xserver: Branch 'master' - 20 commits

Keith Packard keithp at kemper.freedesktop.org
Mon May 11 15:33:14 PDT 2015


 Xext/hashtable.c                             |    4 
 Xext/panoramiX.c                             |   10 
 Xext/panoramiXprocs.c                        |   21 
 Xext/saver.c                                 |    2 
 Xext/shape.c                                 |    2 
 Xext/sync.c                                  |    4 
 Xext/xcmisc.c                                |    2 
 Xext/xf86bigfont.c                           |    4 
 Xext/xres.c                                  |    2 
 Xext/xselinux_label.c                        |    2 
 Xext/xvmain.c                                |    2 
 Xi/exevents.c                                |    6 
 Xi/getprop.c                                 |    2 
 Xi/xiproperty.c                              |    8 
 Xi/xiquerypointer.c                          |    4 
 composite/compinit.c                         |    8 
 config/config.c                              |    3 
 configure.ac                                 |    9 
 dbe/dbe.c                                    |   14 
 dbe/midbe.c                                  |    2 
 dix/atom.c                                   |    4 
 dix/colormap.c                               |   71 +-
 dix/devices.c                                |    4 
 dix/dispatch.c                               |   10 
 dix/dixfonts.c                               |   18 
 dix/enterleave.c                             |    2 
 dix/events.c                                 |    4 
 dix/extension.c                              |    6 
 dix/glyphcurs.c                              |    4 
 dix/grabs.c                                  |    8 
 dix/property.c                               |   10 
 dix/region.c                                 |    2 
 dix/resource.c                               |    6 
 dix/touch.c                                  |    8 
 doc/Xserver-spec.xml                         |    9 
 exa/exa_accel.c                              |    8 
 exa/exa_glyphs.c                             |    4 
 exa/exa_migration_mixed.c                    |    4 
 fb/fbcopy.c                                  |    2 
 fb/fbpict.c                                  |    2 
 glamor/glamor_compositerects.c               |    2 
 glamor/glamor_glyphs.c                       |    2 
 glamor/glamor_gradient.c                     |    8 
 glamor/glamor_pixmap.c                       |    4 
 glamor/glamor_prepare.c                      |    4 
 glamor/glamor_utils.c                        |    2 
 glx/single2.c                                |    9 
 glx/single2swap.c                            |    9 
 hw/dmx/config/dmxconfig.c                    |   10 
 hw/dmx/dmx.c                                 |   10 
 hw/dmx/dmxcmap.c                             |    2 
 hw/dmx/dmxcursor.c                           |    2 
 hw/dmx/dmxextension.c                        |    4 
 hw/dmx/dmxfont.c                             |    6 
 hw/dmx/dmxgc.c                               |    2 
 hw/dmx/dmxinit.c                             |    4 
 hw/dmx/dmxpict.c                             |   10 
 hw/dmx/dmxprop.c                             |    2 
 hw/dmx/dmxwindow.c                           |    4 
 hw/dmx/glxProxy/glxcmds.c                    |   34 -
 hw/dmx/glxProxy/glxscreens.c                 |    9 
 hw/dmx/input/dmxarg.c                        |    2 
 hw/dmx/input/dmxinputinit.c                  |    4 
 hw/dmx/input/dmxmotion.c                     |    5 
 hw/kdrive/ephyr/ephyrdriext.c                |    4 
 hw/kdrive/ephyr/hostx.c                      |   14 
 hw/kdrive/fake/fake.c                        |    2 
 hw/kdrive/fbdev/fbdev.c                      |    2 
 hw/kdrive/src/kshadow.c                      |    2 
 hw/kdrive/src/kxv.c                          |    4 
 hw/vfb/InitOutput.c                          |    8 
 hw/xfree86/common/xf86AutoConfig.c           |    2 
 hw/xfree86/common/xf86Bus.c                  |   23 
 hw/xfree86/common/xf86Config.c               |   22 
 hw/xfree86/common/xf86Configure.c            |    6 
 hw/xfree86/common/xf86DGA.c                  |    2 
 hw/xfree86/common/xf86Helper.c               |   32 -
 hw/xfree86/common/xf86Xinput.c               |    5 
 hw/xfree86/common/xf86cmap.c                 |    6 
 hw/xfree86/common/xf86fbman.c                |   11 
 hw/xfree86/common/xf86pciBus.c               |   10 
 hw/xfree86/common/xf86platformBus.c          |    6 
 hw/xfree86/common/xf86sbusBus.c              |   10 
 hw/xfree86/common/xf86vmode.c                |    8 
 hw/xfree86/common/xf86xv.c                   |   10 
 hw/xfree86/common/xf86xvmc.c                 |    2 
 hw/xfree86/ddc/ddc.c                         |    2 
 hw/xfree86/dri/xf86dri.c                     |    2 
 hw/xfree86/dri2/dri2.c                       |    4 
 hw/xfree86/drivers/modesetting/driver.c      |    2 
 hw/xfree86/i2c/xf86i2c.c                     |    2 
 hw/xfree86/loader/loadmod.c                  |   10 
 hw/xfree86/modes/xf86Crtc.c                  |   21 
 hw/xfree86/modes/xf86DiDGA.c                 |    2 
 hw/xfree86/modes/xf86RandR12.c               |   20 
 hw/xfree86/os-support/bus/Sbus.c             |    2 
 hw/xfree86/os-support/solaris/Makefile.am    |    3 
 hw/xfree86/os-support/solaris/apSolaris.shar |  806 ---------------------------
 hw/xfree86/utils/cvt/cvt.c                   |    4 
 hw/xfree86/vbe/vbe.c                         |    4 
 hw/xnest/Color.c                             |   17 
 hw/xnest/Display.c                           |    4 
 hw/xnest/GC.c                                |    5 
 hw/xnest/Keyboard.c                          |    2 
 hw/xnest/Screen.c                            |    4 
 include/dix-config.h.in                      |    3 
 include/os.h                                 |   31 -
 include/xorg-server.h.in                     |    3 
 mi/miarc.c                                   |   25 
 mi/mibitblt.c                                |   16 
 mi/micmap.c                                  |    8 
 mi/micopy.c                                  |    4 
 mi/miexpose.c                                |    2 
 mi/mifillrct.c                               |    4 
 mi/miglblt.c                                 |    2 
 mi/miinitext.c                               |    4 
 mi/mipoly.c                                  |    4 
 mi/mipolypnt.c                               |    2 
 mi/mipolyrect.c                              |    2 
 mi/miwideline.c                              |   42 -
 mi/miwindow.c                                |    6 
 mi/mizerarc.c                                |    4 
 mi/mizerline.c                               |    4 
 miext/damage/damage.c                        |    2 
 miext/rootless/rootlessWindow.c              |    4 
 miext/shadow/shalloc.c                       |    2 
 os/connection.c                              |   13 
 os/reallocarray.c                            |   43 +
 os/utils.c                                   |   24 
 pseudoramiX/pseudoramiX.c                    |    6 
 randr/rrcrtc.c                               |   14 
 randr/rrinfo.c                               |   10 
 randr/rrmode.c                               |    4 
 randr/rrmonitor.c                            |    5 
 randr/rroutput.c                             |   14 
 randr/rrproperty.c                           |   12 
 randr/rrproviderproperty.c                   |    6 
 randr/rrtransform.c                          |    2 
 record/record.c                              |   35 -
 record/set.c                                 |    4 
 render/filter.c                              |   12 
 render/miindex.c                             |    2 
 render/mipict.c                              |    4 
 render/picture.c                             |    2 
 render/render.c                              |    6 
 xfixes/region.c                              |    2 
 xkb/XKBAlloc.c                               |   14 
 xkb/XKBGAlloc.c                              |    2 
 xkb/XKBMAlloc.c                              |   47 -
 xkb/maprules.c                               |   12 
 xkb/xkb.c                                    |   32 -
 xkb/xkbActions.c                             |    4 
 xkb/xkbUtils.c                               |   76 +-
 xkb/xkmread.c                                |    2 
 154 files changed, 694 insertions(+), 1443 deletions(-)

New commits:
commit 28ff661e73f4bdf0a9b7c84e70fa0a08fd30e482
Author: Alan Coopersmith <alan.coopersmith at oracle.com>
Date:   Fri Apr 3 19:06:21 2015 -0700

    Remove empty stub of $host_cpu case statement in configure.ac
    
    Left behind when commit 5c12399b6c3a8d moved the xorg_bus_* settings
    elsewhere.
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Reviewed-by: Thomas Klausner <wiz at NetBSD.org>

diff --git a/configure.ac b/configure.ac
index 3028e12..fc15460 100644
--- a/configure.ac
+++ b/configure.ac
@@ -2006,11 +2006,6 @@ if test "x$XORG" = xyes; then
 		;;
 	esac
 
-	case $host_cpu in
-	  i*86)
-		;;
-	esac
-
 	if test "x$DGA" = xauto; then
 		PKG_CHECK_MODULES(DGA, $DGAPROTO, [DGA=yes], [DGA=no])
 	fi
commit d4e85afac6578d5babc8bf97e00e85b00746fca9
Author: Alan Coopersmith <alan.coopersmith at oracle.com>
Date:   Fri Apr 3 19:01:40 2015 -0700

    Accept x86_64 as well as i*86 for $host_cpu in Solaris on x86
    
    Needed when using a compiler that defaults to 64-bit output when
    configure is checking for $host_cpu.
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Reviewed-by: Thomas Klausner <wiz at NetBSD.org>

diff --git a/configure.ac b/configure.ac
index a5bdbbf..3028e12 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1976,7 +1976,7 @@ if test "x$XORG" = xyes; then
 		  sparc*)	
 			SOLARIS_INOUT_ARCH="sparcv8plus"
 			;;
-		  i*86)	
+		  i*86|x86_64*)
 			if test x$SOLARIS_64 = xyes ; then
 				SOLARIS_INOUT_ARCH="amd64"
 			else
commit 0018784cdde19444a8f970bc414796fc2a523a51
Author: Alan Coopersmith <alan.coopersmith at oracle.com>
Date:   Sat Mar 21 17:59:13 2015 -0700

    Convert hw/dmx to new *allocarray functions
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Reviewed-by: Matt Turner <mattst88 at gmail.com>

diff --git a/hw/dmx/config/dmxconfig.c b/hw/dmx/config/dmxconfig.c
index 2cc9ab3..1d10ec0 100644
--- a/hw/dmx/config/dmxconfig.c
+++ b/hw/dmx/config/dmxconfig.c
@@ -204,8 +204,8 @@ dmxConfigAddDisplay(const char *name,
 {
     DMXScreenInfo *dmxScreen;
 
-    if (!(dmxScreens = realloc(dmxScreens,
-                               (dmxNumScreens + 1) * sizeof(*dmxScreens))))
+    if (!(dmxScreens = reallocarray(dmxScreens, dmxNumScreens + 1,
+                                    sizeof(*dmxScreens))))
         dmxLog(dmxFatal,
                "dmxConfigAddDisplay: realloc failed for screen %d (%s)\n",
                dmxNumScreens, name);
@@ -234,8 +234,8 @@ dmxConfigAddInput(const char *name, int core)
 {
     DMXInputInfo *dmxInput;
 
-    if (!(dmxInputs = realloc(dmxInputs,
-                              (dmxNumInputs + 1) * sizeof(*dmxInputs))))
+    if (!(dmxInputs = reallocarray(dmxInputs, dmxNumInputs + 1,
+                                   sizeof(*dmxInputs))))
         dmxLog(dmxFatal,
                "dmxConfigAddInput: realloc failed for input %d (%s)\n",
                dmxNumInputs, name);
@@ -341,7 +341,7 @@ dmxConfigCopyFromOption(DMXConfigOptionPtr o)
     for (pt = o->option; pt; pt = pt->next) {
         if (pt->string) {
             ++argc;
-            argv = realloc(argv, (argc + 1) * sizeof(*argv));
+            argv = reallocarray(argv, argc + 1, sizeof(*argv));
             argv[argc] = (char *) pt->string;
         }
     }
diff --git a/hw/dmx/dmx.c b/hw/dmx/dmx.c
index 2988df3..9729963 100644
--- a/hw/dmx/dmx.c
+++ b/hw/dmx/dmx.c
@@ -427,7 +427,7 @@ ProcDMXChangeScreensAttributes(ClientPtr client)
     if (!_DMXXineramaActive())
         goto noxinerama;
 
-    if (!(attribs = malloc(stuff->screenCount * sizeof(*attribs))))
+    if (!(attribs = xallocarray(stuff->screenCount, sizeof(*attribs))))
         return BadAlloc;
 
     for (i = 0; i < stuff->screenCount; i++) {
@@ -624,18 +624,18 @@ ProcDMXGetWindowAttributes(ClientPtr client)
 
     REQUEST_SIZE_MATCH(xDMXGetWindowAttributesReq);
 
-    if (!(screens = malloc(count * sizeof(*screens))))
+    if (!(screens = xallocarray(count, sizeof(*screens))))
         return BadAlloc;
-    if (!(windows = malloc(count * sizeof(*windows)))) {
+    if (!(windows = xallocarray(count, sizeof(*windows)))) {
         free(screens);
         return BadAlloc;
     }
-    if (!(pos = malloc(count * sizeof(*pos)))) {
+    if (!(pos = xallocarray(count, sizeof(*pos)))) {
         free(windows);
         free(screens);
         return BadAlloc;
     }
-    if (!(vis = malloc(count * sizeof(*vis)))) {
+    if (!(vis = xallocarray(count, sizeof(*vis)))) {
         free(pos);
         free(windows);
         free(screens);
diff --git a/hw/dmx/dmxcmap.c b/hw/dmx/dmxcmap.c
index 450627b..7a87a98 100644
--- a/hw/dmx/dmxcmap.c
+++ b/hw/dmx/dmxcmap.c
@@ -177,7 +177,7 @@ dmxStoreColors(ColormapPtr pColormap, int ndef, xColorItem * pdef)
     dmxColormapPrivPtr pCmapPriv = DMX_GET_COLORMAP_PRIV(pColormap);
 
     if (dmxScreen->beDisplay && (pColormap->pVisual->class & DynamicClass)) {
-        XColor *color = malloc(sizeof(*color) * ndef);
+        XColor *color = xallocarray(ndef, sizeof(*color));
         int i;
 
         if (color) {
diff --git a/hw/dmx/dmxcursor.c b/hw/dmx/dmxcursor.c
index 70f2bc4..0ef800e 100644
--- a/hw/dmx/dmxcursor.c
+++ b/hw/dmx/dmxcursor.c
@@ -203,7 +203,7 @@ miPointerScreenFuncRec dmxPointerCursorFuncs = {
 static int *
 dmxSLCreate(void)
 {
-    int *list = malloc(dmxNumScreens * sizeof(*list));
+    int *list = xallocarray(dmxNumScreens, sizeof(*list));
     int i;
 
     for (i = 0; i < dmxNumScreens; i++)
diff --git a/hw/dmx/dmxextension.c b/hw/dmx/dmxextension.c
index fcc97e3..75d7166 100644
--- a/hw/dmx/dmxextension.c
+++ b/hw/dmx/dmxextension.c
@@ -1188,8 +1188,8 @@ dmxBERestoreRenderGlyph(void *value, XID id, void *n)
 
     /* Now allocate the memory we need */
     images = calloc(len_images, sizeof(char));
-    gids = malloc(glyphSet->hash.tableEntries * sizeof(Glyph));
-    glyphs = malloc(glyphSet->hash.tableEntries * sizeof(XGlyphInfo));
+    gids = xallocarray(glyphSet->hash.tableEntries, sizeof(Glyph));
+    glyphs = xallocarray(glyphSet->hash.tableEntries, sizeof(XGlyphInfo));
 
     pos = images;
     ctr = 0;
diff --git a/hw/dmx/dmxfont.c b/hw/dmx/dmxfont.c
index 115422d..25a04a6 100644
--- a/hw/dmx/dmxfont.c
+++ b/hw/dmx/dmxfont.c
@@ -72,7 +72,7 @@ dmxGetFontPath(int *npaths)
 
     newfp = malloc(*npaths + len);
     c = (unsigned char *) newfp;
-    fp = malloc(*npaths * sizeof(*fp));
+    fp = xallocarray(*npaths, sizeof(*fp));
 
     memmove(newfp, paths + 1, *npaths + len - 1);
     l = *paths;
@@ -306,7 +306,7 @@ dmxBELoadFont(ScreenPtr pScreen, FontPtr pFont)
         if (!dmxFontPath)
             dmxLog(dmxWarning, "No default font path is set.\n");
 
-        goodfps = malloc(npaths * sizeof(*goodfps));
+        goodfps = xallocarray(npaths, sizeof(*goodfps));
 
         dmxLog(dmxError,
                "The DMX server failed to set the following font paths on "
@@ -354,7 +354,7 @@ dmxBELoadFont(ScreenPtr pScreen, FontPtr pFont)
                 return FALSE;
             }
 
-            newfp = malloc(len * sizeof(*newfp));
+            newfp = xallocarray(len, sizeof(*newfp));
             for (i = 0; i < npaths; i++) {
                 if (goodfps[i]) {
                     int n = strlen(fp[i]);
diff --git a/hw/dmx/dmxgc.c b/hw/dmx/dmxgc.c
index ec15d27..c4789a6 100644
--- a/hw/dmx/dmxgc.c
+++ b/hw/dmx/dmxgc.c
@@ -397,7 +397,7 @@ dmxChangeClip(GCPtr pGC, int type, void *pvalue, int nrects)
     } else {
         if (dmxScreen->beDisplay) {
             nRects = RegionNumRects((RegionPtr) pGC->clientClip);
-            pRects = malloc(nRects * sizeof(*pRects));
+            pRects = xallocarray(nRects, sizeof(*pRects));
             pBox = RegionRects((RegionPtr) pGC->clientClip);
 
             for (i = 0; i < nRects; i++) {
diff --git a/hw/dmx/dmxinit.c b/hw/dmx/dmxinit.c
index 025dc86..3d394c5 100644
--- a/hw/dmx/dmxinit.c
+++ b/hw/dmx/dmxinit.c
@@ -438,7 +438,7 @@ dmxGetColormaps(DMXScreenInfo * dmxScreen)
     int i;
 
     dmxScreen->beNumDefColormaps = dmxScreen->beNumVisuals;
-    dmxScreen->beDefColormaps = malloc(dmxScreen->beNumDefColormaps *
+    dmxScreen->beDefColormaps = xallocarray(dmxScreen->beNumDefColormaps,
                                        sizeof(*dmxScreen->beDefColormaps));
 
     for (i = 0; i < dmxScreen->beNumDefColormaps; i++)
@@ -793,7 +793,7 @@ InitOutput(ScreenInfo * pScreenInfo, int argc, char *argv[])
                 nconfigs = dmxScreen->numGlxVisuals;
             }
 
-            configprivs = malloc(nconfigs * sizeof(dmxGlxVisualPrivate *));
+            configprivs = xallocarray(nconfigs, sizeof(dmxGlxVisualPrivate *));
 
             if (configs != NULL && configprivs != NULL) {
                 int j;
diff --git a/hw/dmx/dmxpict.c b/hw/dmx/dmxpict.c
index aaca178..1f1022e 100644
--- a/hw/dmx/dmxpict.c
+++ b/hw/dmx/dmxpict.c
@@ -390,7 +390,7 @@ dmxProcRenderAddGlyphs(ClientPtr client)
                   sizeof(xRenderAddGlyphsReq) -
                   (sizeof(CARD32) + sizeof(xGlyphInfo)) * nglyphs);
 
-        gidsCopy = malloc(sizeof(*gidsCopy) * nglyphs);
+        gidsCopy = xallocarray(nglyphs, sizeof(*gidsCopy));
         for (i = 0; i < nglyphs; i++)
             gidsCopy[i] = gids[i];
 
@@ -434,7 +434,7 @@ dmxProcRenderFreeGlyphs(ClientPtr client)
 
         nglyphs = ((client->req_len << 2) - sizeof(xRenderFreeGlyphsReq)) >> 2;
         if (nglyphs) {
-            gids = malloc(sizeof(*gids) * nglyphs);
+            gids = xallocarray(nglyphs, sizeof(*gids));
             for (i = 0; i < nglyphs; i++)
                 gids[i] = ((CARD32 *) (stuff + 1))[i];
 
@@ -569,11 +569,11 @@ dmxProcRenderCompositeGlyphs(ClientPtr client)
         /* The following only works for Render version > 0.2 */
 
         /* All of the XGlyphElt* structure sizes are identical */
-        elts = malloc(nelt * sizeof(XGlyphElt8));
+        elts = xallocarray(nelt, sizeof(XGlyphElt8));
         if (!elts)
             return BadAlloc;
 
