4 files changed, 19 insertions, 12 deletions
diff --git a/xorg-server/Xi/exevents.c b/xorg-server/Xi/exevents.c
index 1232fe363..34dd80ff6 100644
--- a/xorg-server/Xi/exevents.c
+++ b/xorg-server/Xi/exevents.c
@@ -537,6 +537,7 @@ DeepCopyPointerClasses(DeviceIntPtr from, DeviceIntPtr to)
     if (from->valuator)
     {
         ValuatorClassPtr v;
+
         if (!to->valuator)
         {
             classes = to->unused_classes;
@@ -545,18 +546,14 @@ DeepCopyPointerClasses(DeviceIntPtr from, DeviceIntPtr to)
                 classes->valuator = NULL;
         }
 
-        to->valuator = realloc(to->valuator, sizeof(ValuatorClassRec) +
-                from->valuator->numAxes * sizeof(AxisInfo) +
-                from->valuator->numAxes * sizeof(double));
-        v = to->valuator;
+        v = AllocValuatorClass(to->valuator, from->valuator->numAxes);
+
         if (!v)
             FatalError("[Xi] no memory for class shift.\n");
 
-        v->numAxes = from->valuator->numAxes;
-        v->axes = (AxisInfoPtr)&v[1];
+        to->valuator = v;
         memcpy(v->axes, from->valuator->axes, v->numAxes * sizeof(AxisInfo));
 
-        v->axisVal = (double*)(v->axes + from->valuator->numAxes);
         v->sourceid = from->id;
     } else if (to->valuator && !from->valuator)
     {
diff --git a/xorg-server/Xi/extinit.c b/xorg-server/Xi/extinit.c
index 84b0086ff..88786abb7 100644
--- a/xorg-server/Xi/extinit.c
+++ b/xorg-server/Xi/extinit.c
@@ -511,7 +511,7 @@ SReplyIDispatch(ClientPtr client, int len, xGrabDeviceReply * rep)
         SRepXIQueryDevice(client, len, (xXIQueryDeviceReply*)rep);
     else if (rep->RepType == X_XIGrabDevice)
 	SRepXIGrabDevice(client, len, (xXIGrabDeviceReply *) rep);
-    else if (rep->RepType == X_XIGrabDevice)
+    else if (rep->RepType == X_XIPassiveGrabDevice)
 	SRepXIPassiveGrabDevice(client, len, (xXIPassiveGrabDeviceReply *) rep);
     else if (rep->RepType == X_XIListProperties)
 	SRepXIListProperties(client, len, (xXIListPropertiesReply *) rep);
diff --git a/xorg-server/Xi/xichangehierarchy.c b/xorg-server/Xi/xichangehierarchy.c
index d48200b04..94edf6623 100644
--- a/xorg-server/Xi/xichangehierarchy.c
+++ b/xorg-server/Xi/xichangehierarchy.c
@@ -116,7 +116,9 @@ void XISendDeviceHierarchyEvent(int flags[MAXDEVICES])
 
     ev->length = bytes_to_int32(ev->num_info * sizeof(xXIHierarchyInfo));
 
+    memset(&dummyDev, 0, sizeof(dummyDev));
     dummyDev.id = XIAllDevices;
+    dummyDev.type = SLAVE;
     SendEventToAllWindows(&dummyDev, (XI_HierarchyChangedMask >> 8), (xEvent*)ev, 1);
     free(ev);
 }
diff --git a/xorg-server/Xi/xipassivegrab.c b/xorg-server/Xi/xipassivegrab.c
index 487c2721b..fe8c3944a 100644
--- a/xorg-server/Xi/xipassivegrab.c
+++ b/xorg-server/Xi/xipassivegrab.c
@@ -43,6 +43,7 @@
 #include "exevents.h"
 #include "xipassivegrab.h"
 #include "dixgrabs.h"
+#include "misc.h"
 
 int
 SProcXIPassiveGrabDevice(ClientPtr client)
@@ -87,6 +88,7 @@ ProcXIPassiveGrabDevice(ClientPtr client)
     GrabParameters param;
     void *tmp;
     int mask_len;
+    int n;
 
     REQUEST(xXIPassiveGrabDeviceReq);
     REQUEST_AT_LEAST_SIZE(xXIPassiveGrabDeviceReq);
@@ -99,7 +101,10 @@ ProcXIPassiveGrabDevice(ClientPtr client)
     {
         ret = dixLookupDevice(&dev, stuff->deviceid, client, DixGrabAccess);
         if (ret != Success)
+        {
+            client->errorValue = stuff->deviceid;
             return ret;
+        }
     }
 
     if (stuff->grab_type != XIGrabtypeButton &&
@@ -156,6 +161,8 @@ ProcXIPassiveGrabDevice(ClientPtr client)
 	return status;
 
     status = CheckGrabValues(client, &param);
+    if (status != Success)
+        return status;
 
     modifiers = (uint32_t*)&stuff[1] + stuff->mask_len;
     modifiers_failed = calloc(stuff->num_modifiers, sizeof(xXIGrabModifierInfo));
@@ -190,6 +197,9 @@ ProcXIPassiveGrabDevice(ClientPtr client)
 
             info->status = status;
             info->modifiers = *modifiers;
+            if (client->swapped)
+                swapl(&info->modifiers, n);
+
             rep.num_modifiers++;
             rep.length += bytes_to_int32(sizeof(xXIGrabModifierInfo));
         }
@@ -197,10 +207,8 @@ ProcXIPassiveGrabDevice(ClientPtr client)
 
     WriteReplyToClient(client, sizeof(rep), &rep);
     if (rep.num_modifiers)
-    {
-	client->pSwapReplyFunc = (ReplySwapPtr) Swap32Write;
-        WriteSwappedDataToClient(client, rep.length * 4, (char*)modifiers_failed);
-    }
+        WriteToClient(client, rep.length * 4, (char*)modifiers_failed);
+
     free(modifiers_failed);
     return ret;
 }