2 files changed, 48 insertions, 23 deletions

diff --git a/xorg-server/Xi/exevents.c b/xorg-server/Xi/exevents.c
index 8172f611d..35f929731 100644
--- a/xorg-server/Xi/exevents.c
+++ b/xorg-server/Xi/exevents.c
@@ -1632,6 +1632,19 @@ SelectForWindow(DeviceIntPtr dev, WindowPtr pWin, ClientPtr client,
     return Success;
 }
 
+static void
+FreeInputClient(InputClientsPtr *other)
+{
+    free(*other);
+    *other = NULL;
+}
+
+static InputClientsPtr
+AllocInputClient(void)
+{
+    return calloc(1, sizeof(InputClients));
+}
+
 int
 AddExtensionClient(WindowPtr pWin, ClientPtr client, Mask mask, int mskidx)
 {
@@ -1639,7 +1652,7 @@ AddExtensionClient(WindowPtr pWin, ClientPtr client, Mask mask, int mskidx)
 
     if (!pWin->optional && !MakeWindowOptional(pWin))
 	return BadAlloc;
-    others = calloc(1, sizeof(InputClients));
+    others = AllocInputClient();
     if (!others)
 	return BadAlloc;
     if (!pWin->optional->inputMasks && !MakeInputMasks(pWin))
@@ -1653,7 +1666,7 @@ AddExtensionClient(WindowPtr pWin, ClientPtr client, Mask mask, int mskidx)
     return Success;
 
 bail:
-    free(others);
+    FreeInputClient(&others);
     return BadAlloc;
 }
 
@@ -1669,6 +1682,13 @@ MakeInputMasks(WindowPtr pWin)
     return TRUE;
 }
 
+static void
+FreeInputMask(OtherInputMasks **imask)
+{
+    free(*imask);
+    *imask = NULL;
+}
+
 void
 RecalculateDeviceDeliverableEvents(WindowPtr pWin)
 {
@@ -1729,14 +1749,15 @@ InputClientGone(WindowPtr pWin, XID id)
 	if (other->resource == id) {
 	    if (prev) {
 		prev->next = other->next;
-		free(other);
+		FreeInputClient(&other);
 	    } else if (!(other->next)) {
 		if (ShouldFreeInputMasks(pWin, TRUE)) {
-		    wOtherInputMasks(pWin)->inputClients = other->next;
-		    free(wOtherInputMasks(pWin));
+		    OtherInputMasks *mask = wOtherInputMasks(pWin);
+		    mask->inputClients = other->next;
+		    FreeInputMask(&mask);
 		    pWin->optional->inputMasks = (OtherInputMasks *) NULL;
 		    CheckWindowOptionalNeed(pWin);
-		    free(other);
+		    FreeInputClient(&other);
 		} else {
 		    other->resource = FakeClientID(0);
 		    if (!AddResource(other->resource, RT_INPUTCLIENT,
@@ -1745,7 +1766,7 @@ InputClientGone(WindowPtr pWin, XID id)
 		}
 	    } else {
 		wOtherInputMasks(pWin)->inputClients = other->next;
-		free(other);
+		FreeInputClient(&other);
 	    }
 	    RecalculateDeviceDeliverableEvents(pWin);
 	    return Success;
diff --git a/xorg-server/Xi/xipassivegrab.c b/xorg-server/Xi/xipassivegrab.c
index 6be27f3d1..2f13a95e8 100644
--- a/xorg-server/Xi/xipassivegrab.c
+++ b/xorg-server/Xi/xipassivegrab.c
@@ -80,7 +80,6 @@ ProcXIPassiveGrabDevice(ClientPtr client)
     DeviceIntPtr dev, mod_dev;
     xXIPassiveGrabDeviceReply rep;
     int i, ret = Success;
-    uint8_t status;
     uint32_t *modifiers;
     xXIGrabModifierInfo *modifiers_failed;
     GrabMask mask;
@@ -145,32 +144,36 @@ ProcXIPassiveGrabDevice(ClientPtr client)
 
     if (stuff->cursor != None)
     {
-        status = dixLookupResourceByType(&tmp, stuff->cursor,
-                                         RT_CURSOR, client, DixUseAccess);
-	if (status != Success)
-	{
-	    client->errorValue = stuff->cursor;
-	    return status;
-	}
+        ret = dixLookupResourceByType(&tmp, stuff->cursor,
+                                      RT_CURSOR, client, DixUseAccess);
+        if (ret != Success)
+        {
+            client->errorValue = stuff->cursor;
+            goto out;
+        }
     }
 
-    status = dixLookupWindow((WindowPtr*)&tmp, stuff->grab_window, client, DixSetAttrAccess);
-    if (status != Success)
-	return status;
+    ret = dixLookupWindow((WindowPtr*)&tmp, stuff->grab_window, client, DixSetAttrAccess);
+    if (ret != Success)
+        goto out;
 
-    status = CheckGrabValues(client, &param);
-    if (status != Success)
-        return status;
+    ret = CheckGrabValues(client, &param);
+    if (ret != Success)
+        goto out;
 
     modifiers = (uint32_t*)&stuff[1] + stuff->mask_len;
     modifiers_failed = calloc(stuff->num_modifiers, sizeof(xXIGrabModifierInfo));
-    if (!modifiers_failed)
-        return BadAlloc;
+    if (!modifiers_failed) {
+        ret = BadAlloc;
+        goto out;
+    }
 
     mod_dev = (IsFloating(dev)) ? dev : GetMaster(dev, MASTER_KEYBOARD);
 
     for (i = 0; i < stuff->num_modifiers; i++, modifiers++)
     {
+        uint8_t status = Success;
+
         param.modifiers = *modifiers;
         switch(stuff->grab_type)
         {
@@ -208,6 +211,7 @@ ProcXIPassiveGrabDevice(ClientPtr client)
         WriteToClient(client, rep.length * 4, (char*)modifiers_failed);
 
     free(modifiers_failed);
+out:
     return ret;
 }