4 files changed, 16 insertions, 12 deletions
diff --git a/xorg-server/dix/devices.c b/xorg-server/dix/devices.c
index 45de713ce..1c86d5242 100644
--- a/xorg-server/dix/devices.c
+++ b/xorg-server/dix/devices.c
@@ -955,7 +955,7 @@ CloseDevice(DeviceIntPtr dev)
     while (dev->xkb_interest)
         XkbRemoveResourceClient((DevicePtr) dev, dev->xkb_interest->resource);
 
-    free((void *) dev->name);
+    free(dev->name);
 
     classes = (ClassesPtr) &dev->key;
     FreeAllDeviceClasses(classes);
@@ -1279,6 +1279,7 @@ InitButtonClassDeviceStruct(DeviceIntPtr dev, int numButtons, Atom *labels,
 
     BUG_RETURN_VAL(dev == NULL, FALSE);
     BUG_RETURN_VAL(dev->button != NULL, FALSE);
+    BUG_RETURN_VAL(numButtons >= MAX_BUTTONS, FALSE);
 
     butc = calloc(1, sizeof(ButtonClassRec));
     if (!butc)
diff --git a/xorg-server/dix/dispatch.c b/xorg-server/dix/dispatch.c
index 9a5658db0..4f830f7f4 100644
--- a/xorg-server/dix/dispatch.c
+++ b/xorg-server/dix/dispatch.c
@@ -478,9 +478,9 @@ SetVendorRelease(int release)
 }
 
 void
-SetVendorString(const char *string)
+SetVendorString(const char *vendor)
 {
-    VendorString = string;
+    VendorString = vendor;
 }
 
 Bool
diff --git a/xorg-server/dix/getevents.c b/xorg-server/dix/getevents.c
index 646c723ea..ffa89fad2 100644
--- a/xorg-server/dix/getevents.c
+++ b/xorg-server/dix/getevents.c
@@ -1655,6 +1655,8 @@ GetPointerEvents(InternalEvent *events, DeviceIntPtr pDev, int type,
     }
 #endif
 
+    BUG_RETURN_VAL(buttons >= MAX_BUTTONS, 0);
+
     /* refuse events from disabled devices */
     if (!pDev->enabled)
         return 0;
diff --git a/xorg-server/dix/inpututils.c b/xorg-server/dix/inpututils.c
index 3e1d75fec..e5bcc31f7 100644
--- a/xorg-server/dix/inpututils.c
+++ b/xorg-server/dix/inpututils.c
@@ -60,7 +60,8 @@ check_butmap_change(DeviceIntPtr dev, CARD8 *map, int len, CARD32 *errval_out,
     }
 
     for (i = 0; i < len; i++) {
-        if (dev->button->map[i + 1] != map[i] && dev->button->down[i + 1])
+        if (dev->button->map[i + 1] != map[i] &&
+            button_is_down(dev, i + 1, BUTTON_PROCESSED))
             return MappingBusy;
     }
 
@@ -351,7 +352,7 @@ DuplicateInputAttributes(InputAttributes * attrs)
 {
     InputAttributes *new_attr;
     int ntags = 0;
-    const char **tags, **new_tags;
+    char **tags, **new_tags;
 
     if (!attrs)
         return NULL;
@@ -403,20 +404,20 @@ DuplicateInputAttributes(InputAttributes * attrs)
 void
 FreeInputAttributes(InputAttributes * attrs)
 {
-    const char **tags;
+    char **tags;
 
     if (!attrs)
         return;
 
-    free((void *) attrs->product);
-    free((void *) attrs->vendor);
-    free((void *) attrs->device);
-    free((void *) attrs->pnp_id);
-    free((void *) attrs->usb_id);
+    free(attrs->product);
+    free(attrs->vendor);
+    free(attrs->device);
+    free(attrs->pnp_id);
+    free(attrs->usb_id);
 
     if ((tags = attrs->tags))
         while (*tags)
-            free((void *) *tags++);
+            free(*tags++);
 
     free(attrs->tags);
     free(attrs);