-        glyphs = malloc(nglyph * size);
+        glyphs = xallocarray(nglyph, size);
         if (!glyphs) {
             free(elts);
             return BadAlloc;
@@ -925,7 +925,7 @@ dmxChangePictureClip(PicturePtr pPicture, int clipType, void *value, int n)
             int nRects;
 
             nRects = nBox;
-            pRects = pRect = malloc(nRects * sizeof(*pRect));
+            pRects = pRect = xallocarray(nRects, sizeof(*pRect));
 
             while (nBox--) {
                 pRect->x = pBox->x1;
diff --git a/hw/dmx/dmxprop.c b/hw/dmx/dmxprop.c
index 5e306d2..4c85268 100644
--- a/hw/dmx/dmxprop.c
+++ b/hw/dmx/dmxprop.c
@@ -171,7 +171,7 @@ dmxPropertyCheckOtherServers(DMXScreenInfo * dmxScreen, Atom atom)
                     dmxLogOutputWarning(dmxScreen,
                                         "%s also running on %s\n",
                                         tp.value, dmxScreen->name);
-                    list = realloc(list, ++count * sizeof(*list));
+                    list = reallocarray(list, ++count, sizeof(*list));
                     list[count - 1] = malloc(tp.nitems + 2);
                     strncpy(list[count - 1], (char *) tp.value, tp.nitems + 1);
                 }
diff --git a/hw/dmx/dmxwindow.c b/hw/dmx/dmxwindow.c
index c157e10..dcdb9ac 100644
--- a/hw/dmx/dmxwindow.c
+++ b/hw/dmx/dmxwindow.c
@@ -969,7 +969,7 @@ dmxDoSetShape(WindowPtr pWindow)
     if (wBoundingShape(pWindow)) {
         pBox = RegionRects(wBoundingShape(pWindow));
         nRect = nBox = RegionNumRects(wBoundingShape(pWindow));
-        pRectFirst = pRect = malloc(nRect * sizeof(*pRect));
+        pRectFirst = pRect = xallocarray(nRect, sizeof(*pRect));
         while (nBox--) {
             pRect->x = pBox->x1;
             pRect->y = pBox->y1;
@@ -992,7 +992,7 @@ dmxDoSetShape(WindowPtr pWindow)
     if (wClipShape(pWindow)) {
         pBox = RegionRects(wClipShape(pWindow));
         nRect = nBox = RegionNumRects(wClipShape(pWindow));
-        pRectFirst = pRect = malloc(nRect * sizeof(*pRect));
+        pRectFirst = pRect = xallocarray(nRect, sizeof(*pRect));
         while (nBox--) {
             pRect->x = pBox->x1;
             pRect->y = pBox->y1;
diff --git a/hw/dmx/glxProxy/glxcmds.c b/hw/dmx/glxProxy/glxcmds.c
index 4c500c9..ddcb981 100644
--- a/hw/dmx/glxProxy/glxcmds.c
+++ b/hw/dmx/glxProxy/glxcmds.c
@@ -284,11 +284,11 @@ CreateContext(__GLXclientState * cl,
      * allocate memory for back-end servers info
      */
     num_be_screens = to_screen - from_screen + 1;
-    glxc->real_ids = (XID *) malloc(sizeof(XID) * num_be_screens);
+    glxc->real_ids = xallocarray(num_be_screens, sizeof(XID));
     if (!glxc->real_ids) {
         return BadAlloc;
     }
-    glxc->real_vids = (XID *) malloc(sizeof(XID) * num_be_screens);
+    glxc->real_vids = xallocarray(num_be_screens, sizeof(XID));
     if (!glxc->real_vids) {
         return BadAlloc;
     }
@@ -685,22 +685,16 @@ AddCurrentContext(__GLXclientState * cl, __GLXcontext * glxc, DrawablePtr pDraw)
     if (!num) {
         table = (__GLXcontext **) malloc(sizeof(__GLXcontext *));
         cl->currentDrawables = (DrawablePtr *) malloc(sizeof(DrawablePtr));
-        cl->be_currentCTag =
-            (GLXContextTag *) malloc(screenInfo.numScreens *
-                                     sizeof(GLXContextTag));
+        cl->be_currentCTag = xallocarray(screenInfo.numScreens,
+                                         sizeof(GLXContextTag));
     }
     else {
-        table = (__GLXcontext **) realloc(table,
-                                          (num + 1) * sizeof(__GLXcontext *));
-        cl->currentDrawables = (DrawablePtr *) realloc(cl->currentDrawables,
-                                                       (num +
-                                                        1) *
-                                                       sizeof(DrawablePtr));
-        cl->be_currentCTag =
-            (GLXContextTag *) realloc(cl->be_currentCTag,
-                                      (num +
-                                       1) * screenInfo.numScreens *
-                                      sizeof(GLXContextTag));
+        table = reallocarray(table, num + 1, sizeof(__GLXcontext *));
+        cl->currentDrawables = reallocarray(cl->currentDrawables, num + 1,
+                                            sizeof(DrawablePtr));
+        cl->be_currentCTag = reallocarray(cl->be_currentCTag,
+                                          (num + 1) * screenInfo.numScreens,
+                                          sizeof(GLXContextTag));
     }
     table[num] = glxc;
     cl->currentDrawables[num] = pDraw;
@@ -1896,7 +1890,7 @@ CreateGLXPixmap(__GLXclientState * cl,
     if (!pGlxPixmap) {
         return BadAlloc;
     }
-    pGlxPixmap->be_xids = (XID *) malloc(sizeof(XID) * screenInfo.numScreens);
+    pGlxPixmap->be_xids = xallocarray(screenInfo.numScreens, sizeof(XID));
     if (!pGlxPixmap->be_xids) {
         free(pGlxPixmap);
         return BadAlloc;
@@ -3356,7 +3350,7 @@ __glXCreatePbuffer(__GLXclientState * cl, GLbyte * pc)
         return BadAlloc;
     }
 
-    pGlxPbuffer->be_xids = (XID *) malloc(sizeof(XID) * screenInfo.numScreens);
+    pGlxPbuffer->be_xids = xallocarray(screenInfo.numScreens, sizeof(XID));
     if (!pGlxPbuffer->be_xids) {
         free(pGlxPbuffer);
         return BadAlloc;
@@ -3617,13 +3611,13 @@ __glXGetDrawableAttributes(__GLXclientState * cl, GLbyte * pc)
     }
 
     if (reply.numAttribs) {
-        attribs_size = 2 * reply.numAttribs * __GLX_SIZE_CARD32;
-        attribs = (CARD32 *) malloc(attribs_size);
+        attribs = xallocarray(reply.numAttribs, 2 * __GLX_SIZE_CARD32);
         if (attribs == NULL) {
             UnlockDisplay(dpy);
             SyncHandle();
             return BadAlloc;
         }
+        attribs_size = 2 * reply.numAttribs * __GLX_SIZE_CARD32;
 
         _XRead(dpy, (char *) attribs, attribs_size);
     }
diff --git a/hw/dmx/glxProxy/glxscreens.c b/hw/dmx/glxProxy/glxscreens.c
index 15bb1e8..508e67e 100644
--- a/hw/dmx/glxProxy/glxscreens.c
+++ b/hw/dmx/glxProxy/glxscreens.c
@@ -129,7 +129,7 @@ CalcServerVersionAndExtensions(void)
     /*
      * read extensions strings of all back-end servers
      */
-    be_extensions = (char **) malloc(__glXNumActiveScreens * sizeof(char *));
+    be_extensions = xallocarray(__glXNumActiveScreens, sizeof(char *));
     if (!be_extensions)
         return;
 
@@ -237,10 +237,9 @@ __glXScreenInit(GLint numscreens)
            // find the set of FBConfigs that are present on all back-end
            // servers - only those configs will be supported
          */
-        __glXFBConfigs = (__GLXFBConfig **) malloc(dmxScreen0->numFBConfigs *
-                                                   (numscreens +
-                                                    1) *
-                                                   sizeof(__GLXFBConfig *));
+        __glXFBConfigs =
+            xallocarray(dmxScreen0->numFBConfigs * (numscreens + 1),
+                        sizeof(__GLXFBConfig *));
         __glXNumFBConfigs = 0;
 
         for (c = 0; c < dmxScreen0->numFBConfigs; c++) {
diff --git a/hw/dmx/input/dmxarg.c b/hw/dmx/input/dmxarg.c
index 4a74b4c..6c21ae9 100644
--- a/hw/dmx/input/dmxarg.c
+++ b/hw/dmx/input/dmxarg.c
@@ -86,7 +86,7 @@ void
 dmxArgAdd(dmxArg a, const char *string)
 {
     if (a->argm <= a->argc + 2)
-        a->argv = realloc(a->argv, sizeof(*a->argv) * (a->argm *= 2));
+        a->argv = reallocarray(a->argv, (a->argm *= 2), sizeof(*a->argv));
     a->argv[a->argc++] = strdup(string);
     a->argv[a->argc] = NULL;
 }
diff --git a/hw/dmx/input/dmxinputinit.c b/hw/dmx/input/dmxinputinit.c
index 56a39df..cdefd9a 100644
--- a/hw/dmx/input/dmxinputinit.c
+++ b/hw/dmx/input/dmxinputinit.c
@@ -814,8 +814,8 @@ dmxInputCopyLocal(DMXInputInfo * dmxInput, DMXLocalInputInfoPtr s)
     dmxLocal->deviceId = -1;
 
     ++dmxInput->numDevs;
-    dmxInput->devs = realloc(dmxInput->devs,
-                             dmxInput->numDevs * sizeof(*dmxInput->devs));
+    dmxInput->devs = reallocarray(dmxInput->devs,
+                                  dmxInput->numDevs, sizeof(*dmxInput->devs));
     dmxInput->devs[dmxInput->numDevs - 1] = dmxLocal;
 
     return dmxLocal;
diff --git a/hw/dmx/input/dmxmotion.c b/hw/dmx/input/dmxmotion.c
index 1642894..7f2cb8e 100644
--- a/hw/dmx/input/dmxmotion.c
+++ b/hw/dmx/input/dmxmotion.c
@@ -113,9 +113,8 @@ dmxPointerPutMotionEvent(DeviceIntPtr pDevice,
     int i;
 
     if (!dmxLocal->history) {
-        dmxLocal->history = malloc(sizeof(*dmxLocal->history)
-                                   * (numAxes + 1)
-                                   * DMX_MOTION_SIZE);
+        dmxLocal->history = xallocarray(numAxes + 1,
+                                 sizeof(*dmxLocal->history) * DMX_MOTION_SIZE);
         dmxLocal->head = 0;
         dmxLocal->tail = 0;
         dmxLocal->valuators = calloc(sizeof(*dmxLocal->valuators), numAxes);
commit dc5acaa28ab9ed091f087e56046400d63f1f192a
Author: Alan Coopersmith <alan.coopersmith at oracle.com>
Date:   Sat Mar 21 17:30:05 2015 -0700

    Convert hw/kdrive to new *allocarray functions
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Reviewed-by: Matt Turner <mattst88 at gmail.com>

diff --git a/hw/kdrive/ephyr/ephyrdriext.c b/hw/kdrive/ephyr/ephyrdriext.c
index 3d5cf77..748b608 100644
--- a/hw/kdrive/ephyr/ephyrdriext.c
+++ b/hw/kdrive/ephyr/ephyrdriext.c
@@ -431,8 +431,8 @@ EphyrDuplicateVisual(unsigned int a_screen,
          * extend the list of visual IDs in that entry,
          * so to add a_new_id in there.
          */
-        vids = realloc(cur_depth->vids,
-                       (cur_depth->numVids + 1) * sizeof(VisualID));
+        vids = reallocarray(cur_depth->vids,
+                            cur_depth->numVids + 1, sizeof(VisualID));
         if (!vids) {
             EPHYR_LOG_ERROR("failed to realloc numids\n");
             goto out;
diff --git a/hw/kdrive/ephyr/hostx.c b/hw/kdrive/ephyr/hostx.c
index c67ff60..7163af0 100644
--- a/hw/kdrive/ephyr/hostx.c
+++ b/hw/kdrive/ephyr/hostx.c
@@ -129,8 +129,8 @@ hostx_add_screen(KdScreenInfo *screen, unsigned long win_id, int screen_num, Boo
     int index = HostX.n_screens;
 
     HostX.n_screens += 1;
-    HostX.screens = realloc(HostX.screens,
-                            HostX.n_screens * sizeof(HostX.screens[0]));
+    HostX.screens = reallocarray(HostX.screens,
+                                 HostX.n_screens, sizeof(HostX.screens[0]));
     HostX.screens[index] = screen;
 
     scrpriv->screen = screen;
@@ -867,7 +867,7 @@ hostx_screen_init(KdScreenInfo *screen,
                                                     NULL);
 
         scrpriv->ximg->data =
-            malloc(scrpriv->ximg->stride * buffer_height);
+            xallocarray(scrpriv->ximg->stride, buffer_height);
     }
 
     {
@@ -933,7 +933,7 @@ hostx_screen_init(KdScreenInfo *screen,
         *bits_per_pixel = scrpriv->server_depth;
 
         EPHYR_DBG("server bpp %i", bytes_per_pixel);
-        scrpriv->fb_data = malloc (stride * buffer_height);
+        scrpriv->fb_data = xallocarray (stride, buffer_height);
         return scrpriv->fb_data;
     }
 }
@@ -1148,9 +1148,9 @@ hostx_get_visuals_info(EphyrHostVisualInfo ** a_visuals, int *a_num_entries)
         for (; depths.rem; xcb_depth_next(&depths)) {
             xcb_visualtype_t *visuals = xcb_depth_visuals(depths.data);
             EphyrHostVisualInfo *tmp_visuals =
-                realloc(host_visuals,
-                        (nb_items + depths.data->visuals_len)
-                        * sizeof(EphyrHostVisualInfo));
+                reallocarray(host_visuals,
+                             nb_items + depths.data->visuals_len,
+                             sizeof(EphyrHostVisualInfo));
             if (!tmp_visuals) {
                 goto out;
             }
diff --git a/hw/kdrive/fake/fake.c b/hw/kdrive/fake/fake.c
index 90e3ec9..04a7278 100644
--- a/hw/kdrive/fake/fake.c
+++ b/hw/kdrive/fake/fake.c
@@ -158,7 +158,7 @@ fakeMapFramebuffer(KdScreenInfo * screen)
     priv->bytes_per_line =
         ((screen->width * screen->fb.bitsPerPixel + 31) >> 5) << 2;
     free(priv->base);
-    priv->base = malloc(priv->bytes_per_line * screen->height);
+    priv->base = xallocarray(priv->bytes_per_line, screen->height);
 
     if (scrpriv->shadow) {
         if (!KdShadowFbAlloc
diff --git a/hw/kdrive/fbdev/fbdev.c b/hw/kdrive/fbdev/fbdev.c
index 95f64cb..23f7509 100644
--- a/hw/kdrive/fbdev/fbdev.c
+++ b/hw/kdrive/fbdev/fbdev.c
@@ -677,7 +677,7 @@ fbdevCreateColormap(ColormapPtr pmap)
     case FB_VISUAL_STATIC_PSEUDOCOLOR:
         pVisual = pmap->pVisual;
         nent = pVisual->ColormapEntries;
-        pdefs = malloc(nent * sizeof(xColorItem));
+        pdefs = xallocarray(nent, sizeof(xColorItem));
         if (!pdefs)
             return FALSE;
         for (i = 0; i < nent; i++)
diff --git a/hw/kdrive/src/kshadow.c b/hw/kdrive/src/kshadow.c
index 828ea19..7f1e2ee 100644
--- a/hw/kdrive/src/kshadow.c
+++ b/hw/kdrive/src/kshadow.c
@@ -36,7 +36,7 @@ KdShadowFbAlloc(KdScreenInfo * screen, Bool rotate)
 
     /* use fb computation for width */
     paddedWidth = ((width * bpp + FB_MASK) >> FB_SHIFT) * sizeof(FbBits);
-    buf = malloc(paddedWidth * height);
+    buf = xallocarray(paddedWidth, height);
     if (!buf)
         return FALSE;
     if (screen->fb.shadow)
diff --git a/hw/kdrive/src/kxv.c b/hw/kdrive/src/kxv.c
index 369db33..844deca 100644
--- a/hw/kdrive/src/kxv.c
+++ b/hw/kdrive/src/kxv.c
@@ -327,8 +327,8 @@ KdXVInitAdaptors(ScreenPtr pScreen, KdVideoAdaptorPtr infoPtr, int number)
                         void *moreSpace;
 
                         totFormat *= 2;
-                        moreSpace = realloc(pFormat,
-                                            totFormat * sizeof(XvFormatRec));
+                        moreSpace = reallocarray(pFormat, totFormat,
+                                                 sizeof(XvFormatRec));
                         if (!moreSpace)
                             break;
                         pFormat = moreSpace;
commit ae2dc01cf1a371db69d5deb987f4185e7c3ccedd
Author: Alan Coopersmith <alan.coopersmith at oracle.com>
Date:   Sat Mar 21 17:23:33 2015 -0700

    Convert hw/xnest & hw/vfb to new *allocarray functions
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Reviewed-by: Matt Turner <mattst88 at gmail.com>

diff --git a/hw/vfb/InitOutput.c b/hw/vfb/InitOutput.c
index bcaaa85..8b867e3 100644
--- a/hw/vfb/InitOutput.c
+++ b/hw/vfb/InitOutput.c
@@ -292,7 +292,7 @@ ddxProcessArgument(int argc, char *argv[], int i)
 
         if (vfbNumScreens <= screenNum) {
             vfbScreens =
-                realloc(vfbScreens, sizeof(*vfbScreens) * (screenNum + 1));
+                reallocarray(vfbScreens, screenNum + 1, sizeof(*vfbScreens));
             if (!vfbScreens)
                 FatalError("Not enough memory for screen %d\n", screenNum);
             for (; vfbNumScreens <= screenNum; ++vfbNumScreens)
@@ -407,9 +407,9 @@ vfbInstallColormap(ColormapPtr pmap)
         swapcopy32(pXWDHeader->bits_per_rgb, pVisual->bitsPerRGBValue);
         swapcopy32(pXWDHeader->colormap_entries, pVisual->ColormapEntries);
 
-        ppix = (Pixel *) malloc(entries * sizeof(Pixel));
-        prgb = (xrgb *) malloc(entries * sizeof(xrgb));
-        defs = (xColorItem *) malloc(entries * sizeof(xColorItem));
+        ppix = xallocarray(entries, sizeof(Pixel));
+        prgb = xallocarray(entries, sizeof(xrgb));
+        defs = xallocarray(entries, sizeof(xColorItem));
 
         for (i = 0; i < entries; i++)
             ppix[i] = i;
diff --git a/hw/xnest/Color.c b/hw/xnest/Color.c
index 8d9d356..3a9e422 100644
--- a/hw/xnest/Color.c
+++ b/hw/xnest/Color.c
@@ -62,7 +62,7 @@ xnestCreateColormap(ColormapPtr pCmap)
 
     switch (pVisual->class) {
     case StaticGray:           /* read only */
-        colors = (XColor *) malloc(ncolors * sizeof(XColor));
+        colors = xallocarray(ncolors, sizeof(XColor));
         for (i = 0; i < ncolors; i++)
             colors[i].pixel = i;
         XQueryColors(xnestDisplay, xnestColormap(pCmap), colors, ncolors);
@@ -75,7 +75,7 @@ xnestCreateColormap(ColormapPtr pCmap)
         break;
 
     case StaticColor:          /* read only */
-        colors = (XColor *) malloc(ncolors * sizeof(XColor));
+        colors = xallocarray(ncolors, sizeof(XColor));
         for (i = 0; i < ncolors; i++)
             colors[i].pixel = i;
         XQueryColors(xnestDisplay, xnestColormap(pCmap), colors, ncolors);
@@ -88,7 +88,7 @@ xnestCreateColormap(ColormapPtr pCmap)
         break;
 
     case TrueColor:            /* read only */
-        colors = (XColor *) malloc(ncolors * sizeof(XColor));
+        colors = xallocarray(ncolors, sizeof(XColor));
         red = green = blue = 0L;
         redInc = lowbit(pVisual->redMask);
         greenInc = lowbit(pVisual->greenMask);
@@ -194,14 +194,12 @@ xnestSetInstalledColormapWindows(ScreenPtr pScreen)
     xnestInstalledColormapWindows icws;
     int numWindows;
 
-    icws.cmapIDs = (Colormap *) malloc(pScreen->maxInstalledCmaps *
-                                       sizeof(Colormap));
+    icws.cmapIDs = xallocarray(pScreen->maxInstalledCmaps, sizeof(Colormap));
     icws.numCmapIDs = xnestListInstalledColormaps(pScreen, icws.cmapIDs);
     icws.numWindows = 0;
     WalkTree(pScreen, xnestCountInstalledColormapWindows, (void *) &icws);
     if (icws.numWindows) {
-        icws.windows =
-            (Window *) malloc((icws.numWindows + 1) * sizeof(Window));
+        icws.windows = xallocarray(icws.numWindows + 1, sizeof(Window));
         icws.index = 0;
         WalkTree(pScreen, xnestGetInstalledColormapWindows, (void *) &icws);
         icws.windows[icws.numWindows] = xnestDefaultWindows[pScreen->myNum];
@@ -220,8 +218,7 @@ xnestSetInstalledColormapWindows(ScreenPtr pScreen)
 #ifdef _XSERVER64
         {
             int i;
-            Window64 *windows =
-                (Window64 *) malloc(numWindows * sizeof(Window64));
+            Window64 *windows = xallocarray(numWindows, sizeof(Window64));
 
             for (i = 0; i < numWindows; ++i)
                 windows[i] = icws.windows[i];
@@ -393,7 +390,7 @@ xnestStoreColors(ColormapPtr pCmap, int nColors, xColorItem * pColors)
 #ifdef _XSERVER64
     {
         int i;
-        XColor *pColors64 = (XColor *) malloc(nColors * sizeof(XColor));
+        XColor *pColors64 = xallocarray(nColors, sizeof(XColor));
 
         for (i = 0; i < nColors; ++i) {
             pColors64[i].pixel = pColors[i].pixel;
diff --git a/hw/xnest/Display.c b/hw/xnest/Display.c
index a2f8acb..e6d07df 100644
--- a/hw/xnest/Display.c
+++ b/hw/xnest/Display.c
@@ -121,8 +121,8 @@ xnestOpenDisplay(int argc, char *argv[])
     }
 
     xnestNumDefaultColormaps = xnestNumVisuals;
-    xnestDefaultColormaps = (Colormap *) malloc(xnestNumDefaultColormaps *
-                                                sizeof(Colormap));
+    xnestDefaultColormaps = xallocarray(xnestNumDefaultColormaps,
+                                        sizeof(Colormap));
     for (i = 0; i < xnestNumDefaultColormaps; i++)
         xnestDefaultColormaps[i] = XCreateColormap(xnestDisplay,
                                                    DefaultRootWindow
diff --git a/hw/xnest/GC.c b/hw/xnest/GC.c
index 96af6eb..ecfa61e 100644
--- a/hw/xnest/GC.c
+++ b/hw/xnest/GC.c
@@ -190,7 +190,7 @@ xnestDestroyGC(GCPtr pGC)
 void
 xnestChangeClip(GCPtr pGC, int type, void *pValue, int nRects)
 {
-    int i, size;
+    int i;
     BoxPtr pBox;
     XRectangle *pRects;
 
