4 files changed, 9 insertions, 11 deletions

diff --git a/xorg-server/Xi/exevents.c b/xorg-server/Xi/exevents.c
index 0857bcee6..1c586d051 100644
--- a/xorg-server/Xi/exevents.c
+++ b/xorg-server/Xi/exevents.c
@@ -471,9 +471,9 @@ DeepCopyKeyboardClasses(DeviceIntPtr from, DeviceIntPtr to)
 
             oldTrace = to->focus->trace;
             memcpy(to->focus, from->focus, sizeof(FocusClassRec));
-            to->focus->trace = realloc(oldTrace,
-                                       to->focus->traceSize *
-                                       sizeof(WindowPtr));
+            to->focus->trace = reallocarray(oldTrace,
+                                            to->focus->traceSize,
+                                            sizeof(WindowPtr));
             if (!to->focus->trace && to->focus->traceSize)
                 FatalError("[Xi] no memory for trace.\n");
             memcpy(to->focus->trace, from->focus->trace,
diff --git a/xorg-server/Xi/getprop.c b/xorg-server/Xi/getprop.c
index 4d6ce6338..19f18af21 100644
--- a/xorg-server/Xi/getprop.c
+++ b/xorg-server/Xi/getprop.c
@@ -118,7 +118,7 @@ ProcXGetDeviceDontPropagateList(ClientPtr client)
             ClassFromMask(NULL, others->dontPropagateMask[i], i, &count, COUNT);
         if (count) {
             rep.count = count;
-            buf = (XEventClass *) malloc(rep.count * sizeof(XEventClass));
+            buf = xallocarray(rep.count, sizeof(XEventClass));
             rep.length = bytes_to_int32(rep.count * sizeof(XEventClass));
 
             tbuf = buf;
diff --git a/xorg-server/Xi/xiproperty.c b/xorg-server/Xi/xiproperty.c
index 8e8e4b061..e3b8f5abe 100644
--- a/xorg-server/Xi/xiproperty.c
+++ b/xorg-server/Xi/xiproperty.c
@@ -221,7 +221,7 @@ list_atoms(DeviceIntPtr dev, int *natoms, Atom **atoms_return)
     if (nprops) {
         Atom *a;
 
-        atoms = malloc(nprops * sizeof(Atom));
+        atoms = xallocarray(nprops, sizeof(Atom));
         if (!atoms)
             return BadAlloc;
         a = atoms;
@@ -687,7 +687,6 @@ XIChangeDeviceProperty(DeviceIntPtr dev, Atom property, Atom type,
 {
     XIPropertyPtr prop;
     int size_in_bytes;
-    int total_size;
     unsigned long total_len;
     XIPropertyValuePtr prop_value;
     XIPropertyValueRec new_value;
@@ -725,9 +724,8 @@ XIChangeDeviceProperty(DeviceIntPtr dev, Atom property, Atom type,
     if (mode == PropModeReplace || len > 0) {
         void *new_data = NULL, *old_data = NULL;
 
-        total_size = total_len * size_in_bytes;
-        new_value.data = (void *) malloc(total_size);
-        if (!new_value.data && total_size) {
+        new_value.data = xallocarray(total_len, size_in_bytes);
+        if (!new_value.data && total_len && size_in_bytes) {
             if (add)
                 XIDestroyDeviceProperty(prop);
             return BadAlloc;
diff --git a/xorg-server/Xi/xiquerypointer.c b/xorg-server/Xi/xiquerypointer.c
index 7ec0c851d..b9e295815 100644
--- a/xorg-server/Xi/xiquerypointer.c
+++ b/xorg-server/Xi/xiquerypointer.c
@@ -152,10 +152,10 @@ ProcXIQueryPointer(ClientPtr client)
         rep.buttons_len =
             bytes_to_int32(bits_to_bytes(pDev->button->numButtons));
         rep.length += rep.buttons_len;
-        buttons_size = rep.buttons_len * 4;
-        buttons = calloc(1, buttons_size);
+        buttons = calloc(rep.buttons_len, 4);
         if (!buttons)
             return BadAlloc;
+        buttons_size = rep.buttons_len * 4;
 
         for (i = 1; i < pDev->button->numButtons; i++)
             if (BitIsOn(pDev->button->down, i))