
-    if (numProps && !(pAtoms = malloc(numProps * sizeof(Atom))))
+    if (numProps && !(pAtoms = xallocarray(numProps, sizeof(Atom))))
         return BadAlloc;
 
     numProps = 0;
diff --git a/xorg-server/dix/region.c b/xorg-server/dix/region.c
index 04e590170..fd7313990 100644
--- a/xorg-server/dix/region.c
+++ b/xorg-server/dix/region.c
@@ -1247,7 +1247,7 @@ RegionValidate(RegionPtr badreg, Bool *pOverlap)
         if (sizeRI == numRI) {
             /* Oops, allocate space for new region information */
             sizeRI <<= 1;
-            rit = (RegionInfo *) realloc(ri, sizeRI * sizeof(RegionInfo));
+            rit = (RegionInfo *) reallocarray(ri, sizeRI, sizeof(RegionInfo));
             if (!rit)
                 goto bail;
             ri = rit;
diff --git a/xorg-server/dix/resource.c b/xorg-server/dix/resource.c
index 964f0b306..af8e162bb 100644
--- a/xorg-server/dix/resource.c
+++ b/xorg-server/dix/resource.c
@@ -510,7 +510,7 @@ CreateNewResourceType(DeleteType deleteFunc, const char *name)
 
     if (next & lastResourceClass)
         return 0;
-    types = realloc(resourceTypes, (next + 1) * sizeof(*resourceTypes));
+    types = reallocarray(resourceTypes, next + 1, sizeof(*resourceTypes));
     if (!types)
         return 0;
 
@@ -834,10 +834,10 @@ RebuildTable(int client)
      */
 
     j = 2 * clientTable[client].buckets;
-    tails = malloc(j * sizeof(ResourcePtr *));
+    tails =  xallocarray(j, sizeof(ResourcePtr *));
     if (!tails)
         return;
-    resources = malloc(j * sizeof(ResourcePtr));
+    resources =  xallocarray(j, sizeof(ResourcePtr));
     if (!resources) {
         free(tails);
         return;
diff --git a/xorg-server/dix/touch.c b/xorg-server/dix/touch.c
index 1eeed78bd..49d16ab37 100644
--- a/xorg-server/dix/touch.c
+++ b/xorg-server/dix/touch.c
@@ -101,7 +101,7 @@ TouchResizeQueue(ClientPtr client, void *closure)
          * don't need to do it often */
         size = dev->last.num_touches + dev->last.num_touches / 2 + 1;
 
-        tmp = realloc(dev->last.touches, size * sizeof(*dev->last.touches));
+        tmp = reallocarray(dev->last.touches, size, sizeof(*dev->last.touches));
         if (tmp) {
             int j;
 
@@ -350,7 +350,7 @@ TouchBeginTouch(DeviceIntPtr dev, int sourceid, uint32_t touchid,
 
     /* If we get here, then we've run out of touches: enlarge dev->touch and
      * try again. */
-    tmp = realloc(t->touches, (t->num_touches + 1) * sizeof(*ti));
+    tmp = reallocarray(t->touches, t->num_touches + 1, sizeof(*ti));
     if (tmp) {
         t->touches = tmp;
         t->num_touches++;
@@ -547,8 +547,8 @@ TouchBuildDependentSpriteTrace(DeviceIntPtr dev, SpritePtr sprite)
         return FALSE;
 
     if (srcsprite->spriteTraceGood > sprite->spriteTraceSize) {
-        trace = realloc(sprite->spriteTrace,
-                        srcsprite->spriteTraceSize * sizeof(*trace));
+        trace = reallocarray(sprite->spriteTrace,
+                             srcsprite->spriteTraceSize, sizeof(*trace));
         if (!trace) {
             sprite->spriteTraceGood = 0;
             return FALSE;