@@ -204,8 +204,7 @@ xnestChangeClip(GCPtr pGC, int type, void *pValue, int nRects)
 
     case CT_REGION:
         nRects = RegionNumRects((RegionPtr) pValue);
-        size = nRects * sizeof(*pRects);
-        pRects = (XRectangle *) malloc(size);
+        pRects = xallocarray(nRects, sizeof(*pRects));
         pBox = RegionRects((RegionPtr) pValue);
         for (i = nRects; i-- > 0;) {
             pRects[i].x = pBox[i].x1;
diff --git a/hw/xnest/Keyboard.c b/hw/xnest/Keyboard.c
index ee3f68e..002885f 100644
--- a/hw/xnest/Keyboard.c
+++ b/hw/xnest/Keyboard.c
@@ -134,7 +134,7 @@ xnestKeyboardProc(DeviceIntPtr pDev, int onoff)
                                            max_keycode - min_keycode + 1,
                                            &mapWidth);
             len = (max_keycode - min_keycode + 1) * mapWidth;
-            keymap = (KeySym *) malloc(len * sizeof(KeySym));
+            keymap = xallocarray(len, sizeof(KeySym));
             for (i = 0; i < len; ++i)
                 keymap[i] = keymap64[i];
             XFree(keymap64);
diff --git a/hw/xnest/Screen.c b/hw/xnest/Screen.c
index abb4d37..214b550 100644
--- a/hw/xnest/Screen.c
+++ b/hw/xnest/Screen.c
@@ -158,7 +158,7 @@ xnestOpenScreen(ScreenPtr pScreen, int argc, char *argv[])
     if (!dixRegisterPrivateKey(&xnestCursorScreenKeyRec, PRIVATE_SCREEN, 0))
         return FALSE;
 
-    visuals = (VisualPtr) malloc(xnestNumVisuals * sizeof(VisualRec));
+    visuals = xallocarray(xnestNumVisuals, sizeof(VisualRec));
     numVisuals = 0;
 
     depths = (DepthPtr) malloc(MAXDEPTH * sizeof(DepthRec));
@@ -224,7 +224,7 @@ xnestOpenScreen(ScreenPtr pScreen, int argc, char *argv[])
 
         numVisuals++;
     }
-    visuals = (VisualPtr) realloc(visuals, numVisuals * sizeof(VisualRec));
+    visuals = reallocarray(visuals, numVisuals, sizeof(VisualRec));
 
     defaultVisual = visuals[xnestDefaultVisualIndex].vid;
     rootDepth = visuals[xnestDefaultVisualIndex].nplanes;
commit 4cb1034906eeec8c8442d70918bea0f4eb1f6e44
Author: Alan Coopersmith <alan.coopersmith at oracle.com>
Date:   Sat Mar 21 17:12:06 2015 -0700

    Convert hw/xfree86 to new *allocarray functions
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Reviewed-by: Matt Turner <mattst88 at gmail.com>

diff --git a/hw/xfree86/common/xf86AutoConfig.c b/hw/xfree86/common/xf86AutoConfig.c
index 1450afb..6b8d0eb 100644
--- a/hw/xfree86/common/xf86AutoConfig.c
+++ b/hw/xfree86/common/xf86AutoConfig.c
@@ -105,7 +105,7 @@ AppendToList(const char *s, const char ***list, int *lines)
     str = xnfstrdup(s);
     for (p = strtok(str, "\n"); p; p = strtok(NULL, "\n")) {
         (*lines)++;
-        *list = xnfrealloc(*list, (*lines + 1) * sizeof(**list));
+        *list = xnfreallocarray(*list, *lines + 1, sizeof(**list));
         newstr = xnfalloc(strlen(p) + 2);
         strcpy(newstr, p);
         strcat(newstr, "\n");
diff --git a/hw/xfree86/common/xf86Bus.c b/hw/xfree86/common/xf86Bus.c
index 02f7bf2..bd36fc5 100644
--- a/hw/xfree86/common/xf86Bus.c
+++ b/hw/xfree86/common/xf86Bus.c
@@ -256,8 +256,8 @@ int
 xf86AllocateEntity(void)
 {
     xf86NumEntities++;
-    xf86Entities = xnfrealloc(xf86Entities,
-                              sizeof(EntityPtr) * xf86NumEntities);
+    xf86Entities = xnfreallocarray(xf86Entities,
+                                   xf86NumEntities, sizeof(EntityPtr));
     xf86Entities[xf86NumEntities - 1] = xnfcalloc(1, sizeof(EntityRec));
     xf86Entities[xf86NumEntities - 1]->entityPrivates =
         xnfcalloc(xf86EntityPrivateCount, sizeof(DevUnion));
@@ -326,12 +326,13 @@ xf86AddEntityToScreen(ScrnInfoPtr pScrn, int entityIndex)
     }
 
     pScrn->numEntities++;
-    pScrn->entityList = xnfrealloc(pScrn->entityList,
-                                   pScrn->numEntities * sizeof(int));
+    pScrn->entityList = xnfreallocarray(pScrn->entityList,
+                                        pScrn->numEntities, sizeof(int));
     pScrn->entityList[pScrn->numEntities - 1] = entityIndex;
     xf86Entities[entityIndex]->inUse = TRUE;
-    pScrn->entityInstanceList = xnfrealloc(pScrn->entityInstanceList,
-                                           pScrn->numEntities * sizeof(int));
+    pScrn->entityInstanceList = xnfreallocarray(pScrn->entityInstanceList,
+                                                pScrn->numEntities,
+                                                sizeof(int));
     pScrn->entityInstanceList[pScrn->numEntities - 1] = 0;
 }
 
@@ -427,8 +428,8 @@ xf86AddDevToEntity(int entityIndex, GDevPtr dev)
 
     pEnt = xf86Entities[entityIndex];
     pEnt->numInstances++;
-    pEnt->devices = xnfrealloc(pEnt->devices,
-                               pEnt->numInstances * sizeof(GDevPtr));
+    pEnt->devices = xnfreallocarray(pEnt->devices,
+                                    pEnt->numInstances, sizeof(GDevPtr));
     pEnt->devices[pEnt->numInstances - 1] = dev;
     dev->claimed = TRUE;
 }
@@ -670,8 +671,8 @@ xf86AllocateEntityPrivateIndex(void)
     idx = xf86EntityPrivateCount++;
     for (i = 0; i < xf86NumEntities; i++) {
         pEnt = xf86Entities[i];
-        nprivs = xnfrealloc(pEnt->entityPrivates,
-                            xf86EntityPrivateCount * sizeof(DevUnion));
+        nprivs = xnfreallocarray(pEnt->entityPrivates,
+                                 xf86EntityPrivateCount, sizeof(DevUnion));
         /* Zero the new private */
         memset(&nprivs[idx], 0, sizeof(DevUnion));
         pEnt->entityPrivates = nprivs;
diff --git a/hw/xfree86/common/xf86Config.c b/hw/xfree86/common/xf86Config.c
index 098d2dd..7edac0b 100644
--- a/hw/xfree86/common/xf86Config.c
+++ b/hw/xfree86/common/xf86Config.c
@@ -363,8 +363,8 @@ xf86ModulelistFromConfig(void ***optlist)
     /*
      * allocate the memory and walk the list again to fill in the pointers
      */
-    modulearray = xnfalloc((count + 1) * sizeof(char *));
-    optarray = xnfalloc((count + 1) * sizeof(void *));
+    modulearray = xnfallocarray(count + 1, sizeof(char *));
+    optarray = xnfallocarray(count + 1, sizeof(void *));
     count = 0;
     if (xf86configptr->conf_modules) {
         modp = xf86configptr->conf_modules->mod_load_lst;
@@ -429,7 +429,7 @@ xf86DriverlistFromConfig(void)
     /*
      * allocate the memory and walk the list again to fill in the pointers
      */
-    modulearray = xnfalloc((count + 1) * sizeof(char *));
+    modulearray = xnfallocarray(count + 1, sizeof(char *));
     count = 0;
     slp = xf86ConfigLayout.screens;
     while (slp->screen) {
@@ -493,7 +493,7 @@ xf86InputDriverlistFromConfig(void)
     /*
      * allocate the memory and walk the list again to fill in the pointers
      */
-    modulearray = xnfalloc((count + 1) * sizeof(char *));
+    modulearray = xnfallocarray(count + 1, sizeof(char *));
     count = 0;
     idp = xf86ConfigLayout.inputs;
     while (idp && *idp) {
@@ -1086,7 +1086,7 @@ addDevice(InputInfoPtr * list, InputInfoPtr pInfo)
     for (devs = list; devs && *devs; devs++)
         count++;
 
-    list = xnfrealloc(list, (count + 1) * sizeof(InputInfoPtr));
+    list = xnfreallocarray(list, count + 1, sizeof(InputInfoPtr));
     list[count] = NULL;
 
     list[count - 1] = pInfo;
@@ -1626,7 +1626,7 @@ configLayout(serverLayoutPtr servlayoutp, XF86ConfLayoutPtr conf_layout,
     }
     DebugF("Found %d inactive devices in the layout section %s\n",
            count, conf_layout->lay_identifier);
-    gdp = xnfalloc((count + 1) * sizeof(GDevRec));
+    gdp = xnfallocarray(count + 1, sizeof(GDevRec));
     gdp[count].identifier = NULL;
     idp = conf_layout->lay_inactive_lst;
     count = 0;
@@ -1746,7 +1746,7 @@ configXvAdaptor(confXvAdaptorPtr adaptor, XF86ConfVideoAdaptorPtr conf_adaptor)
         count++;
         conf_port = (XF86ConfVideoPortPtr) conf_port->list.next;
     }
-    adaptor->ports = xnfalloc((count) * sizeof(confXvPortRec));
+    adaptor->ports = xnfallocarray(count, sizeof(confXvPortRec));
     adaptor->numports = count;
     count = 0;
     conf_port = conf_adaptor->va_port_lst;
@@ -1827,7 +1827,7 @@ configScreen(confScreenPtr screenp, XF86ConfScreenPtr conf_screen, int scrnum,
         count++;
         dispptr = (XF86ConfDisplayPtr) dispptr->list.next;
     }
-    screenp->displays = xnfalloc((count) * sizeof(DispRec));
+    screenp->displays = xnfallocarray(count, sizeof(DispRec));
     screenp->numdisplays = count;
 
     /* Fill in the default Virtual size, if any */
@@ -1857,7 +1857,7 @@ configScreen(confScreenPtr screenp, XF86ConfScreenPtr conf_screen, int scrnum,
         count++;
         conf_adaptor = (XF86ConfAdaptorLinkPtr) conf_adaptor->list.next;
     }
-    screenp->xvadaptors = xnfalloc((count) * sizeof(confXvAdaptorRec));
+    screenp->xvadaptors = xnfallocarray(count, sizeof(confXvAdaptorRec));
     screenp->numxvadaptors = 0;
     conf_adaptor = conf_screen->scrn_adaptor_lst;
     while (conf_adaptor) {
@@ -2096,7 +2096,7 @@ configDisplay(DispPtr displayp, XF86ConfDisplayPtr conf_display)
         count++;
         modep = (XF86ModePtr) modep->list.next;
     }
-    displayp->modes = xnfalloc((count + 1) * sizeof(char *));
+    displayp->modes = xnfallocarray(count + 1, sizeof(char *));
     modep = conf_display->disp_mode_lst;
     count = 0;
     while (modep) {
diff --git a/hw/xfree86/common/xf86Configure.c b/hw/xfree86/common/xf86Configure.c
index 7ab378f..1271010 100644
--- a/hw/xfree86/common/xf86Configure.c
+++ b/hw/xfree86/common/xf86Configure.c
@@ -109,7 +109,7 @@ xf86AddBusDeviceToConfigure(const char *driver, BusType bus, void *busData,
     /* Allocate new structure occurrence */
     i = nDevToConfig++;
     DevToConfig =
-        xnfrealloc(DevToConfig, nDevToConfig * sizeof(DevToConfigRec));
+        xnfreallocarray(DevToConfig, nDevToConfig, sizeof(DevToConfigRec));
     memset(DevToConfig + i, 0, sizeof(DevToConfigRec));
 
     DevToConfig[i].GDev.chipID =
diff --git a/hw/xfree86/common/xf86DGA.c b/hw/xfree86/common/xf86DGA.c
index b9e1e3f..9533e1c 100644
--- a/hw/xfree86/common/xf86DGA.c
+++ b/hw/xfree86/common/xf86DGA.c
@@ -1349,7 +1349,7 @@ ProcXDGAQueryModes(ClientPtr client)
         return Success;
     }
 
-    if (!(mode = (XDGAModePtr) malloc(num * sizeof(XDGAModeRec))))
+    if (!(mode = xallocarray(num, sizeof(XDGAModeRec))))
         return BadAlloc;
 
     for (i = 0; i < num; i++)
diff --git a/hw/xfree86/common/xf86Helper.c b/hw/xfree86/common/xf86Helper.c
index e2b32a0..6a35250 100644
--- a/hw/xfree86/common/xf86Helper.c
+++ b/hw/xfree86/common/xf86Helper.c
@@ -77,8 +77,8 @@ xf86AddDriver(DriverPtr driver, void *module, int flags)
         xf86NumDrivers = 0;
 
     xf86NumDrivers++;
-    xf86DriverList = xnfrealloc(xf86DriverList,
-                                xf86NumDrivers * sizeof(DriverPtr));
+    xf86DriverList = xnfreallocarray(xf86DriverList,
+                                     xf86NumDrivers, sizeof(DriverPtr));
     xf86DriverList[xf86NumDrivers - 1] = xnfalloc(sizeof(DriverRec));
     if (flags & HaveDriverFuncs)
         *xf86DriverList[xf86NumDrivers - 1] = *driver;
@@ -117,9 +117,9 @@ xf86AddInputDriver(InputDriverPtr driver, void *module, int flags)
         xf86NumInputDrivers = 0;
 
     xf86NumInputDrivers++;
-    xf86InputDriverList = xnfrealloc(xf86InputDriverList,
-                                     xf86NumInputDrivers *
-                                     sizeof(InputDriverPtr));
+    xf86InputDriverList = xnfreallocarray(xf86InputDriverList,
+                                          xf86NumInputDrivers,
+                                          sizeof(InputDriverPtr));
     xf86InputDriverList[xf86NumInputDrivers - 1] =
         xnfalloc(sizeof(InputDriverRec));
     *xf86InputDriverList[xf86NumInputDrivers - 1] = *driver;
@@ -173,7 +173,8 @@ xf86AllocateScreen(DriverPtr drv, int flags)
         if (xf86GPUScreens == NULL)
             xf86NumGPUScreens = 0;
         i = xf86NumGPUScreens++;
-        xf86GPUScreens = xnfrealloc(xf86GPUScreens, xf86NumGPUScreens * sizeof(ScrnInfoPtr));
+        xf86GPUScreens = xnfreallocarray(xf86GPUScreens, xf86NumGPUScreens,
+                                         sizeof(ScrnInfoPtr));
         xf86GPUScreens[i] = xnfcalloc(sizeof(ScrnInfoRec), 1);
         pScrn = xf86GPUScreens[i];
         pScrn->scrnIndex = i + GPU_SCREEN_OFFSET;      /* Changes when a screen is removed */
@@ -183,7 +184,8 @@ xf86AllocateScreen(DriverPtr drv, int flags)
             xf86NumScreens = 0;
 
         i = xf86NumScreens++;
-        xf86Screens = xnfrealloc(xf86Screens, xf86NumScreens * sizeof(ScrnInfoPtr));
+        xf86Screens = xnfreallocarray(xf86Screens, xf86NumScreens,
+                                      sizeof(ScrnInfoPtr));
         xf86Screens[i] = xnfcalloc(sizeof(ScrnInfoRec), 1);
         pScrn = xf86Screens[i];
 
@@ -293,16 +295,16 @@ xf86AllocateScrnInfoPrivateIndex(void)
     idx = xf86ScrnInfoPrivateCount++;
     for (i = 0; i < xf86NumScreens; i++) {
         pScr = xf86Screens[i];
-        nprivs = xnfrealloc(pScr->privates,
-                            xf86ScrnInfoPrivateCount * sizeof(DevUnion));
+        nprivs = xnfreallocarray(pScr->privates,
+                                 xf86ScrnInfoPrivateCount, sizeof(DevUnion));
         /* Zero the new private */
         memset(&nprivs[idx], 0, sizeof(DevUnion));
         pScr->privates = nprivs;
     }
     for (i = 0; i < xf86NumGPUScreens; i++) {
         pScr = xf86GPUScreens[i];
-        nprivs = xnfrealloc(pScr->privates,
-                            xf86ScrnInfoPrivateCount * sizeof(DevUnion));
+        nprivs = xnfreallocarray(pScr->privates,
+                                 xf86ScrnInfoPrivateCount, sizeof(DevUnion));
         /* Zero the new private */
         memset(&nprivs[idx], 0, sizeof(DevUnion));
         pScr->privates = nprivs;
@@ -636,8 +638,8 @@ xf86SetDepthBpp(ScrnInfoPtr scrp, int depth, int dummy, int fbbpp,
     if (i == scrp->confScreen->numdisplays) {
         scrp->confScreen->numdisplays++;
         scrp->confScreen->displays =
-            xnfrealloc(scrp->confScreen->displays,
-                       scrp->confScreen->numdisplays * sizeof(DispRec));
+            xnfreallocarray(scrp->confScreen->displays,
+                            scrp->confScreen->numdisplays, sizeof(DispRec));
         xf86DrvMsg(scrp->scrnIndex, X_INFO,
                    "Creating default Display subsection in Screen section\n"
                    "\t\"%s\" for depth/fbbpp %d/%d\n",
@@ -1408,7 +1410,7 @@ xf86MatchDevice(const char *drivername, GDevPtr ** sectlist)
             /*
              * we have a matching driver that wasn't claimed, yet
              */
-            pgdp = xnfrealloc(pgdp, (i + 2) * sizeof(GDevPtr));
+            pgdp = xnfreallocarray(pgdp, i + 2, sizeof(GDevPtr));
             pgdp[i++] = screensecptr->device;
         }
     }
@@ -1420,7 +1422,7 @@ xf86MatchDevice(const char *drivername, GDevPtr ** sectlist)
         if (gdp->driver && !gdp->claimed &&
             !xf86NameCmp(gdp->driver, drivername)) {
             /* we have a matching driver that wasn't claimed yet */
-            pgdp = xnfrealloc(pgdp, (i + 2) * sizeof(GDevPtr));
+            pgdp = xnfreallocarray(pgdp, i + 2, sizeof(GDevPtr));
             pgdp[i++] = gdp;
         }
         j++;
diff --git a/hw/xfree86/common/xf86Xinput.c b/hw/xfree86/common/xf86Xinput.c
index 9fa3dc4..55bf2bb 100644
--- a/hw/xfree86/common/xf86Xinput.c
+++ b/hw/xfree86/common/xf86Xinput.c
@@ -867,8 +867,9 @@ xf86NewInputDevice(InputInfoPtr pInfo, DeviceIntPtr *pdev, BOOL enable)
         if (fd != -1) {
             if (paused) {
                 /* Put on new_input_devices list for delayed probe */
-                new_input_devices = xnfrealloc(new_input_devices,
-                            sizeof(pInfo) * (new_input_devices_count + 1));
+                new_input_devices = xnfreallocarray(new_input_devices,
+                                                    new_input_devices_count + 1,
+                                                    sizeof(pInfo));
                 new_input_devices[new_input_devices_count] = pInfo;
                 new_input_devices_count++;
                 systemd_logind_release_fd(pInfo->major, pInfo->minor, fd);
diff --git a/hw/xfree86/common/xf86cmap.c b/hw/xfree86/common/xf86cmap.c
index ab51f96..704e353 100644
--- a/hw/xfree86/common/xf86cmap.c
+++ b/hw/xfree86/common/xf86cmap.c
@@ -166,10 +166,10 @@ xf86HandleColormaps(ScreenPtr pScreen,
 
     elements = 1 << sigRGBbits;
 
-    if (!(gamma = malloc(elements * sizeof(LOCO))))
+    if (!(gamma = xallocarray(elements, sizeof(LOCO))))
         return FALSE;
 
-    if (!(indices = malloc(maxColors * sizeof(int)))) {
+    if (!(indices = xallocarray(maxColors, sizeof(int)))) {
         free(gamma);
         return FALSE;
     }
@@ -270,7 +270,7 @@ CMapAllocateColormapPrivate(ColormapPtr pmap)
     else
         numColors = 1 << pmap->pVisual->nplanes;
 
-    if (!(colors = malloc(numColors * sizeof(LOCO))))
+    if (!(colors = xallocarray(numColors, sizeof(LOCO))))
         return FALSE;
 
     if (!(pColPriv = malloc(sizeof(CMapColormapRec)))) {
diff --git a/hw/xfree86/common/xf86fbman.c b/hw/xfree86/common/xf86fbman.c
index 1b2cb57..91ddedc 100644
--- a/hw/xfree86/common/xf86fbman.c
+++ b/hw/xfree86/common/xf86fbman.c
@@ -317,16 +317,17 @@ localRegisterFreeBoxCallback(ScreenPtr pScreen,
 
     offman = (FBManagerPtr) dixLookupPrivate(&pScreen->devPrivates,
                                              xf86FBScreenKey);
-    newCallbacks = realloc(offman->FreeBoxesUpdateCallback,
-                           sizeof(FreeBoxCallbackProcPtr) *
-                           (offman->NumCallbacks + 1));
+    newCallbacks = reallocarray(offman->FreeBoxesUpdateCallback,
+                                offman->NumCallbacks + 1,
+                                sizeof(FreeBoxCallbackProcPtr));
     if (!newCallbacks)
         return FALSE;
     else
         offman->FreeBoxesUpdateCallback = newCallbacks;
 
-    newPrivates = realloc(offman->devPrivates,
-                          sizeof(DevUnion) * (offman->NumCallbacks + 1));
+    newPrivates = reallocarray(offman->devPrivates,
+                               offman->NumCallbacks + 1,
+                               sizeof(DevUnion));
     if (!newPrivates)
         return FALSE;
     else
diff --git a/hw/xfree86/common/xf86pciBus.c b/hw/xfree86/common/xf86pciBus.c
index e86ecb9..8158c2b 100644
--- a/hw/xfree86/common/xf86pciBus.c
+++ b/hw/xfree86/common/xf86pciBus.c
@@ -103,9 +103,9 @@ xf86PciProbe(void)
     while ((info = pci_device_next(iter)) != NULL) {
         if (PCIINFOCLASSES(info->device_class)) {
             num++;
-            xf86PciVideoInfo = xnfrealloc(xf86PciVideoInfo,
-                                          (sizeof(struct pci_device *)
-                                           * (num + 1)));
+            xf86PciVideoInfo = xnfreallocarray(xf86PciVideoInfo,
+                                               num + 1,
+                                               sizeof(struct pci_device *));
             xf86PciVideoInfo[num] = NULL;
             xf86PciVideoInfo[num - 1] = info;
 
