1 files changed, 17 insertions, 8 deletions

diff --git a/xorg-server/hw/dmx/dmx_glxvisuals.c b/xorg-server/hw/dmx/dmx_glxvisuals.c
index f903b7491..56bd67b6e 100644
--- a/xorg-server/hw/dmx/dmx_glxvisuals.c
+++ b/xorg-server/hw/dmx/dmx_glxvisuals.c
@@ -37,6 +37,7 @@
 #include <GL/glxproto.h>
 #include <X11/extensions/Xext.h>
 #include <X11/extensions/extutil.h>
+#include <limits.h>
 
 #include "dmx_glxvisuals.h"
 
@@ -84,7 +85,10 @@ GetGLXVisualConfigs(Display * dpy, int screen, int *nconfigs)
         SyncHandle();
         return NULL;
     }
-    props = (INT32 *) Xmalloc(nprops * __GLX_SIZE_CARD32);
+    if (nprops < (INT_MAX / __GLX_SIZE_CARD32))
+        props = Xmalloc(nprops * __GLX_SIZE_CARD32);
+    else
+        props = NULL;
     if (!props) {
         UnlockDisplay(dpy);
         SyncHandle();
@@ -92,15 +96,16 @@ GetGLXVisualConfigs(Display * dpy, int screen, int *nconfigs)
     }
 
     /* Allocate memory for our config structure */
-    config = (__GLXvisualConfig *)
-        Xmalloc(nvisuals * sizeof(__GLXvisualConfig));
+    if (nvisuals < (INT_MAX / sizeof(__GLXvisualConfig)))
+        config = Xcalloc(nvisuals, sizeof(__GLXvisualConfig));
+    else
+        config = NULL;
     if (!config) {
         free(props);
         UnlockDisplay(dpy);
         SyncHandle();
         return NULL;
     }
-    memset(config, 0, nvisuals * sizeof(__GLXvisualConfig));
     configs = config;
     num_good_visuals = 0;
 
@@ -274,7 +279,10 @@ GetGLXFBConfigs(Display * dpy, int glxMajorOpcode, int *nconfigs)
         return NULL;
     }
 
-    attrs = (INT32 *) Xmalloc(2 * numAttribs * __GLX_SIZE_CARD32);
+    if (numAttribs < (INT_MAX / (2 * __GLX_SIZE_CARD32)))
+        attrs = Xmalloc(2 * numAttribs * __GLX_SIZE_CARD32);
+    else
+        attrs = NULL;
     if (!attrs) {
         UnlockDisplay(dpy);
         SyncHandle();
@@ -282,15 +290,16 @@ GetGLXFBConfigs(Display * dpy, int glxMajorOpcode, int *nconfigs)
     }
 
     /* Allocate memory for our config structure */
-    config = (__GLXFBConfig *)
-        Xmalloc(numFBConfigs * sizeof(__GLXFBConfig));
+    if (numFBConfigs < (INT_MAX / sizeof(__GLXFBConfig)))
+        config = Xcalloc(numFBConfigs, sizeof(__GLXFBConfig));
+    else
+        config = NULL;
     if (!config) {
         free(attrs);
         UnlockDisplay(dpy);
         SyncHandle();
         return NULL;
     }
-    memset(config, 0, numFBConfigs * sizeof(__GLXFBConfig));
     fbconfigs = config;
 
     /* Convert attribute list into our format */