2 files changed, 16 insertions, 21 deletions

diff --git a/xorg-server/hw/xquartz/xpr/appledri.c b/xorg-server/hw/xquartz/xpr/appledri.c
index 9aac07240..77574655b 100644
--- a/xorg-server/hw/xquartz/xpr/appledri.c
+++ b/xorg-server/hw/xquartz/xpr/appledri.c
@@ -123,6 +123,10 @@ ProcAppleDRIQueryDirectRenderingCapable(register ClientPtr client)
     rep.length = 0;
     rep.sequenceNumber = client->sequence;
 
+    if (stuff->screen >= screenInfo.numScreens) {
+        return BadValue;
+    }
+
     if (!DRIQueryDirectRenderingCapable(screenInfo.screens[stuff->screen],
                                         &isCapable)) {
         return BadValue;
@@ -402,6 +406,7 @@ SProcAppleDRIQueryDirectRenderingCapable(register ClientPtr client)
 {
     REQUEST(xAppleDRIQueryDirectRenderingCapableReq);
     swaps(&stuff->length);
+    REQUEST_SIZE_MATCH(xAppleDRIQueryDirectRenderingCapableReq);
     swapl(&stuff->screen);
     return ProcAppleDRIQueryDirectRenderingCapable(client);
 }
@@ -411,6 +416,7 @@ SProcAppleDRIAuthConnection(register ClientPtr client)
 {
     REQUEST(xAppleDRIAuthConnectionReq);
     swaps(&stuff->length);
+    REQUEST_SIZE_MATCH(xAppleDRIAuthConnectionReq);
     swapl(&stuff->screen);
     swapl(&stuff->magic);
     return ProcAppleDRIAuthConnection(client);
@@ -421,6 +427,7 @@ SProcAppleDRICreateSurface(register ClientPtr client)
 {
     REQUEST(xAppleDRICreateSurfaceReq);
     swaps(&stuff->length);
+    REQUEST_SIZE_MATCH(xAppleDRICreateSurfaceReq);
     swapl(&stuff->screen);
     swapl(&stuff->drawable);
     swapl(&stuff->client_id);
@@ -432,6 +439,7 @@ SProcAppleDRIDestroySurface(register ClientPtr client)
 {
     REQUEST(xAppleDRIDestroySurfaceReq);
     swaps(&stuff->length);
+    REQUEST_SIZE_MATCH(xAppleDRIDestroySurfaceReq);
     swapl(&stuff->screen);
     swapl(&stuff->drawable);
     return ProcAppleDRIDestroySurface(client);
@@ -442,6 +450,7 @@ SProcAppleDRICreatePixmap(register ClientPtr client)
 {
     REQUEST(xAppleDRICreatePixmapReq);
     swaps(&stuff->length);
+    REQUEST_SIZE_MATCH(xAppleDRICreatePixmapReq);
     swapl(&stuff->screen);
     swapl(&stuff->drawable);
     return ProcAppleDRICreatePixmap(client);
@@ -452,6 +461,7 @@ SProcAppleDRIDestroyPixmap(register ClientPtr client)
 {
     REQUEST(xAppleDRIDestroyPixmapReq);
     swaps(&stuff->length);
+    REQUEST_SIZE_MATCH(xAppleDRIDestroyPixmapReq);
     swapl(&stuff->drawable);
     return ProcAppleDRIDestroyPixmap(client);
 }
diff --git a/xorg-server/hw/xquartz/xpr/x-hook.c b/xorg-server/hw/xquartz/xpr/x-hook.c
index b5d8ab90e..3922bb86c 100644
--- a/xorg-server/hw/xquartz/xpr/x-hook.c
+++ b/xorg-server/hw/xquartz/xpr/x-hook.c
@@ -70,34 +70,19 @@ X_PFX(hook_remove) (x_list * lst, x_hook_function * fun, void *data) {
 
 X_EXTERN void
 X_PFX(hook_run) (x_list * lst, void *arg) {
-    x_list *node, *cell;
-    x_hook_function **fun;
-    void **data;
-    int length, i;
+    x_list *node;
 
     if (!lst)
         return;
 
-    length = X_PFX(list_length) (lst);
-    fun = malloc(sizeof(x_hook_function *) * length);
-    data = malloc(sizeof(void *) * length);
-
-    if (!fun || !data) {
-        FatalError("Failed to allocate memory in %s\n", __func__);
-    }
+    for (node = lst; node != NULL; node = node->next) {
+        x_list *cell = node->data;
 
-    for (i = 0, node = lst; node != NULL; node = node->next, i++) {
-        cell = node->data;
-        fun[i] = CELL_FUN(cell);
-        data[i] = CELL_DATA(cell);
-    }
+        x_hook_function *fun = CELL_FUN(cell);
+        void *data = CELL_DATA(cell);
 
-    for (i = 0; i < length; i++) {
-        (*fun[i])(arg, data[i]);
+        (*fun)(arg, data);
     }
-
-    free(fun);
-    free(data);
 }
 
 X_EXTERN void