@@ -679,7 +679,7 @@ xf86MatchPciInstances(const char *driverName, int vendorID,
         }
 
         pci_iterator_destroy(iter);
-        instances = xnfalloc(max_entries * sizeof(struct Inst));
+        instances = xnfallocarray(max_entries, sizeof(struct Inst));
     }
 
     iter = pci_slot_match_iterator_create(NULL);
@@ -976,7 +976,7 @@ xf86MatchPciInstances(const char *driverName, int vendorID,
 
         /* Allocate an entry in the lists to be returned */
         numFound++;
-        retEntities = xnfrealloc(retEntities, numFound * sizeof(int));
+        retEntities = xnfreallocarray(retEntities, numFound, sizeof(int));
         retEntities[numFound - 1] = xf86ClaimPciSlot(pPci, drvp,
                                                      instances[i].chip,
                                                      instances[i].dev,
diff --git a/hw/xfree86/common/xf86platformBus.c b/hw/xfree86/common/xf86platformBus.c
index c1aaba4..f1e9423 100644
--- a/hw/xfree86/common/xf86platformBus.c
+++ b/hw/xfree86/common/xf86platformBus.c
@@ -59,9 +59,9 @@ struct xf86_platform_device *xf86_platform_devices;
 int
 xf86_add_platform_device(struct OdevAttributes *attribs, Bool unowned)
 {
-    xf86_platform_devices = xnfrealloc(xf86_platform_devices,
-                                   (sizeof(struct xf86_platform_device)
-                                    * (xf86_num_platform_devices + 1)));
+    xf86_platform_devices = xnfreallocarray(xf86_platform_devices,
+                                            xf86_num_platform_devices + 1,
+                                            sizeof(struct xf86_platform_device));
 
     xf86_platform_devices[xf86_num_platform_devices].attribs = attribs;
     xf86_platform_devices[xf86_num_platform_devices].pdev = NULL;
diff --git a/hw/xfree86/common/xf86sbusBus.c b/hw/xfree86/common/xf86sbusBus.c
index 07eb71e..119211d 100644
--- a/hw/xfree86/common/xf86sbusBus.c
+++ b/hw/xfree86/common/xf86sbusBus.c
@@ -68,7 +68,7 @@ CheckSbusDevice(const char *device, int fbNum)
     if (!sbusDeviceTable[i].devId)
         return;
     xf86SbusInfo =
-        xnfrealloc(xf86SbusInfo, sizeof(psdp) * (++xf86nSbusInfo + 1));
+        xnfreallocarray(xf86SbusInfo, ++xf86nSbusInfo + 1, sizeof(psdp));
     xf86SbusInfo[xf86nSbusInfo] = NULL;
     xf86SbusInfo[xf86nSbusInfo - 1] = psdp = xnfcalloc(sizeof(sbusDevice), 1);
     psdp->devId = sbusDeviceTable[i].devId;
@@ -406,8 +406,8 @@ xf86MatchSbusInstances(const char *driverName, int sbusDevId,
         if (psdp->fd == -2)
             continue;
         ++allocatedInstances;
-        instances = xnfrealloc(instances,
-                               allocatedInstances * sizeof(struct Inst));
+        instances = xnfreallocarray(instances,
+                                    allocatedInstances, sizeof(struct Inst));
         instances[allocatedInstances - 1].sbus = psdp;
         instances[allocatedInstances - 1].dev = NULL;
         instances[allocatedInstances - 1].claimed = FALSE;
@@ -532,7 +532,7 @@ xf86MatchSbusInstances(const char *driverName, int sbusDevId,
 
         /* Allocate an entry in the lists to be returned */
         numFound++;
-        retEntities = xnfrealloc(retEntities, numFound * sizeof(int));
+        retEntities = xnfreallocarray(retEntities, numFound, sizeof(int));
         retEntities[numFound - 1]
             = xf86ClaimSbusSlot(psdp, drvp, instances[i].dev,
                                 instances[i].dev->active ? TRUE : FALSE);
@@ -648,7 +648,7 @@ xf86SbusCmapLoadPalette(ScrnInfoPtr pScrn, int numColors, int *indices,
         return;
     fbcmap.count = 0;
     fbcmap.index = indices[0];
-    fbcmap.red = data = malloc(numColors * 3);
+    fbcmap.red = data = xallocarray(numColors, 3);
     if (!data)
         return;
     fbcmap.green = data + numColors;
diff --git a/hw/xfree86/common/xf86vmode.c b/hw/xfree86/common/xf86vmode.c
index 0ce58e3..818e7dc 100644
--- a/hw/xfree86/common/xf86vmode.c
+++ b/hw/xfree86/common/xf86vmode.c
@@ -1240,11 +1240,11 @@ ProcXF86VidModeGetMonitor(ClientPtr client)
                        pad_to_int32(rep.modelLength));
     rep.nhsync = nHsync;
     rep.nvsync = nVrefresh;
-    hsyncdata = malloc(nHsync * sizeof(CARD32));
+    hsyncdata = xallocarray(nHsync, sizeof(CARD32));
     if (!hsyncdata) {
         return BadAlloc;
     }
-    vsyncdata = malloc(nVrefresh * sizeof(CARD32));
+    vsyncdata = xallocarray(nVrefresh, sizeof(CARD32));
 
     if (!vsyncdata) {
         free(hsyncdata);
@@ -1512,9 +1512,9 @@ ProcXF86VidModeGetGammaRamp(ClientPtr client)
     length = (stuff->size + 1) & ~1;
 
     if (stuff->size) {
-        ramplen = length * 3 * sizeof(CARD16);
-        if (!(ramp = malloc(ramplen)))
+        if (!(ramp = xallocarray(length, 3 * sizeof(CARD16))))
             return BadAlloc;
+        ramplen = length * 3 * sizeof(CARD16);
 
         if (!VidModeGetGammaRamp(stuff->screen, stuff->size,
                                  ramp, ramp + length, ramp + (length * 2))) {
diff --git a/hw/xfree86/common/xf86xv.c b/hw/xfree86/common/xf86xv.c
index b974cd2..d613d71 100644
--- a/hw/xfree86/common/xf86xv.c
+++ b/hw/xfree86/common/xf86xv.c
@@ -131,8 +131,8 @@ xf86XVRegisterGenericAdaptorDriver(xf86XVInitGenericAdaptorPtr InitFunc)
 {
     xf86XVInitGenericAdaptorPtr *newdrivers;
 
-    newdrivers = realloc(GenDrivers, sizeof(xf86XVInitGenericAdaptorPtr) *
-                         (1 + NumGenDrivers));
+    newdrivers = reallocarray(GenDrivers, 1 + NumGenDrivers,
+                              sizeof(xf86XVInitGenericAdaptorPtr));
     if (!newdrivers)
         return 0;
     GenDrivers = newdrivers;
@@ -159,7 +159,7 @@ xf86XVListGenericAdaptors(ScrnInfoPtr pScrn, XF86VideoAdaptorPtr ** adaptors)
         n = (*GenDrivers[i]) (pScrn, &DrivAdap);
         if (0 == n)
             continue;
-        new = realloc(*adaptors, sizeof(XF86VideoAdaptorPtr) * (num + n));
+        new = reallocarray(*adaptors, num + n, sizeof(XF86VideoAdaptorPtr));
         if (NULL == new)
             continue;
         *adaptors = new;
@@ -436,8 +436,8 @@ xf86XVInitAdaptors(ScreenPtr pScreen, XF86VideoAdaptorPtr * infoPtr, int number)
                         void *moreSpace;
 
                         totFormat *= 2;
-                        moreSpace = realloc(pFormat,
-                                            totFormat * sizeof(XvFormatRec));
+                        moreSpace = reallocarray(pFormat, totFormat,
+                                                 sizeof(XvFormatRec));
                         if (!moreSpace)
                             break;
                         pFormat = moreSpace;
diff --git a/hw/xfree86/common/xf86xvmc.c b/hw/xfree86/common/xf86xvmc.c
index 3169c05..a0a94c7 100644
--- a/hw/xfree86/common/xf86xvmc.c
+++ b/hw/xfree86/common/xf86xvmc.c
@@ -155,7 +155,7 @@ xf86XvMCScreenInit(ScreenPtr pScreen,
     if (noXvExtension)
         return FALSE;
 
-    if (!(pAdapt = malloc(sizeof(XvMCAdaptorRec) * num_adaptors)))
+    if (!(pAdapt = xallocarray(num_adaptors, sizeof(XvMCAdaptorRec))))
         return FALSE;
 
     if (!dixRegisterPrivateKey(&XF86XvMCScreenKeyRec, PRIVATE_SCREEN, 0)) {
diff --git a/hw/xfree86/ddc/ddc.c b/hw/xfree86/ddc/ddc.c
index 29185ad..ee533db 100644
--- a/hw/xfree86/ddc/ddc.c
+++ b/hw/xfree86/ddc/ddc.c
@@ -437,7 +437,7 @@ xf86DoEEDID(ScrnInfoPtr pScrn, I2CBusPtr pBus, Bool complete)
         int i, n = EDID_block[0x7e];
 
         if (complete && n) {
-            EDID_block = realloc(EDID_block, EDID1_LEN * (1 + n));
+            EDID_block = reallocarray(EDID_block, 1 + n, EDID1_LEN);
 
             for (i = 0; i < n; i++)
                 DDC2Read(dev, i + 1, EDID_block + (EDID1_LEN * (1 + i)));
diff --git a/hw/xfree86/dri/xf86dri.c b/hw/xfree86/dri/xf86dri.c
index 086e833..68f8b7e 100644
--- a/hw/xfree86/dri/xf86dri.c
+++ b/hw/xfree86/dri/xf86dri.c
@@ -422,7 +422,7 @@ ProcXF86DRIGetDrawableInfo(register ClientPtr client)
 
     if (rep.numClipRects) {
         /* Clip cliprects to screen dimensions (redirected windows) */
-        pClippedRects = malloc(rep.numClipRects * sizeof(drm_clip_rect_t));
+        pClippedRects = xallocarray(rep.numClipRects, sizeof(drm_clip_rect_t));
 
         if (pClippedRects) {
             ScreenPtr pScreen = screenInfo.screens[stuff->screen];
diff --git a/hw/xfree86/dri2/dri2.c b/hw/xfree86/dri2/dri2.c
index 0c038b3..60ea6dd 100644
--- a/hw/xfree86/dri2/dri2.c
+++ b/hw/xfree86/dri2/dri2.c
@@ -1577,7 +1577,7 @@ DRI2ScreenInit(ScreenPtr pScreen, DRI2InfoPtr info)
     if (info->version == 3 || info->numDrivers == 0) {
         /* Driver too old: use the old-style driverName field */
         ds->numDrivers = info->driverName ? 1 : 2;
-        ds->driverNames = malloc(ds->numDrivers * sizeof(*ds->driverNames));
+        ds->driverNames = xallocarray(ds->numDrivers, sizeof(*ds->driverNames));
         if (!ds->driverNames)
             goto err_out;
 
@@ -1591,7 +1591,7 @@ DRI2ScreenInit(ScreenPtr pScreen, DRI2InfoPtr info)
     }
     else {
         ds->numDrivers = info->numDrivers;
-        ds->driverNames = malloc(info->numDrivers * sizeof(*ds->driverNames));
+        ds->driverNames = xallocarray(info->numDrivers, sizeof(*ds->driverNames));
         if (!ds->driverNames)
             goto err_out;
         memcpy(ds->driverNames, info->driverNames,
diff --git a/hw/xfree86/drivers/modesetting/driver.c b/hw/xfree86/drivers/modesetting/driver.c
index e2f3846..e90e4b8 100644
--- a/hw/xfree86/drivers/modesetting/driver.c
+++ b/hw/xfree86/drivers/modesetting/driver.c
@@ -451,7 +451,7 @@ dispatch_dirty_region(ScrnInfoPtr scrn,
     int ret = 0;
 
     if (num_cliprects) {
-        drmModeClip *clip = malloc(num_cliprects * sizeof(drmModeClip));
+        drmModeClip *clip = xallocarray(num_cliprects, sizeof(drmModeClip));
         BoxPtr rect = REGION_RECTS(dirty);
         int i;
 
diff --git a/hw/xfree86/i2c/xf86i2c.c b/hw/xfree86/i2c/xf86i2c.c
index cf2cd09..2a8b8df 100644
--- a/hw/xfree86/i2c/xf86i2c.c
+++ b/hw/xfree86/i2c/xf86i2c.c
@@ -872,7 +872,7 @@ xf86I2CGetScreenBuses(int scrnIndex, I2CBusPtr ** pppI2CBus)
         if (!pppI2CBus)
             continue;
 
-        *pppI2CBus = xnfrealloc(*pppI2CBus, n * sizeof(I2CBusPtr));
+        *pppI2CBus = xnfreallocarray(*pppI2CBus, n, sizeof(I2CBusPtr));
         (*pppI2CBus)[n - 1] = pI2CBus;
     }
 
diff --git a/hw/xfree86/loader/loadmod.c b/hw/xfree86/loader/loadmod.c
index fdf5bd8..73dc1b8 100644
--- a/hw/xfree86/loader/loadmod.c
+++ b/hw/xfree86/loader/loadmod.c
@@ -142,7 +142,7 @@ InitPathList(const char *path)
             if (addslash)
                 len++;
             save = list;
-            list = realloc(list, (n + 2) * sizeof(char *));
+            list = reallocarray(list, n + 2, sizeof(char *));
             if (!list) {
                 if (save) {
                     save[n] = NULL;
@@ -244,7 +244,7 @@ InitPatterns(const char **patternlist)
         for (i = 0, s = patternlist; *s; i++, s++)
             if (*s == DEFAULT_LIST)
                 i += sizeof(stdPatterns) / sizeof(stdPatterns[0]) - 1 - 1;
-        patterns = malloc((i + 1) * sizeof(PatternRec));
+        patterns = xallocarray(i + 1, sizeof(PatternRec));
         if (!patterns) {
             return NULL;
         }
@@ -323,7 +323,7 @@ InitSubdirs(const char **subdirlist)
                 }
             }
         }
-        subdirs = malloc((i * 2 + 1) * sizeof(char *));
+        subdirs = xallocarray(i * 2 + 1, sizeof(char *));
         if (!subdirs) {
             free(tmp_subdirlist);
             return NULL;
@@ -530,8 +530,8 @@ LoaderListDirs(const char **subdirlist, const char **patternlist)
                             match[1].rm_so != -1) {
                             len = match[1].rm_eo - match[1].rm_so;
                             save = listing;
-                            listing = realloc(listing,
-                                              (n + 2) * sizeof(char *));
+                            listing = reallocarray(listing, n + 2,
+                                                   sizeof(char *));
                             if (!listing) {
                                 if (save) {
                                     save[n] = NULL;
diff --git a/hw/xfree86/modes/xf86Crtc.c b/hw/xfree86/modes/xf86Crtc.c
index a194724..127e543 100644
--- a/hw/xfree86/modes/xf86Crtc.c
+++ b/hw/xfree86/modes/xf86Crtc.c
@@ -118,7 +118,7 @@ xf86CrtcCreate(ScrnInfoPtr scrn, const xf86CrtcFuncsRec * funcs)
 
     /* Preallocate gamma at a sensible size. */
     crtc->gamma_size = 256;
-    crtc->gamma_red = malloc(3 * crtc->gamma_size * sizeof(CARD16));
+    crtc->gamma_red = xallocarray(crtc->gamma_size, 3 * sizeof(CARD16));
     if (!crtc->gamma_red) {
         free(crtc);
         return NULL;
@@ -127,10 +127,10 @@ xf86CrtcCreate(ScrnInfoPtr scrn, const xf86CrtcFuncsRec * funcs)
     crtc->gamma_blue = crtc->gamma_green + crtc->gamma_size;
 
     if (xf86_config->crtc)
-        crtcs = realloc(xf86_config->crtc,
-                        (xf86_config->num_crtc + 1) * sizeof(xf86CrtcPtr));
+        crtcs = reallocarray(xf86_config->crtc,
+                             xf86_config->num_crtc + 1, sizeof(xf86CrtcPtr));
     else
-        crtcs = malloc((xf86_config->num_crtc + 1) * sizeof(xf86CrtcPtr));
+        crtcs = xallocarray(xf86_config->num_crtc + 1, sizeof(xf86CrtcPtr));
     if (!crtcs) {
         free(crtc->gamma_red);
         free(crtc);
@@ -620,11 +620,12 @@ xf86OutputCreate(ScrnInfoPtr scrn,
     }
 
     if (xf86_config->output)
-        outputs = realloc(xf86_config->output,
-                          (xf86_config->num_output +
-                           1) * sizeof(xf86OutputPtr));
+        outputs = reallocarray(xf86_config->output,
+                               xf86_config->num_output + 1,
+                               sizeof(xf86OutputPtr));
     else
-        outputs = malloc((xf86_config->num_output + 1) * sizeof(xf86OutputPtr));
+        outputs = xallocarray(xf86_config->num_output + 1,
+                              sizeof(xf86OutputPtr));
     if (!outputs) {
         free(output);
         return NULL;
@@ -942,7 +943,7 @@ xf86PickCrtcs(ScrnInfoPtr scrn,
     if (modes[n] == NULL)
         return best_score;
 
-    crtcs = malloc(config->num_output * sizeof(xf86CrtcPtr));
+    crtcs = xallocarray(config->num_output, sizeof(xf86CrtcPtr));
     if (!crtcs)
         return best_score;
 
@@ -2334,7 +2335,7 @@ xf86CrtcSetInitialGamma(xf86CrtcPtr crtc, float gamma_red, float gamma_green,
     int i, size = 256;
     CARD16 *red, *green, *blue;
 
-    red = malloc(3 * size * sizeof(CARD16));
+    red = xallocarray(size, 3 * sizeof(CARD16));
     green = red + size;
     blue = green + size;
 
diff --git a/hw/xfree86/modes/xf86DiDGA.c b/hw/xfree86/modes/xf86DiDGA.c
index 3f1a330..6457274 100644
--- a/hw/xfree86/modes/xf86DiDGA.c
+++ b/hw/xfree86/modes/xf86DiDGA.c
@@ -60,7 +60,7 @@ xf86_dga_get_modes(ScreenPtr pScreen)
     if (!num)
         return FALSE;
 
-    modes = malloc(num * sizeof(DGAModeRec));
+    modes = xallocarray(num, sizeof(DGAModeRec));
     if (!modes)
         return FALSE;
 
diff --git a/hw/xfree86/modes/xf86RandR12.c b/hw/xfree86/modes/xf86RandR12.c
index b1c306a..fb73128 100644
--- a/hw/xfree86/modes/xf86RandR12.c
+++ b/hw/xfree86/modes/xf86RandR12.c
@@ -1058,7 +1058,7 @@ xf86RandR12CrtcNotify(RRCrtcPtr randr_crtc)
     DisplayModePtr mode = &crtc->mode;
     Bool ret;
 
-    randr_outputs = malloc(config->num_output * sizeof(RROutputPtr));
+    randr_outputs = xallocarray(config->num_output, sizeof(RROutputPtr));
     if (!randr_outputs)
         return FALSE;
     x = crtc->x;
@@ -1150,7 +1150,7 @@ xf86RandR12CrtcSet(ScreenPtr pScreen,
     if (!crtc->scrn->vtSema)
         return FALSE;
 
-    save_crtcs = malloc(config->num_output * sizeof(xf86CrtcPtr));
+    save_crtcs = xallocarray(config->num_output, sizeof(xf86CrtcPtr));
     if ((randr_mode != NULL) != crtc->enabled)
         changed = TRUE;
     else if (randr_mode && !xf86RandRModeMatches(randr_mode, &crtc->mode))
@@ -1255,9 +1255,8 @@ xf86RandR12CrtcSetGamma(ScreenPtr pScreen, RRCrtcPtr randr_crtc)
     if (randr_crtc->gammaSize != crtc->gamma_size) {
         CARD16 *tmp_ptr;
 
-        tmp_ptr =
-            realloc(crtc->gamma_red,
-                    3 * randr_crtc->gammaSize * sizeof(CARD16));
+        tmp_ptr = reallocarray(crtc->gamma_red,
+                               randr_crtc->gammaSize, 3 * sizeof(CARD16));
         if (!tmp_ptr)
             return FALSE;
         crtc->gamma_red = tmp_ptr;
@@ -1298,9 +1297,8 @@ xf86RandR12CrtcGetGamma(ScreenPtr pScreen, RRCrtcPtr randr_crtc)
     if (randr_crtc->gammaSize != crtc->gamma_size) {
         CARD16 *tmp_ptr;
 
-        tmp_ptr =
-            realloc(randr_crtc->gammaRed,
-                    3 * crtc->gamma_size * sizeof(CARD16));
+        tmp_ptr = reallocarray(randr_crtc->gammaRed,
+                               crtc->gamma_size, 3 * sizeof(CARD16));
         if (!tmp_ptr)
             return FALSE;
         randr_crtc->gammaRed = tmp_ptr;
@@ -1394,7 +1392,7 @@ xf86RROutputSetModes(RROutputPtr randr_output, DisplayModePtr modes)
         nmode++;
 
     if (nmode) {
-        rrmodes = malloc(nmode * sizeof(RRModePtr));
+        rrmodes = xallocarray(nmode, sizeof(RRModePtr));
 
         if (!rrmodes)
             return FALSE;
@@ -1449,8 +1447,8 @@ xf86RandR12SetInfo12(ScreenPtr pScreen)
     int o, c, l;
     int nclone;
 
-    clones = malloc(config->num_output * sizeof(RROutputPtr));
-    crtcs = malloc(config->num_crtc * sizeof(RRCrtcPtr));
+    clones = xallocarray(config->num_output, sizeof(RROutputPtr));
+    crtcs = xallocarray(config->num_crtc, sizeof(RRCrtcPtr));
     for (o = 0; o < config->num_output; o++) {
         xf86OutputPtr output = config->output[o];
 
diff --git a/hw/xfree86/os-support/bus/Sbus.c b/hw/xfree86/os-support/bus/Sbus.c
index 16ce5b5..86b4d68 100644
--- a/hw/xfree86/os-support/bus/Sbus.c
+++ b/hw/xfree86/os-support/bus/Sbus.c
@@ -440,7 +440,7 @@ sparcPromAssignNodes(void)
     for (i = 0, j = 0; i < 32; i++)
         if (devicePtrs[i] && devicePtrs[i]->fbNum == -1)
             j++;
-    xf86SbusInfo = xnfrealloc(xf86SbusInfo, sizeof(psdp) * (n + j + 1));
+    xf86SbusInfo = xnfreallocarray(xf86SbusInfo, n + j + 1, sizeof(psdp));
     for (i = 0, psdpp = xf86SbusInfo; i < 32; i++)
         if (devicePtrs[i]) {
             if (devicePtrs[i]->fbNum == -1) {
diff --git a/hw/xfree86/vbe/vbe.c b/hw/xfree86/vbe/vbe.c
index 5ea0197..ef12cb8 100644
--- a/hw/xfree86/vbe/vbe.c
+++ b/hw/xfree86/vbe/vbe.c
@@ -397,7 +397,7 @@ VBEGetVBEInfo(vbeInfoPtr pVbe)
     i = 0;
     while (modes[i] != 0xffff)
         i++;
-    block->VideoModePtr = malloc(sizeof(CARD16) * (i + 1));
+    block->VideoModePtr = xallocarray(i + 1, sizeof(CARD16));
     memcpy(block->VideoModePtr, modes, sizeof(CARD16) * i);
     block->VideoModePtr[i] = 0xffff;
 
