2 files changed, 4 insertions, 4 deletions
diff --git a/xorg-server/Xi/xipassivegrab.c b/xorg-server/Xi/xipassivegrab.c
index 3b98a79cd..487c2721b 100644
--- a/xorg-server/Xi/xipassivegrab.c
+++ b/xorg-server/Xi/xipassivegrab.c
@@ -191,7 +191,7 @@ ProcXIPassiveGrabDevice(ClientPtr client)
             info->status = status;
             info->modifiers = *modifiers;
             rep.num_modifiers++;
-            rep.length++;
+            rep.length += bytes_to_int32(sizeof(xXIGrabModifierInfo));
         }
     }
 
@@ -199,7 +199,7 @@ ProcXIPassiveGrabDevice(ClientPtr client)
     if (rep.num_modifiers)
     {
 	client->pSwapReplyFunc = (ReplySwapPtr) Swap32Write;
-        WriteSwappedDataToClient(client, rep.num_modifiers * 4, (char*)modifiers_failed);
+        WriteSwappedDataToClient(client, rep.length * 4, (char*)modifiers_failed);
     }
     free(modifiers_failed);
     return ret;
diff --git a/xorg-server/Xi/xiproperty.c b/xorg-server/Xi/xiproperty.c
index c1a25bbf7..b10891d1c 100644
--- a/xorg-server/Xi/xiproperty.c
+++ b/xorg-server/Xi/xiproperty.c
@@ -1051,11 +1051,11 @@ SProcXChangeDeviceProperty (ClientPtr client)
     char n;
     REQUEST(xChangeDevicePropertyReq);
 
+    REQUEST_AT_LEAST_SIZE(xChangeDevicePropertyReq);
     swaps(&stuff->length, n);
     swapl(&stuff->property, n);
     swapl(&stuff->type, n);
     swapl(&stuff->nUnits, n);
-    REQUEST_SIZE_MATCH(xChangeDevicePropertyReq);
     return (ProcXChangeDeviceProperty(client));
 }
 
@@ -1295,12 +1295,12 @@ SProcXIChangeProperty(ClientPtr client)
     char n;
     REQUEST(xXIChangePropertyReq);
 
+    REQUEST_AT_LEAST_SIZE(xXIChangePropertyReq);
     swaps(&stuff->length, n);
     swaps(&stuff->deviceid, n);
     swapl(&stuff->property, n);
     swapl(&stuff->type, n);
     swapl(&stuff->num_items, n);
-    REQUEST_SIZE_MATCH(xXIChangePropertyReq);
     return (ProcXIChangeProperty(client));
 }