commit 55bd6607b6a8665dec3816030950ca2df2f65eca
Author: Pierre Willenbrock <pierre@pirsoft.de>
Date:   Wed May 28 21:59:28 2008 +0200

    hack to fix write-after-end-of-allocation problem

diff --git a/dix/devices.c b/dix/devices.c
index b907521..c581be7 100644
--- a/dix/devices.c
+++ b/dix/devices.c
@@ -1005,6 +1005,10 @@ SetKeySymsMap(KeySymsPtr dst, KeySymsPtr src)
 {
     int i, j;
     int rowDif = src->minKeyCode - dst->minKeyCode;
+    ErrorF("SetKeySymsMap: dst before map=%p, mapWidth=%d, maxKeyCode=%d, minKeyCode=%d\n",
+      dst->map, dst->mapWidth, dst->maxKeyCode, dst->minKeyCode);
+    ErrorF("SetKeySymsMap: src before map=%p, mapWidth=%d, maxKeyCode=%d, minKeyCode=%d\n",
+      src ->map, src->mapWidth, src->maxKeyCode, src->minKeyCode);
 
     /* if keysym map size changes, grow map first */
     if (src->mapWidth < dst->mapWidth)
@@ -1051,6 +1055,10 @@ SetKeySymsMap(KeySymsPtr dst, KeySymsPtr src)
         dst->map = map;
         dst->mapWidth = src->mapWidth;
     }
+    ErrorF("SetKeySymsMap: dst->map=%p, dst->mapWidth=%d, dst->maxKeyCode=%d, dst->minKeyCode=%d\n",
+      dst->map, dst->mapWidth, dst->maxKeyCode, dst->minKeyCode);
+    ErrorF("SetKeySymsMap: src->map=%p, src->mapWidth=%d, src->maxKeyCode=%d, src->minKeyCode=%d\n",
+      src ->map, src->mapWidth, src->maxKeyCode, src->minKeyCode);
     memmove((char *)&dst->map[rowDif * dst->mapWidth],
 	    (char *)src->map,
 	  (int)(src->maxKeyCode - src->minKeyCode + 1) *
diff --git a/xkb/xkbUtils.c b/xkb/xkbUtils.c
index 0727ad8..e49655b 100644
--- a/xkb/xkbUtils.c
+++ b/xkb/xkbUtils.c
@@ -453,6 +453,7 @@ CARD8			keysPerMod[XkbNumModifiers];
     keyc->maxKeysPerModifier= maxKeysPerMod;
 
     if (maxSymsPerKey>0) {
+        maxSymsPerKey = 8;/*to be on the safe side...*/
 	tmp= maxSymsPerKey*_XkbCoreNumKeys(keyc);
 	keyc->curKeySyms.map= _XkbTypedRealloc(keyc->curKeySyms.map,tmp,KeySym);
 	if (keyc->curKeySyms.map==NULL)
@@ -463,7 +464,9 @@ CARD8			keysPerMod[XkbNumModifiers];
 	keyc->curKeySyms.map= NULL;
     }
     keyc->curKeySyms.mapWidth= maxSymsPerKey;
-
+    ErrorF("XkbUpdateCoreDescription: map=%p, mapWidth=%d, maxKeyCode=%d, minKeyCode=%d\n",
+          keyc->curKeySyms.map, keyc->curKeySyms.mapWidth, keyc->curKeySyms.maxKeyCode, keyc->curKeySyms.minKeyCode);
+           
     bzero(keysPerMod,sizeof(keysPerMod));
     for (key=firstCommon;key<=lastCommon;key++) {
 	if (keyc->curKeySyms.map!=NULL) {