@@ -825,7 +825,7 @@ VBESetGetPaletteData(vbeInfoPtr pVbe, Bool set, int first, int num,
     if (set)
         return data;
 
-    data = malloc(num * sizeof(CARD32));
+    data = xallocarray(num, sizeof(CARD32));
     memcpy(data, pVbe->memory, num * sizeof(CARD32));
 
     return data;
commit f59236c2865d22c6f0b2d1ba303213afd10cd02e
Author: Alan Coopersmith <alan.coopersmith at oracle.com>
Date:   Sat Mar 21 15:05:30 2015 -0700

    Convert glamor & glx to new *allocarray functions
    
    v2: fixup whitespace
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Reviewed-by: Matt Turner <mattst88 at gmail.com>
    Reviewed-by: Michel Dänzer <michel.daenzer at amd.com>

diff --git a/glamor/glamor_compositerects.c b/glamor/glamor_compositerects.c
index e188d8a..885a6c0 100644
--- a/glamor/glamor_compositerects.c
+++ b/glamor/glamor_compositerects.c
@@ -57,7 +57,7 @@ _pixman_region_init_clipped_rectangles(pixman_region16_t * region,
     unsigned int i, j;
 
     if (num_rects > ARRAY_SIZE(stack_boxes)) {
-        boxes = malloc(sizeof(pixman_box16_t) * num_rects);
+        boxes = xallocarray(num_rects, sizeof(pixman_box16_t));
         if (boxes == NULL)
             return FALSE;
     }
diff --git a/glamor/glamor_glyphs.c b/glamor/glamor_glyphs.c
index 2cf0c7d..4f3f969 100644
--- a/glamor/glamor_glyphs.c
+++ b/glamor/glamor_glyphs.c
@@ -634,7 +634,7 @@ glyph_new_fixed_list(struct glamor_glyph_list *fixed_list,
     }
     DEBUGF("got %d lists\n", list_cnt);
     if (list_cnt != 0) {
-        fixed_list->list = malloc(list_cnt * sizeof(*cur_list));
+        fixed_list->list = xallocarray(list_cnt, sizeof(*cur_list));
         memcpy(fixed_list->list, *head_list, list_cnt * sizeof(*cur_list));
         fixed_list->list[0].xOff = *head_x;
         fixed_list->list[0].yOff = *head_y;
diff --git a/glamor/glamor_gradient.c b/glamor/glamor_gradient.c
index 8ea645e..d34131d 100644
--- a/glamor/glamor_gradient.c
+++ b/glamor/glamor_gradient.c
@@ -997,13 +997,13 @@ glamor_generate_radial_gradient_picture(ScreenPtr screen,
 
     /* Set all the stops and colors to shader. */
     if (stops_count > RADIAL_SMALL_STOPS) {
-        stop_colors = malloc(4 * stops_count * sizeof(float));
+        stop_colors = xallocarray(stops_count, 4 * sizeof(float));
         if (stop_colors == NULL) {
             ErrorF("Failed to allocate stop_colors memory.\n");
             goto GRADIENT_FAIL;
         }
 
-        n_stops = malloc(stops_count * sizeof(float));
+        n_stops = xallocarray(stops_count, sizeof(float));
         if (n_stops == NULL) {
             ErrorF("Failed to allocate n_stops memory.\n");
             goto GRADIENT_FAIL;
@@ -1338,13 +1338,13 @@ glamor_generate_linear_gradient_picture(ScreenPtr screen,
 
     /* Set all the stops and colors to shader. */
     if (stops_count > LINEAR_SMALL_STOPS) {
-        stop_colors = malloc(4 * stops_count * sizeof(float));
+        stop_colors = xallocarray(stops_count, 4 * sizeof(float));
         if (stop_colors == NULL) {
             ErrorF("Failed to allocate stop_colors memory.\n");
             goto GRADIENT_FAIL;
         }
 
-        n_stops = malloc(stops_count * sizeof(float));
+        n_stops = xallocarray(stops_count, sizeof(float));
         if (n_stops == NULL) {
             ErrorF("Failed to allocate n_stops memory.\n");
             goto GRADIENT_FAIL;
diff --git a/glamor/glamor_pixmap.c b/glamor/glamor_pixmap.c
index 89b4c36..6235747 100644
--- a/glamor/glamor_pixmap.c
+++ b/glamor/glamor_pixmap.c
@@ -775,7 +775,7 @@ _glamor_upload_bits_to_pixmap_texture(PixmapPtr pixmap, GLenum format,
         if (pixmap->drawable.depth == 1)
             stride = (((w * 8 + 7) / 8) + 3) & ~3;
 
-        converted_bits = malloc(h * stride);
+        converted_bits = xallocarray(h, stride);
 
         if (converted_bits == NULL)
             return FALSE;
@@ -966,7 +966,7 @@ glamor_upload_sub_pixmap_to_texture(PixmapPtr pixmap, int x, int y, int w,
         void *sub_bits;
         int i, j;
 
-        sub_bits = malloc(h * stride);
+        sub_bits = xallocarray(h, stride);
         if (sub_bits == NULL)
             return FALSE;
         box.x1 = x;
diff --git a/glamor/glamor_prepare.c b/glamor/glamor_prepare.c
index 83ba7f1..9bfc557 100644
--- a/glamor/glamor_prepare.c
+++ b/glamor/glamor_prepare.c
@@ -91,8 +91,8 @@ glamor_prep_pixmap_box(PixmapPtr pixmap, glamor_access_t access, BoxPtr box)
                          pixmap->devKind * pixmap->drawable.height, NULL,
                          gl_usage);
         } else {
-            pixmap->devPrivate.ptr = malloc(pixmap->devKind *
-                                            pixmap->drawable.height);
+            pixmap->devPrivate.ptr = xallocarray(pixmap->devKind,
+                                                 pixmap->drawable.height);
             if (!pixmap->devPrivate.ptr)
                 return FALSE;
         }
diff --git a/glamor/glamor_utils.c b/glamor/glamor_utils.c
index f068960..d3e6fd3 100644
--- a/glamor/glamor_utils.c
+++ b/glamor/glamor_utils.c
@@ -31,7 +31,7 @@ glamor_solid_boxes(PixmapPtr pixmap,
     xRectangle *rect;
     int n;
 
-    rect = malloc(nbox * sizeof (xRectangle));
+    rect = xallocarray(nbox, sizeof(xRectangle));
     if (!rect)
         return;
     for (n = 0; n < nbox; n++) {
diff --git a/glx/single2.c b/glx/single2.c
index a6ea614..acc66ac 100644
--- a/glx/single2.c
+++ b/glx/single2.c
@@ -62,9 +62,8 @@ __glXDisp_FeedbackBuffer(__GLXclientState * cl, GLbyte * pc)
     size = *(GLsizei *) (pc + 0);
     type = *(GLenum *) (pc + 4);
     if (cx->feedbackBufSize < size) {
-        cx->feedbackBuf = (GLfloat *) realloc(cx->feedbackBuf,
-                                              (size_t) size
-                                              * __GLX_SIZE_FLOAT32);
+        cx->feedbackBuf = reallocarray(cx->feedbackBuf,
+                                       (size_t) size, __GLX_SIZE_FLOAT32);
         if (!cx->feedbackBuf) {
             cl->client->errorValue = size;
             return BadAlloc;
@@ -94,8 +93,8 @@ __glXDisp_SelectBuffer(__GLXclientState * cl, GLbyte * pc)
     pc += __GLX_SINGLE_HDR_SIZE;
     size = *(GLsizei *) (pc + 0);
     if (cx->selectBufSize < size) {
-        cx->selectBuf = (GLuint *) realloc(cx->selectBuf,
-                                           (size_t) size * __GLX_SIZE_CARD32);
+        cx->selectBuf = reallocarray(cx->selectBuf,
+                                     (size_t) size, __GLX_SIZE_CARD32);
         if (!cx->selectBuf) {
             cl->client->errorValue = size;
             return BadAlloc;
diff --git a/glx/single2swap.c b/glx/single2swap.c
index 5349069..d5bb1c0 100644
--- a/glx/single2swap.c
+++ b/glx/single2swap.c
@@ -63,9 +63,8 @@ __glXDispSwap_FeedbackBuffer(__GLXclientState * cl, GLbyte * pc)
     size = *(GLsizei *) (pc + 0);
     type = *(GLenum *) (pc + 4);
     if (cx->feedbackBufSize < size) {
-        cx->feedbackBuf = (GLfloat *) realloc(cx->feedbackBuf,
-                                              (size_t) size
-                                              * __GLX_SIZE_FLOAT32);
+        cx->feedbackBuf = reallocarray(cx->feedbackBuf,
+                                       (size_t) size, __GLX_SIZE_FLOAT32);
         if (!cx->feedbackBuf) {
             cl->client->errorValue = size;
             return BadAlloc;
@@ -99,8 +98,8 @@ __glXDispSwap_SelectBuffer(__GLXclientState * cl, GLbyte * pc)
     __GLX_SWAP_INT(pc + 0);
     size = *(GLsizei *) (pc + 0);
     if (cx->selectBufSize < size) {
-        cx->selectBuf = (GLuint *) realloc(cx->selectBuf,
-                                           (size_t) size * __GLX_SIZE_CARD32);
+        cx->selectBuf = reallocarray(cx->selectBuf,
+                                     (size_t) size, __GLX_SIZE_CARD32);
         if (!cx->selectBuf) {
             cl->client->errorValue = size;
             return BadAlloc;
commit 7ac280287491fe06127d9fefc504217e21c780e6
Author: Alan Coopersmith <alan.coopersmith at oracle.com>
Date:   Sat Mar 21 14:58:50 2015 -0700

    Convert mi & miext to new *allocarray functions
    
    v2: remove now useless parentheses
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Reviewed-by: Matt Turner <mattst88 at gmail.com>

diff --git a/mi/miarc.c b/mi/miarc.c
index e8bc87e..5e854b3 100644
--- a/mi/miarc.c
+++ b/mi/miarc.c
@@ -1187,9 +1187,9 @@ miFillSppPoly(DrawablePtr dst, GCPtr pgc, int count,    /* number of points */
     y = ymax - ymin + 1;
     if ((count < 3) || (y <= 0))
         return;
-    ptsOut = FirstPoint = malloc(sizeof(DDXPointRec) * y);
-    width = FirstWidth = malloc(sizeof(int) * y);
-    Marked = malloc(sizeof(int) * count);
+    ptsOut = FirstPoint = xallocarray(y, sizeof(DDXPointRec));
+    width = FirstWidth = xallocarray(y, sizeof(int));
+    Marked = xallocarray(count, sizeof(int));
 
     if (!ptsOut || !width || !Marked) {
         free(Marked);
@@ -1679,8 +1679,7 @@ miGetArcPts(SppArcPtr parc,     /* points to an arc */
     count++;
 
     cdt = 2 * miDcos(dt);
-    if (!(poly = (SppPointPtr) realloc((void *) *ppPts,
-                                       (cpt + count) * sizeof(SppPointRec))))
+    if (!(poly = reallocarray(*ppPts, cpt + count, sizeof(SppPointRec))))
         return 0;
     *ppPts = poly;
 
@@ -1737,7 +1736,7 @@ addCap(miArcCapPtr * capsp, int *ncapsp, int *sizep, int end, int arcIndex)
 
     if (*ncapsp == *sizep) {
         newsize = *sizep + ADD_REALLOC_STEP;
-        cap = (miArcCapPtr) realloc(*capsp, newsize * sizeof(**capsp));
+        cap = reallocarray(*capsp, newsize, sizeof(**capsp));
         if (!cap)
             return;
         *sizep = newsize;
@@ -1760,7 +1759,7 @@ addJoin(miArcJoinPtr * joinsp,
 
     if (*njoinsp == *sizep) {
         newsize = *sizep + ADD_REALLOC_STEP;
-        join = (miArcJoinPtr) realloc(*joinsp, newsize * sizeof(**joinsp));
+        join = reallocarray(*joinsp, newsize, sizeof(**joinsp));
         if (!join)
             return;
         *sizep = newsize;
@@ -1784,7 +1783,7 @@ addArc(miArcDataPtr * arcsp, int *narcsp, int *sizep, xArc * xarc)
 
     if (*narcsp == *sizep) {
         newsize = *sizep + ADD_REALLOC_STEP;
-        arc = (miArcDataPtr) realloc(*arcsp, newsize * sizeof(**arcsp));
+        arc = reallocarray(*arcsp, newsize, sizeof(**arcsp));
         if (!arc)
             return NULL;
         *sizep = newsize;
@@ -1890,10 +1889,10 @@ miComputeArcs(xArc * parcs, int narcs, GCPtr pGC)
     isDoubleDash = (pGC->lineStyle == LineDoubleDash);
     dashOffset = pGC->dashOffset;
 
-    data = malloc(narcs * sizeof(struct arcData));
+    data = xallocarray(narcs, sizeof(struct arcData));
     if (!data)
         return NULL;
-    arcs = malloc(sizeof(*arcs) * (isDoubleDash ? 2 : 1));
+    arcs = xallocarray(isDoubleDash ? 2 : 1, sizeof(*arcs));
     if (!arcs) {
         free(data);
         return NULL;
@@ -3081,8 +3080,8 @@ fillSpans(DrawablePtr pDrawable, GCPtr pGC)
 
     if (nspans == 0)
         return;
-    xSpan = xSpans = malloc(nspans * sizeof(DDXPointRec));
-    xWidth = xWidths = malloc(nspans * sizeof(int));
+    xSpan = xSpans = xallocarray(nspans, sizeof(DDXPointRec));
+    xWidth = xWidths = xallocarray(nspans, sizeof(int));
     if (xSpans && xWidths) {
         i = 0;
         f = finalSpans;
@@ -3136,7 +3135,7 @@ realFindSpan(int y)
         else
             change = SPAN_REALLOC;
         newSize = finalSize + change;
-        newSpans = malloc(newSize * sizeof(struct finalSpan *));
+        newSpans = xallocarray(newSize, sizeof(struct finalSpan *));
         if (!newSpans)
             return NULL;
         newMiny = finalMiny;
diff --git a/mi/mibitblt.c b/mi/mibitblt.c
index 7243963..28296a4 100644
--- a/mi/mibitblt.c
+++ b/mi/mibitblt.c
@@ -136,11 +136,11 @@ miCopyArea(DrawablePtr pSrcDrawable,
         dsty += pDstDrawable->y;
     }
 
-    pptFirst = ppt = malloc(heightSrc * sizeof(DDXPointRec));
-    pwidthFirst = pwidth = malloc(heightSrc * sizeof(unsigned int));
+    pptFirst = ppt = xallocarray(heightSrc, sizeof(DDXPointRec));
+    pwidthFirst = pwidth = xallocarray(heightSrc, sizeof(unsigned int));
     numRects = RegionNumRects(prgnSrcClip);
     boxes = RegionRects(prgnSrcClip);
-    ordering = malloc(numRects * sizeof(unsigned int));
+    ordering = xallocarray(numRects, sizeof(unsigned int));
     if (!pptFirst || !pwidthFirst || !ordering) {
         free(ordering);
         free(pwidthFirst);
@@ -221,7 +221,7 @@ miCopyArea(DrawablePtr pSrcDrawable,
             ppt++->y = y++;
             *pwidth++ = width;
         }
-        pbits = malloc(height * PixmapBytePad(width, pSrcDrawable->depth));
+        pbits = xallocarray(height, PixmapBytePad(width, pSrcDrawable->depth));
         if (pbits) {
             (*pSrcDrawable->pScreen->GetSpans) (pSrcDrawable, width, pptFirst,
                                                 (int *) pwidthFirst, height,
@@ -398,8 +398,8 @@ miOpqStipDrawable(DrawablePtr pDraw, GCPtr pGC, RegionPtr prgnSrc,
     ChangeGC(NullClient, pGCT, GCBackground, gcv);
     ValidateGC((DrawablePtr) pPixmap, pGCT);
     miClearDrawable((DrawablePtr) pPixmap, pGCT);
-    ppt = pptFirst = malloc(h * sizeof(DDXPointRec));
-    pwidth = pwidthFirst = malloc(h * sizeof(int));
+    ppt = pptFirst = xallocarray(h, sizeof(DDXPointRec));
+    pwidth = pwidthFirst = xallocarray(h, sizeof(int));
     if (!pptFirst || !pwidthFirst) {
         free(pwidthFirst);
         free(pptFirst);
@@ -746,8 +746,8 @@ miPutImage(DrawablePtr pDraw, GCPtr pGC, int depth,
         break;
 
     case ZPixmap:
-        ppt = pptFirst = malloc(h * sizeof(DDXPointRec));
-        pwidth = pwidthFirst = malloc(h * sizeof(int));
+        ppt = pptFirst = xallocarray(h, sizeof(DDXPointRec));
+        pwidth = pwidthFirst = xallocarray(h, sizeof(int));
         if (!pptFirst || !pwidthFirst) {
             free(pwidthFirst);
             free(pptFirst);
diff --git a/mi/micmap.c b/mi/micmap.c
index 1aeb359..5743adb 100644
--- a/mi/micmap.c
+++ b/mi/micmap.c
@@ -458,9 +458,9 @@ miInitVisuals(VisualPtr * visualp, DepthPtr * depthp, int *nvisualp,
         ndepth++;
         nvisual += visuals->count;
     }
-    depth = malloc(ndepth * sizeof(DepthRec));
-    visual = malloc(nvisual * sizeof(VisualRec));
-    preferredCVCs = malloc(ndepth * sizeof(int));
+    depth = xallocarray(ndepth, sizeof(DepthRec));
+    visual = xallocarray(nvisual, sizeof(VisualRec));
+    preferredCVCs = xallocarray(ndepth, sizeof(int));
     if (!depth || !visual || !preferredCVCs) {
         free(depth);
         free(visual);
@@ -481,7 +481,7 @@ miInitVisuals(VisualPtr * visualp, DepthPtr * depthp, int *nvisualp,
         prefp++;
         vid = NULL;
         if (nvtype) {
-            vid = malloc(nvtype * sizeof(VisualID));
+            vid = xallocarray(nvtype, sizeof(VisualID));
             if (!vid) {
                 free(depth);
                 free(visual);
diff --git a/mi/micopy.c b/mi/micopy.c
index 2409c78..12cdad4 100644
--- a/mi/micopy.c
+++ b/mi/micopy.c
@@ -62,7 +62,7 @@ miCopyRegion(DrawablePtr pSrcDrawable,
 
         if (nbox > 1) {
             /* keep ordering in each band, reverse order of bands */
-            pboxNew1 = (BoxPtr) malloc(sizeof(BoxRec) * nbox);
+            pboxNew1 = xallocarray(nbox, sizeof(BoxRec));
             if (!pboxNew1)
                 return;
             pboxBase = pboxNext = pbox + nbox - 1;
@@ -93,7 +93,7 @@ miCopyRegion(DrawablePtr pSrcDrawable,
 
         if (nbox > 1) {
             /* reverse order of rects in each band */
-            pboxNew2 = (BoxPtr) malloc(sizeof(BoxRec) * nbox);
+            pboxNew2 = xallocarray(nbox, sizeof(BoxRec));
             if (!pboxNew2) {
                 free(pboxNew1);
                 return;
diff --git a/mi/miexpose.c b/mi/miexpose.c
index fc4dbc0..c4118f1 100644
--- a/mi/miexpose.c
+++ b/mi/miexpose.c
@@ -535,7 +535,7 @@ miPaintWindow(WindowPtr pWin, RegionPtr prgn, int what)
         gcmask |= GCFillStyle | GCTile | GCTileStipXOrigin | GCTileStipYOrigin;
     }
 
-    prect = malloc(RegionNumRects(prgn) * sizeof(xRectangle));
+    prect = xallocarray(RegionNumRects(prgn), sizeof(xRectangle));
     if (!prect)
         return;
 
diff --git a/mi/mifillrct.c b/mi/mifillrct.c
index 28f2322..eb98a77 100644
--- a/mi/mifillrct.c
+++ b/mi/mifillrct.c
@@ -100,8 +100,8 @@ miPolyFillRect(DrawablePtr pDrawable, GCPtr pGC, int nrectFill, /* number of rec
             maxheight = max(maxheight, prect->height);
     }
 
-    pptFirst = malloc(maxheight * sizeof(DDXPointRec));
-    pwFirst = malloc(maxheight * sizeof(int));
+    pptFirst = xallocarray(maxheight, sizeof(DDXPointRec));
+    pwFirst = xallocarray(maxheight, sizeof(int));
     if (!pptFirst || !pwFirst) {
         free(pwFirst);
         free(pptFirst);
diff --git a/mi/miglblt.c b/mi/miglblt.c
index 0183e99..e9d3a1a 100644
--- a/mi/miglblt.c
+++ b/mi/miglblt.c
@@ -131,7 +131,7 @@ miPolyGlyphBlt(DrawablePtr pDrawable, GC * pGC, int x, int y, unsigned int nglyp
              gcvals);
 
     nbyLine = BitmapBytePad(width);
-    pbits = malloc(height * nbyLine);
+    pbits = xallocarray(height, nbyLine);
     if (!pbits) {
         (*pDrawable->pScreen->DestroyPixmap) (pPixmap);
         FreeScratchGC(pGCtmp);
diff --git a/mi/miinitext.c b/mi/miinitext.c
index 086d2c3..5fc44e3 100644
--- a/mi/miinitext.c
+++ b/mi/miinitext.c
@@ -352,8 +352,8 @@ NewExtensionModuleList(int size)
         numExtensionModules = 0;
 
     n = numExtensionModules + size;
-    ExtensionModuleList = realloc(ExtensionModuleList,
-                                  n * sizeof(ExtensionModule));
+    ExtensionModuleList = reallocarray(ExtensionModuleList, n,
+                                       sizeof(ExtensionModule));
     if (ExtensionModuleList == NULL) {
         ExtensionModuleList = save;
         return NULL;
diff --git a/mi/mipoly.c b/mi/mipoly.c
index a332376..a97e2bb 100644
--- a/mi/mipoly.c
+++ b/mi/mipoly.c
@@ -412,8 +412,8 @@ miFillConvexPoly(DrawablePtr dst, GCPtr pgc, int count, DDXPointPtr ptsIn)
     dy = ymax - ymin + 1;
     if ((count < 3) || (dy < 0))
         return TRUE;
-    ptsOut = FirstPoint = malloc(sizeof(DDXPointRec) * dy);
-    width = FirstWidth = malloc(sizeof(int) * dy);
+    ptsOut = FirstPoint = xallocarray(dy, sizeof(DDXPointRec));
+    width = FirstWidth = xallocarray(dy, sizeof(int));
     if (!FirstPoint || !FirstWidth) {
         free(FirstWidth);
         free(FirstPoint);
diff --git a/mi/mipolypnt.c b/mi/mipolypnt.c
index 4fa521d..1c4150d 100644
--- a/mi/mipolypnt.c
+++ b/mi/mipolypnt.c
@@ -67,7 +67,7 @@ miPolyPoint(DrawablePtr pDrawable, GCPtr pGC, int mode, /* Origin or Previous */
     int i;
     xPoint *ppt;
 
-    if (!(pwidthInit = malloc(npt * sizeof(int))))
+    if (!(pwidthInit = xallocarray(npt, sizeof(int))))
         return;
 
     /* make pointlist origin relative */
diff --git a/mi/mipolyrect.c b/mi/mipolyrect.c
index 8308225..7ebf9db 100644
--- a/mi/mipolyrect.c
+++ b/mi/mipolyrect.c
@@ -88,7 +88,7 @@ miPolyRectangle(DrawablePtr pDraw, GCPtr pGC, int nrects, xRectangle *pRects)
         offset2 = pGC->lineWidth;
         offset1 = offset2 >> 1;
         offset3 = offset2 - offset1;
-        tmp = malloc(ntmp * sizeof(xRectangle));
+        tmp = xallocarray(ntmp, sizeof(xRectangle));
         if (!tmp)
             return;
         t = tmp;
diff --git a/mi/miwideline.c b/mi/miwideline.c
index 452d74f..3baa99b 100644
--- a/mi/miwideline.c
+++ b/mi/miwideline.c
@@ -189,19 +189,16 @@ miSubtractSpans(SpanGroup * spanGroup, Spans * sub)
                                 int *newwid;
 
 #define EXTRA 8
-                                newPt =
-                                    (DDXPointPtr) realloc(spans->points,
-                                                          (spans->count +
-                                                           EXTRA) *
-                                                          sizeof(DDXPointRec));
+                                newPt = reallocarray(spans->points,
+                                                     spans->count + EXTRA,
+                                                     sizeof(DDXPointRec));
                                 if (!newPt)
                                     break;
                                 spansPt = newPt + (spansPt - spans->points);
                                 spans->points = newPt;
-                                newwid =
-                                    (int *) realloc(spans->widths,
-                                                    (spans->count +
-                                                     EXTRA) * sizeof(int));
+                                newwid = reallocarray(spans->widths,
+                                                      spans->count + EXTRA,
+                                                      sizeof(int));
                                 if (!newwid)
                                     break;
                                 spansWid = newwid + (spansWid - spans->widths);
@@ -240,8 +237,8 @@ miAppendSpans(SpanGroup * spanGroup, SpanGroup * otherGroup, Spans * spans)
     if (spansCount > 0) {
         if (spanGroup->size == spanGroup->count) {
             spanGroup->size = (spanGroup->size + 8) * 2;
-            spanGroup->group = (Spans *)
-                realloc(spanGroup->group, sizeof(Spans) * spanGroup->size);
+            spanGroup->group =
+                reallocarray(spanGroup->group, sizeof(Spans), spanGroup->size);
         }
 
         spanGroup->group[spanGroup->count] = *spans;
@@ -456,8 +453,8 @@ miFillUniqueSpanGroup(DrawablePtr pDraw, GCPtr pGC, SpanGroup * spanGroup)
         ylength = spanGroup->ymax - ymin + 1;
 
         /* Allocate Spans for y buckets */
-        yspans = malloc(ylength * sizeof(Spans));
-        ysizes = malloc(ylength * sizeof(int));
+        yspans = xallocarray(ylength, sizeof(Spans));
+        ysizes = xallocarray(ylength, sizeof(int));
 
         if (!yspans || !ysizes) {
             free(yspans);
@@ -491,12 +488,11 @@ miFillUniqueSpanGroup(DrawablePtr pDraw, GCPtr pGC, SpanGroup * spanGroup)
                         int *newwidths;
 
                         ysizes[index] = (ysizes[index] + 8) * 2;
-                        newpoints = (DDXPointPtr) realloc(newspans->points,
-                                                          ysizes[index] *
-                                                          sizeof(DDXPointRec));
-                        newwidths =
-                            (int *) realloc(newspans->widths,
-                                            ysizes[index] * sizeof(int));
+                        newpoints = reallocarray(newspans->points,
+                                                 ysizes[index],
+                                                 sizeof(DDXPointRec));
+                        newwidths = reallocarray(newspans->widths,
+                                                 ysizes[index], sizeof(int));
                         if (!newpoints || !newwidths) {
                             for (i = 0; i < ylength; i++) {
                                 free(yspans[i].points);
@@ -525,8 +521,8 @@ miFillUniqueSpanGroup(DrawablePtr pDraw, GCPtr pGC, SpanGroup * spanGroup)
         }                       /* for i thorough Spans */
 
         /* Now sort by x and uniquify each bucket into the final array */
-        points = malloc(count * sizeof(DDXPointRec));
-        widths = malloc(count * sizeof(int));
+        points = xallocarray(count, sizeof(DDXPointRec));
+        widths = xallocarray(count, sizeof(int));
         if (!points || !widths) {
             for (i = 0; i < ylength; i++) {
                 free(yspans[i].points);
@@ -573,10 +569,10 @@ miFillUniqueSpanGroup(DrawablePtr pDraw, GCPtr pGC, SpanGroup * spanGroup)
 static Bool
 InitSpans(Spans * spans, size_t nspans)
 {
-    spans->points = malloc(nspans * sizeof(*spans->points));
+    spans->points = xallocarray(nspans, sizeof(*spans->points));
     if (!spans->points)
         return FALSE;
-    spans->widths = malloc(nspans * sizeof(*spans->widths));
+    spans->widths = xallocarray(nspans, sizeof(*spans->widths));
     if (!spans->widths) {
         free(spans->points);
         return FALSE;
diff --git a/mi/miwindow.c b/mi/miwindow.c
index a1af3a7..7574239 100644
--- a/mi/miwindow.c
+++ b/mi/miwindow.c
@@ -777,9 +777,9 @@ miSpriteTrace(SpritePtr pSprite, int x, int y)
             ) {
             if (pSprite->spriteTraceGood >= pSprite->spriteTraceSize) {
                 pSprite->spriteTraceSize += 10;
-                pSprite->spriteTrace = realloc(pSprite->spriteTrace,
-                                               pSprite->spriteTraceSize *
-                                               sizeof(WindowPtr));
+                pSprite->spriteTrace = reallocarray(pSprite->spriteTrace,
+                                                    pSprite->spriteTraceSize,
+                                                    sizeof(WindowPtr));
             }
             pSprite->spriteTrace[pSprite->spriteTraceGood++] = pWin;
             pWin = pWin->firstChild;
diff --git a/mi/mizerarc.c b/mi/mizerarc.c
index b216cf4..e1b5f0c 100644
--- a/mi/mizerarc.c
+++ b/mi/mizerarc.c
@@ -671,7 +671,7 @@ miZeroPolyArc(DrawablePtr pDraw, GCPtr pGC, int narcs, xArc * parcs)
     numPts = maxPts << 2;
     dospans = (pGC->fillStyle != FillSolid);
     if (dospans) {
-        widths = malloc(sizeof(int) * numPts);
+        widths = xallocarray(numPts, sizeof(int));
         if (!widths)
             return;
         maxw = 0;
@@ -687,7 +687,7 @@ miZeroPolyArc(DrawablePtr pDraw, GCPtr pGC, int narcs, xArc * parcs)
                    (unsigned char *) pGC->dash, (int) pGC->numInDashList,
                    &dinfo.dashOffsetInit);
     }
-    points = malloc(sizeof(DDXPointRec) * numPts);
+    points = xallocarray(numPts, sizeof(DDXPointRec));
     if (!points) {
         if (dospans) {
             free(widths);
diff --git a/mi/mizerline.c b/mi/mizerline.c
index 5a24470..2f22d23 100644
--- a/mi/mizerline.c
+++ b/mi/mizerline.c
@@ -150,8 +150,8 @@ miZeroLine(DrawablePtr pDraw, GCPtr pGC, int mode,      /* Origin or Previous */
     width = xright - xleft + 1;
     height = ybottom - ytop + 1;
     list_len = (height >= width) ? height : width;
-    pspanInit = malloc(list_len * sizeof(DDXPointRec));
-    pwidthInit = malloc(list_len * sizeof(int));
+    pspanInit = xallocarray(list_len, sizeof(DDXPointRec));
+    pwidthInit = xallocarray(list_len, sizeof(int));
     if (!pspanInit || !pwidthInit) {
         free(pspanInit);
         free(pwidthInit);
diff --git a/miext/damage/damage.c b/miext/damage/damage.c
index 6ef7f9d..ce20169 100644
--- a/miext/damage/damage.c
+++ b/miext/damage/damage.c
@@ -1293,7 +1293,7 @@ damageText(DrawablePtr pDrawable,
     if (!checkGCDamage(pDrawable, pGC))
         return;
 
-    charinfo = malloc(count * sizeof(CharInfoPtr));
+    charinfo = xallocarray(count, sizeof(CharInfoPtr));
     if (!charinfo)
         return;
 
diff --git a/miext/rootless/rootlessWindow.c b/miext/rootless/rootlessWindow.c
index a8f296a..1f78e3f 100644
--- a/miext/rootless/rootlessWindow.c
+++ b/miext/rootless/rootlessWindow.c
@@ -949,7 +949,7 @@ StartFrameResize(WindowPtr pWin, Bool gravity,
             copy_rect_width = copy_rect.x2 - copy_rect.x1;
             copy_rect_height = copy_rect.y2 - copy_rect.y1;
             copy_rowbytes = ((copy_rect_width * Bpp) + 31) & ~31;
-            gResizeDeathBits = malloc(copy_rowbytes * copy_rect_height);
+            gResizeDeathBits = xallocarray(copy_rowbytes, copy_rect_height);
 
             if (copy_rect_width * copy_rect_height >
                 rootless_CopyBytes_threshold &&
@@ -998,7 +998,7 @@ StartFrameResize(WindowPtr pWin, Bool gravity,
 
         RootlessStartDrawing(pWin);
 
-        gResizeDeathBits = malloc(winRec->bytesPerRow * winRec->height);
+        gResizeDeathBits = xallocarray(winRec->bytesPerRow, winRec->height);
 
         memcpy(gResizeDeathBits, winRec->pixelData,
                winRec->bytesPerRow * winRec->height);
diff --git a/miext/shadow/shalloc.c b/miext/shadow/shalloc.c
index e555135..6a79085 100644
--- a/miext/shadow/shalloc.c
+++ b/miext/shadow/shalloc.c
@@ -44,6 +44,6 @@ shadowAlloc(int width, int height, int bpp)
 
     /* Cant use PixmapBytePad -- the structure is probably not initialized yet */
     stride = BitmapBytePad(width * bpp);
-    fb = malloc(stride * height);
+    fb = xallocarray(stride, height);
     return fb;
 }
commit 70f4a0e6bd18055cc9cb6685253bf5e07b125657
Author: Alan Coopersmith <alan.coopersmith at oracle.com>
Date:   Sat Mar 21 14:40:39 2015 -0700

    Convert exa & fb to new *allocarray functions
    
    v2: fixup whitespace
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Reviewed-by: Matt Turner <mattst88 at gmail.com>
    Reviewed-by: Michel Dänzer <michel.daenzer at amd.com>

diff --git a/exa/exa_accel.c b/exa/exa_accel.c
index 5aa7d10..b26d5c8 100644
--- a/exa/exa_accel.c
+++ b/exa/exa_accel.c
@@ -386,7 +386,7 @@ exaHWCopyNtoN(DrawablePtr pSrcDrawable,
     exaGetDrawableDeltas(pSrcDrawable, pSrcPixmap, &src_off_x, &src_off_y);
     exaGetDrawableDeltas(pDstDrawable, pDstPixmap, &dst_off_x, &dst_off_y);
 
-    rects = malloc(nbox * sizeof(xRectangle));
+    rects = xallocarray(nbox, sizeof(xRectangle));
 
     if (rects) {
         int i;
@@ -626,7 +626,7 @@ exaPolyPoint(DrawablePtr pDrawable, GCPtr pGC, int mode, int npt,
         return;
     }
 
-    prect = malloc(sizeof(xRectangle) * npt);
+    prect = xallocarray(npt, sizeof(xRectangle));
     for (i = 0; i < npt; i++) {
         prect[i].x = ppt[i].x;
         prect[i].y = ppt[i].y;
@@ -667,7 +667,7 @@ exaPolylines(DrawablePtr pDrawable, GCPtr pGC, int mode, int npt,
         return;
     }
 
-    prect = malloc(sizeof(xRectangle) * (npt - 1));
+    prect = xallocarray(npt - 1, sizeof(xRectangle));
     x1 = ppt[0].x;
     y1 = ppt[0].y;
     /* If we have any non-horizontal/vertical, fall back. */
@@ -738,7 +738,7 @@ exaPolySegment(DrawablePtr pDrawable, GCPtr pGC, int nseg, xSegment * pSeg)
         }
     }
 
-    prect = malloc(sizeof(xRectangle) * nseg);
+    prect = xallocarray(nseg, sizeof(xRectangle));
     for (i = 0; i < nseg; i++) {
         if (pSeg[i].x1 < pSeg[i].x2) {
             prect[i].x = pSeg[i].x1;
diff --git a/exa/exa_glyphs.c b/exa/exa_glyphs.c
index 41f3694..cf21ea9 100644
--- a/exa/exa_glyphs.c
+++ b/exa/exa_glyphs.c
@@ -211,8 +211,8 @@ exaRealizeGlyphCaches(ScreenPtr pScreen, unsigned int format)
 
         cache->picture = pPicture;
         cache->picture->refcnt++;
-        cache->hashEntries = malloc(sizeof(int) * cache->hashSize);
-        cache->glyphs = malloc(sizeof(ExaCachedGlyphRec) * cache->size);
+        cache->hashEntries = xallocarray(cache->hashSize, sizeof(int));
+        cache->glyphs = xallocarray(cache->size, sizeof(ExaCachedGlyphRec));
         cache->glyphCount = 0;
 
         if (!cache->hashEntries || !cache->glyphs)
diff --git a/exa/exa_migration_mixed.c b/exa/exa_migration_mixed.c
index cf66327..7d3fca7 100644
--- a/exa/exa_migration_mixed.c
+++ b/exa/exa_migration_mixed.c
@@ -205,8 +205,8 @@ exaPrepareAccessReg_mixed(PixmapPtr pPixmap, int index, RegionPtr pReg)
 
         /* Do we need to allocate our system buffer? */
         if (!pExaPixmap->sys_ptr) {
-            pExaPixmap->sys_ptr = malloc(pExaPixmap->sys_pitch *
-                                         pPixmap->drawable.height);
+            pExaPixmap->sys_ptr = xallocarray(pExaPixmap->sys_pitch,
+                                              pPixmap->drawable.height);
             if (!pExaPixmap->sys_ptr)
                 FatalError("EXA: malloc failed for size %d bytes\n",
                            pExaPixmap->sys_pitch * pPixmap->drawable.height);
diff --git a/fb/fbcopy.c b/fb/fbcopy.c
index 5bbabc3..6af10cc 100644
--- a/fb/fbcopy.c
+++ b/fb/fbcopy.c
@@ -194,7 +194,7 @@ fbCopyNto1(DrawablePtr pSrcDrawable,
             height = pbox->y2 - pbox->y1;
 
             tmpStride = ((width + FB_STIP_MASK) >> FB_STIP_SHIFT);
-            tmp = malloc(tmpStride * height * sizeof(FbStip));
+            tmp = xallocarray(tmpStride * height, sizeof(FbStip));
             if (!tmp)
                 return;
 
diff --git a/fb/fbpict.c b/fb/fbpict.c
index c8378ad..021f178 100644
--- a/fb/fbpict.c
+++ b/fb/fbpict.c
@@ -124,7 +124,7 @@ fbGlyphs(CARD8 op,
     pixman_glyph_cache_freeze (glyphCache);
 
     if (n_glyphs > N_STACK_GLYPHS) {
-	if (!(pglyphs = malloc (n_glyphs * sizeof (pixman_glyph_t))))
+	if (!(pglyphs = xallocarray(n_glyphs, sizeof(pixman_glyph_t))))
 	    goto out;
     }
 
commit 4fe6b03b97ab8dbb32e4908e46be350d7f7d336f
Author: Alan Coopersmith <alan.coopersmith at oracle.com>
Date:   Sat Mar 21 14:36:07 2015 -0700

    Convert XKB to new *allocarray functions
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Reviewed-by: Matt Turner <mattst88 at gmail.com>
    Acked-by: Daniel Stone <daniels at collabora.com>

diff --git a/xkb/XKBAlloc.c b/xkb/XKBAlloc.c
index 78c9837..18557b8 100644
--- a/xkb/XKBAlloc.c
+++ b/xkb/XKBAlloc.c
@@ -56,8 +56,8 @@ XkbAllocCompatMap(XkbDescPtr xkb, unsigned which, unsigned nSI)
         if (compat->sym_interpret == NULL)
             compat->num_si = 0;
         prev_interpret = compat->sym_interpret;
-        compat->sym_interpret = realloc(compat->sym_interpret,
-                                        nSI * sizeof(XkbSymInterpretRec));
+        compat->sym_interpret = reallocarray(compat->sym_interpret,
+                                             nSI, sizeof(XkbSymInterpretRec));
         if (compat->sym_interpret == NULL) {
             free(prev_interpret);
             compat->size_si = compat->num_si = 0;
@@ -159,9 +159,9 @@ XkbAllocNames(XkbDescPtr xkb, unsigned which, int nTotalRG, int nTotalAliases)
         else if (nTotalAliases > names->num_key_aliases) {
             XkbKeyAliasRec *prev_aliases = names->key_aliases;
 
-            names->key_aliases = realloc(names->key_aliases,
-                                         nTotalAliases *
-                                         sizeof(XkbKeyAliasRec));
+            names->key_aliases = reallocarray(names->key_aliases,
+                                              nTotalAliases,
+                                              sizeof(XkbKeyAliasRec));
             if (names->key_aliases != NULL) {
                 memset(&names->key_aliases[names->num_key_aliases], 0,
                        (nTotalAliases -
@@ -184,8 +184,8 @@ XkbAllocNames(XkbDescPtr xkb, unsigned which, int nTotalRG, int nTotalAliases)
         else if (nTotalRG > names->num_rg) {
             Atom *prev_radio_groups = names->radio_groups;
 
-            names->radio_groups = realloc(names->radio_groups,
-                                          nTotalRG * sizeof(Atom));
+            names->radio_groups = reallocarray(names->radio_groups,
+                                               nTotalRG, sizeof(Atom));
             if (names->radio_groups != NULL) {
                 memset(&names->radio_groups[names->num_rg], 0,
                        (nTotalRG - names->num_rg) * sizeof(Atom));
diff --git a/xkb/XKBGAlloc.c b/xkb/XKBGAlloc.c
index 25917d3..e9f55fa 100644
--- a/xkb/XKBGAlloc.c
+++ b/xkb/XKBGAlloc.c
@@ -409,7 +409,7 @@ XkbGeomRealloc(void **buffer, int szItems, int nrItems,
         return FALSE;
     /* Check if there is need to resize. */
     if (nrItems != szItems)
-        if (!(items = realloc(items, nrItems * itemSize)))
+        if (!(items = reallocarray(items, nrItems, itemSize)))
             return FALSE;
     /* Clear specified items to zero. */
     switch (clearance) {
diff --git a/xkb/XKBMAlloc.c b/xkb/XKBMAlloc.c
index 37ed1a7..dbc1389 100644
--- a/xkb/XKBMAlloc.c
+++ b/xkb/XKBMAlloc.c
@@ -80,7 +80,7 @@ XkbAllocClientMap(XkbDescPtr xkb, unsigned which, unsigned nTotalTypes)
             XkbKeyTypeRec *prev_types = map->types;
 
             map->types =
-                realloc(map->types, nTotalTypes * sizeof(XkbKeyTypeRec));
+                reallocarray(map->types, nTotalTypes, sizeof(XkbKeyTypeRec));
             if (map->types == NULL) {
                 free(prev_types);
                 map->num_types = map->size_types = 0;
@@ -177,7 +177,7 @@ XkbAllocServerMap(XkbDescPtr xkb, unsigned which, unsigned nNewActions)
             XkbAction *prev_acts = map->acts;
 
             need = map->num_acts + nNewActions;
-            map->acts = realloc(map->acts, need * sizeof(XkbAction));
+            map->acts = reallocarray(map->acts, need, sizeof(XkbAction));
             if (map->acts == NULL) {
                 free(prev_acts);
                 map->num_acts = map->size_acts = 0;
@@ -309,7 +309,7 @@ XkbResizeKeyType(XkbDescPtr xkb,
 
         if ((map_count > type->map_count) || (type->map == NULL))
             type->map =
-                realloc(type->map, map_count * sizeof(XkbKTMapEntryRec));
+                reallocarray(type->map, map_count, sizeof(XkbKTMapEntryRec));
         if (!type->map) {
             free(prev_map);
             return BadAlloc;
@@ -318,8 +318,8 @@ XkbResizeKeyType(XkbDescPtr xkb,
             XkbModsRec *prev_preserve = type->preserve;
 
             if ((map_count > type->map_count) || (type->preserve == NULL)) {
-                type->preserve = realloc(type->preserve,
-                                         map_count * sizeof(XkbModsRec));
+                type->preserve = reallocarray(type->preserve,
+                                              map_count, sizeof(XkbModsRec));
             }
             if (!type->preserve) {
                 free(prev_preserve);
@@ -336,8 +336,8 @@ XkbResizeKeyType(XkbDescPtr xkb,
     if ((new_num_lvls > type->num_levels) || (type->level_names == NULL)) {
         Atom *prev_level_names = type->level_names;
 
-        type->level_names = realloc(type->level_names,
-                                    new_num_lvls * sizeof(Atom));
+        type->level_names = reallocarray(type->level_names,
+                                         new_num_lvls, sizeof(Atom));
         if (!type->level_names) {
             free(prev_level_names);
             return BadAlloc;
@@ -659,9 +659,9 @@ XkbChangeKeycodeRange(XkbDescPtr xkb,
             if (xkb->map->key_sym_map) {
                 XkbSymMapRec *prev_key_sym_map = xkb->map->key_sym_map;
 
-                xkb->map->key_sym_map = realloc(xkb->map->key_sym_map,
-                                                (maxKC +
-                                                 1) * sizeof(XkbSymMapRec));
+                xkb->map->key_sym_map = reallocarray(xkb->map->key_sym_map,
+                                                     maxKC + 1,
+                                                     sizeof(XkbSymMapRec));
                 if (!xkb->map->key_sym_map) {
                     free(prev_key_sym_map);
                     return BadAlloc;
@@ -680,8 +680,9 @@ XkbChangeKeycodeRange(XkbDescPtr xkb,
             if (xkb->map->modmap) {
                 unsigned char *prev_modmap = xkb->map->modmap;
 
-                xkb->map->modmap = realloc(xkb->map->modmap,
-                                           (maxKC + 1) * sizeof(unsigned char));
+                xkb->map->modmap = reallocarray(xkb->map->modmap,
+                                                maxKC + 1,
+                                                sizeof(unsigned char));
                 if (!xkb->map->modmap) {
                     free(prev_modmap);
                     return BadAlloc;
@@ -702,9 +703,9 @@ XkbChangeKeycodeRange(XkbDescPtr xkb,
             if (xkb->server->behaviors) {
                 XkbBehavior *prev_behaviors = xkb->server->behaviors;
 
-                xkb->server->behaviors = realloc(xkb->server->behaviors,
-                                                 (maxKC +
-                                                  1) * sizeof(XkbBehavior));
+                xkb->server->behaviors = reallocarray(xkb->server->behaviors,
+                                                      maxKC + 1,
+                                                      sizeof(XkbBehavior));
                 if (!xkb->server->behaviors) {
                     free(prev_behaviors);
                     return BadAlloc;
@@ -724,9 +725,9 @@ XkbChangeKeycodeRange(XkbDescPtr xkb,
             if (xkb->server->key_acts) {
                 unsigned short *prev_key_acts = xkb->server->key_acts;
 
-                xkb->server->key_acts = realloc(xkb->server->key_acts,
-                                                (maxKC +
-                                                 1) * sizeof(unsigned short));
+                xkb->server->key_acts = reallocarray(xkb->server->key_acts,
+                                                     maxKC + 1,
+                                                     sizeof(unsigned short));
                 if (!xkb->server->key_acts) {
                     free(prev_key_acts);
                     return BadAlloc;
@@ -746,9 +747,9 @@ XkbChangeKeycodeRange(XkbDescPtr xkb,
             if (xkb->server->vmodmap) {
                 unsigned short *prev_vmodmap = xkb->server->vmodmap;
 
-                xkb->server->vmodmap = realloc(xkb->server->vmodmap,
-                                               (maxKC +
-                                                1) * sizeof(unsigned short));
+                xkb->server->vmodmap = reallocarray(xkb->server->vmodmap,
+                                                    maxKC + 1,
+                                                    sizeof(unsigned short));
                 if (!xkb->server->vmodmap) {
                     free(prev_vmodmap);
                     return BadAlloc;
@@ -769,8 +770,8 @@ XkbChangeKeycodeRange(XkbDescPtr xkb,
         if ((xkb->names) && (xkb->names->keys)) {
             XkbKeyNameRec *prev_keys = xkb->names->keys;
 
-            xkb->names->keys = realloc(xkb->names->keys,
-                                       (maxKC + 1) * sizeof(XkbKeyNameRec));
+            xkb->names->keys = reallocarray(xkb->names->keys,
+                                            maxKC + 1, sizeof(XkbKeyNameRec));
             if (!xkb->names->keys) {
                 free(prev_keys);
                 return BadAlloc;
diff --git a/xkb/maprules.c b/xkb/maprules.c
index 28148d9..8e22779 100644
--- a/xkb/maprules.c
+++ b/xkb/maprules.c
@@ -89,11 +89,11 @@ InputLineAddChar(InputLine * line, int ch)
 {
     if (line->num_line >= line->sz_line) {
         if (line->line == line->buf) {
-            line->line = malloc(line->sz_line * 2);
+            line->line = xallocarray(line->sz_line, 2);
             memcpy(line->line, line->buf, line->sz_line);
         }
         else {
-            line->line = realloc((char *) line->line, line->sz_line * 2);
+            line->line = reallocarray(line->line, line->sz_line, 2);
         }
         line->sz_line *= 2;
     }
@@ -897,8 +897,8 @@ XkbRF_AddRule(XkbRF_RulesPtr rules)
     }
     else if (rules->num_rules >= rules->sz_rules) {
         rules->sz_rules *= 2;
-        rules->rules = realloc(rules->rules,
-                               rules->sz_rules * sizeof(XkbRF_RuleRec));
+        rules->rules = reallocarray(rules->rules,
+                                    rules->sz_rules, sizeof(XkbRF_RuleRec));
     }
     if (!rules->rules) {
         rules->sz_rules = rules->num_rules = 0;
@@ -919,8 +919,8 @@ XkbRF_AddGroup(XkbRF_RulesPtr rules)
     }
     else if (rules->num_groups >= rules->sz_groups) {
         rules->sz_groups *= 2;
-        rules->groups = realloc(rules->groups,
-                                rules->sz_groups * sizeof(XkbRF_GroupRec));
+        rules->groups = reallocarray(rules->groups,
+                                     rules->sz_groups, sizeof(XkbRF_GroupRec));
     }
     if (!rules->groups) {
         rules->sz_groups = rules->num_groups = 0;
diff --git a/xkb/xkb.c b/xkb/xkb.c
index f3988f9..294cdf8 100644
--- a/xkb/xkb.c
+++ b/xkb/xkb.c
@@ -2216,12 +2216,11 @@ SetKeyBehaviors(XkbSrvInfoPtr xkbi,
     }
 
     if (maxRG > (int) xkbi->nRadioGroups) {
-        int sz = maxRG * sizeof(XkbRadioGroupRec);
-
         if (xkbi->radioGroups)
-            xkbi->radioGroups = realloc(xkbi->radioGroups, sz);
+            xkbi->radioGroups = reallocarray(xkbi->radioGroups, maxRG,
+                                             sizeof(XkbRadioGroupRec));
         else
-            xkbi->radioGroups = calloc(1, sz);
+            xkbi->radioGroups = calloc(maxRG, sizeof(XkbRadioGroupRec));
         if (xkbi->radioGroups) {
             if (xkbi->nRadioGroups)
                 memset(&xkbi->radioGroups[xkbi->nRadioGroups], 0,
@@ -2700,15 +2699,16 @@ XkbSendCompatMap(ClientPtr client,
     char *data;
     int size;
 
-    size = rep->length * 4;
-    if (size > 0) {
-        data = malloc(size);
+    if (rep->length > 0) {
+        data = xallocarray(rep->length, 4);
         if (data) {
             register unsigned i, bit;
             xkbModsWireDesc *grp;
             XkbSymInterpretPtr sym = &compat->sym_interpret[rep->firstSI];
             xkbSymInterpretWireDesc *wire = (xkbSymInterpretWireDesc *) data;
 
+            size = rep->length * 4;
+
             for (i = 0; i < rep->nSI; i++, sym++, wire++) {
                 wire->sym = sym->sym;
                 wire->mods = sym->mods;
@@ -2856,9 +2856,9 @@ _XkbSetCompatMap(ClientPtr client, DeviceIntPtr dev,
 
         if ((unsigned) (req->firstSI + req->nSI) > compat->num_si) {
             compat->num_si = req->firstSI + req->nSI;
-            compat->sym_interpret = realloc(compat->sym_interpret,
-                                            compat->num_si *
-                                            sizeof(XkbSymInterpretRec));
+            compat->sym_interpret = reallocarray(compat->sym_interpret,
+                                                 compat->num_si,
+                                                 sizeof(XkbSymInterpretRec));
             if (!compat->sym_interpret) {
                 compat->num_si = 0;
                 return BadAlloc;
@@ -3086,14 +3086,15 @@ XkbSendIndicatorMap(ClientPtr client,
     register int i;
     register unsigned bit;
 
-    length = rep->length * 4;
-    if (length > 0) {
+    if (rep->length > 0) {
         CARD8 *to;
 
-        to = map = malloc(length);
+        to = map = xallocarray(rep->length, 4);
         if (map) {
             xkbIndicatorMapWireDesc *wire = (xkbIndicatorMapWireDesc *) to;
 
+            length = rep->length * 4;
+
             for (i = 0, bit = 1; i < XkbNumIndicators; i++, bit <<= 1) {
                 if (rep->which & bit) {
                     wire->flags = indicators->maps[i].flags;
@@ -4863,7 +4864,6 @@ XkbComputeGetGeometryReplySize(XkbGeometryPtr geom,
     }
     return Success;
 }
-
 static int
 XkbSendGeometry(ClientPtr client,
                 XkbGeometryPtr geom, xkbGetGeometryReply * rep, Bool freeGeom)
@@ -4872,10 +4872,10 @@ XkbSendGeometry(ClientPtr client,
     int len;
 
     if (geom != NULL) {
-        len = rep->length * 4;
-        start = desc = malloc(len);
+        start = desc = xallocarray(rep->length, 4);
         if (!start)
             return BadAlloc;
+        len = rep->length * 4;
         desc = XkbWriteCountedString(desc, geom->label_font, client->swapped);
         if (rep->nProperties > 0)
             desc = XkbWriteGeomProperties(desc, geom, client->swapped);
diff --git a/xkb/xkbActions.c b/xkb/xkbActions.c
index 2a196f1..9dd1cbd 100644
--- a/xkb/xkbActions.c
+++ b/xkb/xkbActions.c
@@ -1103,8 +1103,8 @@ _XkbNextFreeFilter(XkbSrvInfoPtr xkbi)
         }
     }
     xkbi->szFilters *= 2;
-    xkbi->filters = realloc(xkbi->filters,
-                            xkbi->szFilters * sizeof(XkbFilterRec));
+    xkbi->filters = reallocarray(xkbi->filters,
+                                 xkbi->szFilters, sizeof(XkbFilterRec));
     /* 6/21/93 (ef) -- XXX! deal with allocation failure */
     memset(&xkbi->filters[xkbi->szFilters / 2], 0,
            (xkbi->szFilters / 2) * sizeof(XkbFilterRec));
diff --git a/xkb/xkbUtils.c b/xkb/xkbUtils.c
index 6019f0f..25b5a36 100644
--- a/xkb/xkbUtils.c
+++ b/xkb/xkbUtils.c
@@ -946,8 +946,8 @@ _XkbCopyClientMap(XkbDescPtr src, XkbDescPtr dst)
 
         if (src->map->syms) {
             if (src->map->size_syms != dst->map->size_syms) {
-                tmp = realloc(dst->map->syms,
-                              src->map->size_syms * sizeof(KeySym));
+                tmp = reallocarray(dst->map->syms,
+                                   src->map->size_syms, sizeof(KeySym));
                 if (!tmp)
                     return FALSE;
                 dst->map->syms = tmp;
@@ -965,8 +965,8 @@ _XkbCopyClientMap(XkbDescPtr src, XkbDescPtr dst)
 
         if (src->map->key_sym_map) {
             if (src->max_key_code != dst->max_key_code) {
-                tmp = realloc(dst->map->key_sym_map,
-                              (src->max_key_code + 1) * sizeof(XkbSymMapRec));
+                tmp = reallocarray(dst->map->key_sym_map,
+                                   src->max_key_code + 1, sizeof(XkbSymMapRec));
                 if (!tmp)
                     return FALSE;
                 dst->map->key_sym_map = tmp;
@@ -983,8 +983,8 @@ _XkbCopyClientMap(XkbDescPtr src, XkbDescPtr dst)
             if (src->map->num_types > dst->map->size_types ||
                 !dst->map->types || !dst->map->size_types) {
                 if (dst->map->types && dst->map->size_types) {
-                    tmp = realloc(dst->map->types,
-                                  src->map->num_types * sizeof(XkbKeyTypeRec));
+                    tmp = reallocarray(dst->map->types, src->map->num_types,
+                                       sizeof(XkbKeyTypeRec));
                     if (!tmp)
                         return FALSE;
                     dst->map->types = tmp;
@@ -1020,8 +1020,8 @@ _XkbCopyClientMap(XkbDescPtr src, XkbDescPtr dst)
                     if (stype->num_levels != dtype->num_levels &&
                         dtype->num_levels && dtype->level_names &&
                         i < dst->map->num_types) {
-                        tmp = realloc(dtype->level_names,
-                                      stype->num_levels * sizeof(Atom));
+                        tmp = reallocarray(dtype->level_names,
+                                           stype->num_levels, sizeof(Atom));
                         if (!tmp)
                             continue;
                         dtype->level_names = tmp;
@@ -1053,17 +1053,17 @@ _XkbCopyClientMap(XkbDescPtr src, XkbDescPtr dst)
                         if (stype->map_count != dtype->map_count &&
                             dtype->map_count && dtype->map &&
                             i < dst->map->num_types) {
-                            tmp = realloc(dtype->map,
-                                          stype->map_count *
-                                          sizeof(XkbKTMapEntryRec));
+                            tmp = reallocarray(dtype->map,
+                                               stype->map_count,
+                                               sizeof(XkbKTMapEntryRec));
                             if (!tmp)
                                 return FALSE;
                             dtype->map = tmp;
                         }
                         else if (!dtype->map_count || !dtype->map ||
                                  i >= dst->map->num_types) {
-                            tmp = malloc(stype->map_count *
-                                         sizeof(XkbKTMapEntryRec));
+                            tmp = xallocarray(stype->map_count,
+                                              sizeof(XkbKTMapEntryRec));
                             if (!tmp)
                                 return FALSE;
                             dtype->map = tmp;
@@ -1082,16 +1082,17 @@ _XkbCopyClientMap(XkbDescPtr src, XkbDescPtr dst)
                         if (stype->map_count != dtype->map_count &&
                             dtype->map_count && dtype->preserve &&
                             i < dst->map->num_types) {
-                            tmp = realloc(dtype->preserve,
-                                          stype->map_count *
-                                          sizeof(XkbModsRec));
+                            tmp = reallocarray(dtype->preserve,
+                                               stype->map_count,
+                                               sizeof(XkbModsRec));
                             if (!tmp)
                                 return FALSE;
                             dtype->preserve = tmp;
                         }
                         else if (!dtype->preserve || !dtype->map_count ||
                                  i >= dst->map->num_types) {
-                            tmp = malloc(stype->map_count * sizeof(XkbModsRec));
+                            tmp = xallocarray(stype->map_count,
+                                              sizeof(XkbModsRec));
                             if (!tmp)
                                 return FALSE;
                             dtype->preserve = tmp;
@@ -1192,8 +1193,8 @@ _XkbCopyServerMap(XkbDescPtr src, XkbDescPtr dst)
 
         if (src->server->acts) {
             if (src->server->size_acts != dst->server->size_acts) {
-                tmp = realloc(dst->server->acts,
-                              src->server->size_acts * sizeof(XkbAction));
+                tmp = reallocarray(dst->server->acts,
+                                   src->server->size_acts, sizeof(XkbAction));
                 if (!tmp)
                     return FALSE;
                 dst->server->acts = tmp;
@@ -1210,8 +1211,8 @@ _XkbCopyServerMap(XkbDescPtr src, XkbDescPtr dst)
 
         if (src->server->key_acts) {
             if (src->max_key_code != dst->max_key_code) {
-                tmp = realloc(dst->server->key_acts,
-                              (src->max_key_code + 1) * sizeof(unsigned short));
+                tmp = reallocarray(dst->server->key_acts,
+                                   src->max_key_code + 1, sizeof(unsigned short));
                 if (!tmp)
                     return FALSE;
                 dst->server->key_acts = tmp;
@@ -1226,8 +1227,8 @@ _XkbCopyServerMap(XkbDescPtr src, XkbDescPtr dst)
 
         if (src->server->behaviors) {
             if (src->max_key_code != dst->max_key_code) {
-                tmp = realloc(dst->server->behaviors,
-                              (src->max_key_code + 1) * sizeof(XkbBehavior));
+                tmp = reallocarray(dst->server->behaviors,
+                                   src->max_key_code + 1, sizeof(XkbBehavior));
                 if (!tmp)
                     return FALSE;
                 dst->server->behaviors = tmp;
@@ -1244,8 +1245,8 @@ _XkbCopyServerMap(XkbDescPtr src, XkbDescPtr dst)
 
         if (src->server->vmodmap) {
             if (src->max_key_code != dst->max_key_code) {
-                tmp = realloc(dst->server->vmodmap,
-                              (src->max_key_code + 1) * sizeof(unsigned short));
+                tmp = reallocarray(dst->server->vmodmap,
+                                   src->max_key_code + 1, sizeof(unsigned short));
                 if (!tmp)
                     return FALSE;
                 dst->server->vmodmap = tmp;
@@ -1281,8 +1282,8 @@ _XkbCopyNames(XkbDescPtr src, XkbDescPtr dst)
 
         if (src->names->keys) {
             if (src->max_key_code != dst->max_key_code) {
-                tmp = realloc(dst->names->keys,
-                              (src->max_key_code + 1) * sizeof(XkbKeyNameRec));
+                tmp = reallocarray(dst->names->keys, src->max_key_code + 1,
+                                   sizeof(XkbKeyNameRec));
                 if (!tmp)
                     return FALSE;
                 dst->names->keys = tmp;
@@ -1297,9 +1298,9 @@ _XkbCopyNames(XkbDescPtr src, XkbDescPtr dst)
 
         if (src->names->num_key_aliases) {
             if (src->names->num_key_aliases != dst->names->num_key_aliases) {
-                tmp = realloc(dst->names->key_aliases,
-                              src->names->num_key_aliases *
-                              sizeof(XkbKeyAliasRec));
+                tmp = reallocarray(dst->names->key_aliases,
+                                   src->names->num_key_aliases,
+                                   sizeof(XkbKeyAliasRec));
                 if (!tmp)
                     return FALSE;
                 dst->names->key_aliases = tmp;
@@ -1315,8 +1316,8 @@ _XkbCopyNames(XkbDescPtr src, XkbDescPtr dst)
 
         if (src->names->num_rg) {
             if (src->names->num_rg != dst->names->num_rg) {
-                tmp = realloc(dst->names->radio_groups,
-                              src->names->num_rg * sizeof(Atom));
+                tmp = reallocarray(dst->names->radio_groups,
+                                   src->names->num_rg, sizeof(Atom));
                 if (!tmp)
                     return FALSE;
                 dst->names->radio_groups = tmp;
@@ -1366,8 +1367,9 @@ _XkbCopyCompat(XkbDescPtr src, XkbDescPtr dst)
 
         if (src->compat->sym_interpret && src->compat->num_si) {
             if (src->compat->num_si != dst->compat->size_si) {
-                tmp = realloc(dst->compat->sym_interpret,
-                              src->compat->num_si * sizeof(XkbSymInterpretRec));
+                tmp = reallocarray(dst->compat->sym_interpret,
+                                   src->compat->num_si,
+                                   sizeof(XkbSymInterpretRec));
                 if (!tmp)
                     return FALSE;
                 dst->compat->sym_interpret = tmp;
@@ -1582,8 +1584,8 @@ _XkbCopyGeom(XkbDescPtr src, XkbDescPtr dst)
                          j < sshape->num_outlines;
                          j++, soutline++, doutline++) {
                         if (soutline->num_points) {
-                            tmp = malloc(soutline->num_points *
-                                         sizeof(XkbPointRec));
+                            tmp = xallocarray(soutline->num_points,
+                                              sizeof(XkbPointRec));
                             if (!tmp)
                                 return FALSE;
                             doutline->points = tmp;
@@ -1710,7 +1712,7 @@ _XkbCopyGeom(XkbDescPtr src, XkbDescPtr dst)
                 for (j = 0, srow = ssection->rows, drow = dsection->rows;
                      j < ssection->num_rows; j++, srow++, drow++) {
                     if (srow->num_keys) {
-                        tmp = malloc(srow->num_keys * sizeof(XkbKeyRec));
+                        tmp = xallocarray(srow->num_keys, sizeof(XkbKeyRec));
                         if (!tmp)
                             return FALSE;
                         drow->keys = tmp;
diff --git a/xkb/xkmread.c b/xkb/xkmread.c
index 0b9f0ef..1666e32 100644
--- a/xkb/xkmread.c
+++ b/xkb/xkmread.c
@@ -64,7 +64,7 @@ XkmInsureSize(void *oldPtr, int oldCount, int *newCountRtrn, int elemSize)
         oldPtr = calloc(newCount, elemSize);
     }
     else if (oldCount < newCount) {
-        oldPtr = realloc(oldPtr, newCount * elemSize);
+        oldPtr = reallocarray(oldPtr, newCount, elemSize);
         if (oldPtr != NULL) {
             char *tmp = (char *) oldPtr;
 
commit 1c56ac63c040280498c4a9d67b48c35b60070821
Author: Alan Coopersmith <alan.coopersmith at oracle.com>
Date:   Sat Mar 21 13:42:12 2015 -0700

    Convert top level extensions to new *allocarray functions
    
    v2: remove now useless parentheses
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Reviewed-by: Matt Turner <mattst88 at gmail.com>

diff --git a/Xext/hashtable.c b/Xext/hashtable.c
index 471ecca..41b2e00 100644
--- a/Xext/hashtable.c
+++ b/Xext/hashtable.c
@@ -54,7 +54,7 @@ ht_create(int             keySize,
     ht->elements = 0;
     ht->bucketBits = INITHASHSIZE;
     numBuckets = 1 << ht->bucketBits;
-    ht->buckets = malloc(numBuckets * sizeof(*ht->buckets));
+    ht->buckets = xallocarray(numBuckets, sizeof(*ht->buckets));
     ht->cdata = cdata;
 
     if (ht->buckets) {
@@ -92,7 +92,7 @@ double_size(HashTable ht)
     int newNumBuckets = 1 << newBucketBits;
     int c;
 
-    newBuckets = malloc(newNumBuckets * sizeof(*ht->buckets));
+    newBuckets = xallocarray(newNumBuckets, sizeof(*ht->buckets));
     if (newBuckets) {
         for (c = 0; c < newNumBuckets; ++c) {
             xorg_list_init(&newBuckets[c]);
diff --git a/Xext/panoramiX.c b/Xext/panoramiX.c
index 2bbae2f..209df29 100644
--- a/Xext/panoramiX.c
+++ b/Xext/panoramiX.c
@@ -747,13 +747,13 @@ PanoramiXMaybeAddDepth(DepthPtr pDepth)
 
     j = PanoramiXNumDepths;
     PanoramiXNumDepths++;
-    PanoramiXDepths = realloc(PanoramiXDepths,
-                              PanoramiXNumDepths * sizeof(DepthRec));
+    PanoramiXDepths = reallocarray(PanoramiXDepths,
+                                   PanoramiXNumDepths, sizeof(DepthRec));
     PanoramiXDepths[j].depth = pDepth->depth;
     PanoramiXDepths[j].numVids = 0;
     /* XXX suboptimal, should grow these dynamically */
     if (pDepth->numVids)
-        PanoramiXDepths[j].vids = malloc(sizeof(VisualID) * pDepth->numVids);
+        PanoramiXDepths[j].vids = xallocarray(pDepth->numVids, sizeof(VisualID));
     else
         PanoramiXDepths[j].vids = NULL;
 }
@@ -789,8 +789,8 @@ PanoramiXMaybeAddVisual(VisualPtr pVisual)
     /* found a matching visual on all screens, add it to the subset list */
     j = PanoramiXNumVisuals;
     PanoramiXNumVisuals++;
-    PanoramiXVisuals = realloc(PanoramiXVisuals,
-                               PanoramiXNumVisuals * sizeof(VisualRec));
+    PanoramiXVisuals = reallocarray(PanoramiXVisuals,
+                                    PanoramiXNumVisuals, sizeof(VisualRec));
 
     memcpy(&PanoramiXVisuals[j], pVisual, sizeof(VisualRec));
 
diff --git a/Xext/panoramiXprocs.c b/Xext/panoramiXprocs.c
index 5291a4a..9eb29bd 100644
--- a/Xext/panoramiXprocs.c
+++ b/Xext/panoramiXprocs.c
@@ -1341,7 +1341,7 @@ PanoramiXPolyPoint(ClientPtr client)
     isRoot = (draw->type == XRT_WINDOW) && draw->u.win.root;
     npoint = bytes_to_int32((client->req_len << 2) - sizeof(xPolyPointReq));
     if (npoint > 0) {
-        origPts = malloc(npoint * sizeof(xPoint));
+        origPts = xallocarray(npoint, sizeof(xPoint));
         memcpy((char *) origPts, (char *) &stuff[1], npoint * sizeof(xPoint));
         FOR_NSCREENS_FORWARD(j) {
 
@@ -1406,7 +1406,7 @@ PanoramiXPolyLine(ClientPtr client)
     isRoot = IS_ROOT_DRAWABLE(draw);
     npoint = bytes_to_int32((client->req_len << 2) - sizeof(xPolyLineReq));
     if (npoint > 0) {
-        origPts = malloc(npoint * sizeof(xPoint));
+        origPts = xallocarray(npoint, sizeof(xPoint));
         memcpy((char *) origPts, (char *) &stuff[1], npoint * sizeof(xPoint));
         FOR_NSCREENS_FORWARD(j) {
 
@@ -1475,7 +1475,7 @@ PanoramiXPolySegment(ClientPtr client)
         return BadLength;
     nsegs >>= 3;
     if (nsegs > 0) {
-        origSegs = malloc(nsegs * sizeof(xSegment));
+        origSegs = xallocarray(nsegs, sizeof(xSegment));
         memcpy((char *) origSegs, (char *) &stuff[1], nsegs * sizeof(xSegment));
         FOR_NSCREENS_FORWARD(j) {
 
@@ -1543,7 +1543,7 @@ PanoramiXPolyRectangle(ClientPtr client)
         return BadLength;
     nrects >>= 3;
     if (nrects > 0) {
-        origRecs = malloc(nrects * sizeof(xRectangle));
+        origRecs = xallocarray(nrects, sizeof(xRectangle));
         memcpy((char *) origRecs, (char *) &stuff[1],
                nrects * sizeof(xRectangle));
         FOR_NSCREENS_FORWARD(j) {
@@ -1610,7 +1610,7 @@ PanoramiXPolyArc(ClientPtr client)
         return BadLength;
     narcs /= sizeof(xArc);
     if (narcs > 0) {
-        origArcs = malloc(narcs * sizeof(xArc));
+        origArcs = xallocarray(narcs, sizeof(xArc));
         memcpy((char *) origArcs, (char *) &stuff[1], narcs * sizeof(xArc));
         FOR_NSCREENS_FORWARD(j) {
 
@@ -1672,7 +1672,7 @@ PanoramiXFillPoly(ClientPtr client)
 
     count = bytes_to_int32((client->req_len << 2) - sizeof(xFillPolyReq));
     if (count > 0) {
-        locPts = malloc(count * sizeof(DDXPointRec));
+        locPts = xallocarray(count, sizeof(DDXPointRec));
         memcpy((char *) locPts, (char *) &stuff[1],
                count * sizeof(DDXPointRec));
         FOR_NSCREENS_FORWARD(j) {
@@ -1741,7 +1741,7 @@ PanoramiXPolyFillRectangle(ClientPtr client)
         return BadLength;
     things >>= 3;
     if (things > 0) {
-        origRects = malloc(things * sizeof(xRectangle));
+        origRects = xallocarray(things, sizeof(xRectangle));
         memcpy((char *) origRects, (char *) &stuff[1],
                things * sizeof(xRectangle));
         FOR_NSCREENS_FORWARD(j) {
@@ -1808,7 +1808,7 @@ PanoramiXPolyFillArc(ClientPtr client)
         return BadLength;
     narcs /= sizeof(xArc);
     if (narcs > 0) {
-        origArcs = malloc(narcs * sizeof(xArc));
+        origArcs = xallocarray(narcs, sizeof(xArc));
         memcpy((char *) origArcs, (char *) &stuff[1], narcs * sizeof(xArc));
         FOR_NSCREENS_FORWARD(j) {
 
@@ -1988,8 +1988,7 @@ PanoramiXGetImage(ClientPtr client)
         if (linesPerBuf > h)
             linesPerBuf = h;
     }
-    length = linesPerBuf * widthBytesLine;
-    if (!(pBuf = malloc(length)))
+    if (!(pBuf = xallocarray(linesPerBuf, widthBytesLine)))
         return BadAlloc;
 
     WriteReplyToClient(client, sizeof(xGetImageReply), &xgi);
diff --git a/Xext/saver.c b/Xext/saver.c
index 2c14ea0..0e20467 100644
--- a/Xext/saver.c
+++ b/Xext/saver.c
@@ -853,7 +853,7 @@ ScreenSaverSetAttributes(ClientPtr client)
         goto bail;
     }
     /* over allocate for override redirect */
-    pAttr->values = values = malloc((len + 1) * sizeof(unsigned long));
+    pAttr->values = values = xallocarray(len + 1, sizeof(unsigned long));
     if (!values) {
         ret = BadAlloc;
         goto bail;
diff --git a/Xext/shape.c b/Xext/shape.c
index bb479b1..2fc789e 100644
--- a/Xext/shape.c
+++ b/Xext/shape.c
@@ -996,7 +996,7 @@ ProcShapeGetRectangles(ClientPtr client)
 
         nrects = RegionNumRects(region);
         box = RegionRects(region);
-        rects = malloc(nrects * sizeof(xRectangle));
+        rects = xallocarray(nrects, sizeof(xRectangle));
         if (!rects && nrects)
             return BadAlloc;
         for (i = 0; i < nrects; i++, box++) {
diff --git a/Xext/sync.c b/Xext/sync.c
index ba08cd1..4140561 100644
--- a/Xext/sync.c
+++ b/Xext/sync.c
@@ -620,7 +620,7 @@ SyncAwaitTriggerFired(SyncTrigger * pTrigger)
 
     pAwaitUnion = (SyncAwaitUnion *) pAwait->pHeader;
     numwaits = pAwaitUnion->header.num_waitconditions;
-    ppAwait = malloc(numwaits * sizeof(SyncAwait *));
+    ppAwait = xallocarray(numwaits, sizeof(SyncAwait *));
     if (!ppAwait)
         goto bail;
 
@@ -1514,7 +1514,7 @@ SyncAwaitPrologue(ClientPtr client, int items)
     /*  all the memory for the entire await list is allocated
      *  here in one chunk
      */
-    pAwaitUnion = malloc((items + 1) * sizeof(SyncAwaitUnion));
+    pAwaitUnion = xallocarray(items + 1, sizeof(SyncAwaitUnion));
     if (!pAwaitUnion)
         return NULL;
 
diff --git a/Xext/xcmisc.c b/Xext/xcmisc.c
index 1e91010..ed25650 100644
--- a/Xext/xcmisc.c
+++ b/Xext/xcmisc.c
@@ -101,7 +101,7 @@ ProcXCMiscGetXIDList(ClientPtr client)
     if (stuff->count > UINT32_MAX / sizeof(XID))
         return BadAlloc;
 
-    pids = (XID *) malloc(stuff->count * sizeof(XID));
+    pids = xallocarray(stuff->count, sizeof(XID));
     if (!pids) {
         return BadAlloc;
     }
diff --git a/Xext/xf86bigfont.c b/Xext/xf86bigfont.c
index 46b3242..95b5371 100644
--- a/Xext/xf86bigfont.c
+++ b/Xext/xf86bigfont.c
@@ -401,7 +401,7 @@ ProcXF86BigfontQueryFont(ClientPtr client)
             }
             else {
 #endif
-                pCI = malloc(nCharInfos * sizeof(xCharInfo));
+                pCI = xallocarray(nCharInfos, sizeof(xCharInfo));
                 if (!pCI)
                     return BadAlloc;
 #ifdef HAS_SHM
@@ -463,7 +463,7 @@ ProcXF86BigfontQueryFont(ClientPtr client)
             if (hashModulus > nCharInfos + 1)
                 hashModulus = nCharInfos + 1;
 
-            tmp = malloc((4 * nCharInfos + 1) * sizeof(CARD16));
+            tmp = xallocarray(4 * nCharInfos + 1, sizeof(CARD16));
             if (!tmp) {
                 if (!pDesc)
                     free(pCI);
diff --git a/Xext/xres.c b/Xext/xres.c
index 2737938..6b87c3d 100644
--- a/Xext/xres.c
+++ b/Xext/xres.c
@@ -223,7 +223,7 @@ ProcXResQueryClients(ClientPtr client)
 
     REQUEST_SIZE_MATCH(xXResQueryClientsReq);
 
-    current_clients = malloc(currentMaxClients * sizeof(int));
+    current_clients = xallocarray(currentMaxClients, sizeof(int));
 
     num_clients = 0;
     for (i = 0; i < currentMaxClients; i++) {
diff --git a/Xext/xselinux_label.c b/Xext/xselinux_label.c
index 2c33d1c..8559385 100644
--- a/Xext/xselinux_label.c
+++ b/Xext/xselinux_label.c
@@ -64,7 +64,7 @@ SELinuxArraySet(SELinuxArrayRec * rec, unsigned key, void *val)
 {
     if (key >= rec->size) {
         /* Need to increase size of array */
-        rec->array = realloc(rec->array, (key + 1) * sizeof(val));
+        rec->array = reallocarray(rec->array, key + 1, sizeof(val));
         if (!rec->array)
             return FALSE;
         memset(rec->array + rec->size, 0, (key - rec->size + 1) * sizeof(val));
diff --git a/Xext/xvmain.c b/Xext/xvmain.c
index 0abf190..93e5f0c 100644
--- a/Xext/xvmain.c
+++ b/Xext/xvmain.c
@@ -1102,7 +1102,7 @@ XvFillColorKey(DrawablePtr pDraw, CARD32 key, RegionPtr region)
     (void) ChangeGC(NullClient, gc, GCForeground | GCSubwindowMode, pval);
     ValidateGC(pDraw, gc);
 
-    rects = malloc(nbox * sizeof(xRectangle));
+    rects = xallocarray(nbox, sizeof(xRectangle));
     if (rects) {
         for (i = 0; i < nbox; i++, pbox++) {
             rects[i].x = pbox->x1 - pDraw->x;
diff --git a/Xi/exevents.c b/Xi/exevents.c
index 0857bce..1c586d0 100644
--- a/Xi/exevents.c
+++ b/Xi/exevents.c
@@ -471,9 +471,9 @@ DeepCopyKeyboardClasses(DeviceIntPtr from, DeviceIntPtr to)
 
             oldTrace = to->focus->trace;
             memcpy(to->focus, from->focus, sizeof(FocusClassRec));
-            to->focus->trace = realloc(oldTrace,
-                                       to->focus->traceSize *
-                                       sizeof(WindowPtr));
+            to->focus->trace = reallocarray(oldTrace,
+                                            to->focus->traceSize,
+                                            sizeof(WindowPtr));
             if (!to->focus->trace && to->focus->traceSize)
                 FatalError("[Xi] no memory for trace.\n");
             memcpy(to->focus->trace, from->focus->trace,
diff --git a/Xi/getprop.c b/Xi/getprop.c
index 4d6ce63..19f18af 100644
--- a/Xi/getprop.c
+++ b/Xi/getprop.c
@@ -118,7 +118,7 @@ ProcXGetDeviceDontPropagateList(ClientPtr client)
             ClassFromMask(NULL, others->dontPropagateMask[i], i, &count, COUNT);
         if (count) {
             rep.count = count;
-            buf = (XEventClass *) malloc(rep.count * sizeof(XEventClass));
+            buf = xallocarray(rep.count, sizeof(XEventClass));
             rep.length = bytes_to_int32(rep.count * sizeof(XEventClass));
 
             tbuf = buf;
diff --git a/Xi/xiproperty.c b/Xi/xiproperty.c
index 8e8e4b0..e3b8f5a 100644
--- a/Xi/xiproperty.c
+++ b/Xi/xiproperty.c
@@ -221,7 +221,7 @@ list_atoms(DeviceIntPtr dev, int *natoms, Atom **atoms_return)
     if (nprops) {
         Atom *a;
 
-        atoms = malloc(nprops * sizeof(Atom));
+        atoms = xallocarray(nprops, sizeof(Atom));
         if (!atoms)
             return BadAlloc;
         a = atoms;
@@ -687,7 +687,6 @@ XIChangeDeviceProperty(DeviceIntPtr dev, Atom property, Atom type,
 {
     XIPropertyPtr prop;
     int size_in_bytes;
-    int total_size;
     unsigned long total_len;
     XIPropertyValuePtr prop_value;
     XIPropertyValueRec new_value;
@@ -725,9 +724,8 @@ XIChangeDeviceProperty(DeviceIntPtr dev, Atom property, Atom type,
     if (mode == PropModeReplace || len > 0) {
         void *new_data = NULL, *old_data = NULL;
 
-        total_size = total_len * size_in_bytes;
-        new_value.data = (void *) malloc(total_size);
-        if (!new_value.data && total_size) {
+        new_value.data = xallocarray(total_len, size_in_bytes);
+        if (!new_value.data && total_len && size_in_bytes) {
             if (add)
                 XIDestroyDeviceProperty(prop);
             return BadAlloc;
diff --git a/composite/compinit.c b/composite/compinit.c
index 3ac075a..cf61f2a 100644
--- a/composite/compinit.c
+++ b/composite/compinit.c
@@ -223,8 +223,8 @@ compRegisterAlternateVisuals(CompScreenPtr cs, VisualID * vids, int nVisuals)
 {
     VisualID *p;
 
-    p = realloc(cs->alternateVisuals,
-                sizeof(VisualID) * (cs->numAlternateVisuals + nVisuals));
+    p = reallocarray(cs->alternateVisuals,
+                     cs->numAlternateVisuals + nVisuals, sizeof(VisualID));
     if (p == NULL)
         return FALSE;
 
@@ -253,8 +253,8 @@ CompositeRegisterImplicitRedirectionException(ScreenPtr pScreen,
     CompScreenPtr cs = GetCompScreen(pScreen);
     CompImplicitRedirectException *p;
 
-    p = realloc(cs->implicitRedirectExceptions,
-                sizeof(p[0]) * (cs->numImplicitRedirectExceptions + 1));
+    p = reallocarray(cs->implicitRedirectExceptions,
+                     cs->numImplicitRedirectExceptions + 1, sizeof(p[0]));
     if (p == NULL)
         return FALSE;
 
diff --git a/dbe/dbe.c b/dbe/dbe.c
index e5d928d..23f7e16 100644
--- a/dbe/dbe.c
+++ b/dbe/dbe.c
@@ -287,11 +287,10 @@ ProcDbeAllocateBackBufferName(ClientPtr client)
             }
 
             /* malloc/realloc a new array and initialize all elements to 0. */
-            pDbeWindowPriv->IDs = (XID *) realloc(pIDs,
-                                                  (pDbeWindowPriv->
-                                                   maxAvailableIDs +
-                                                   DBE_INCR_MAX_IDS) *
-                                                  sizeof(XID));
+            pDbeWindowPriv->IDs =
+                reallocarray(pIDs,
+                             pDbeWindowPriv->maxAvailableIDs + DBE_INCR_MAX_IDS,
+                             sizeof(XID));
             if (!pDbeWindowPriv->IDs) {
                 return BadAlloc;
             }
@@ -470,7 +469,7 @@ ProcDbeSwapBuffers(ClientPtr client)
     dbeSwapInfo = (xDbeSwapInfo *) &stuff[1];
 
     /* Allocate array to record swap information. */
-    swapInfo = (DbeSwapInfoPtr) malloc(nStuff * sizeof(DbeSwapInfoRec));
+    swapInfo = xallocarray(nStuff, sizeof(DbeSwapInfoRec));
     if (swapInfo == NULL) {
         return BadAlloc;
     }
@@ -580,8 +579,7 @@ ProcDbeGetVisualInfo(ClientPtr client)
         return BadAlloc;
     /* Make sure any specified drawables are valid. */
     if (stuff->n != 0) {
-        if (!(pDrawables = (DrawablePtr *) malloc(stuff->n *
-                                                  sizeof(DrawablePtr)))) {
+        if (!(pDrawables = xallocarray(stuff->n, sizeof(DrawablePtr)))) {
             return BadAlloc;
         }
 
diff --git a/dbe/midbe.c b/dbe/midbe.c
index 8f75910..9684d45 100644
--- a/dbe/midbe.c
+++ b/dbe/midbe.c
@@ -87,7 +87,7 @@ miDbeGetVisualInfo(ScreenPtr pScreen, XdbeScreenVisualInfo * pScrVisInfo)
     }
 
     /* Allocate an array of XdbeVisualInfo items. */
-    if (!(visInfo = (XdbeVisualInfo *) malloc(count * sizeof(XdbeVisualInfo)))) {
+    if (!(visInfo = xallocarray(count, sizeof(XdbeVisualInfo)))) {
         return FALSE;           /* memory alloc failure */
     }
 
diff --git a/pseudoramiX/pseudoramiX.c b/pseudoramiX/pseudoramiX.c
index e59ca13..d8b2593 100644
--- a/pseudoramiX/pseudoramiX.c
+++ b/pseudoramiX/pseudoramiX.c
@@ -140,9 +140,9 @@ PseudoramiXAddScreen(int x, int y, int w, int h)
 
     if (pseudoramiXNumScreens == pseudoramiXScreensAllocated) {
         pseudoramiXScreensAllocated += pseudoramiXScreensAllocated + 1;
-        pseudoramiXScreens = realloc(pseudoramiXScreens,
-                                     pseudoramiXScreensAllocated *
-                                     sizeof(PseudoramiXScreenRec));
+        pseudoramiXScreens = reallocarray(pseudoramiXScreens,
+                                          pseudoramiXScreensAllocated,
+                                          sizeof(PseudoramiXScreenRec));
     }
 
     DEBUG_LOG("x: %d, y: %d, w: %d, h: %d\n", x, y, w, h);
diff --git a/randr/rrcrtc.c b/randr/rrcrtc.c
index 69b3ecf..63d94e2 100644
--- a/randr/rrcrtc.c
+++ b/randr/rrcrtc.c
@@ -65,8 +65,8 @@ RRCrtcCreate(ScreenPtr pScreen, void *devPrivate)
 
     /* make space for the crtc pointer */
     if (pScrPriv->numCrtcs)
-        crtcs = realloc(pScrPriv->crtcs,
-                        (pScrPriv->numCrtcs + 1) * sizeof(RRCrtcPtr));
+        crtcs = reallocarray(pScrPriv->crtcs,
+                             pScrPriv->numCrtcs + 1, sizeof(RRCrtcPtr));
     else
         crtcs = malloc(sizeof(RRCrtcPtr));
     if (!crtcs)
@@ -176,10 +176,10 @@ RRCrtcNotify(RRCrtcPtr crtc,
 
         if (numOutputs) {
             if (crtc->numOutputs)
-                newoutputs = realloc(crtc->outputs,
-                                     numOutputs * sizeof(RROutputPtr));
+                newoutputs = reallocarray(crtc->outputs,
+                                          numOutputs, sizeof(RROutputPtr));
             else
-                newoutputs = malloc(numOutputs * sizeof(RROutputPtr));
+                newoutputs = xallocarray(numOutputs, sizeof(RROutputPtr));
             if (!newoutputs)
                 return FALSE;
         }
@@ -798,7 +798,7 @@ RRCrtcGammaSetSize(RRCrtcPtr crtc, int size)
     if (size == crtc->gammaSize)
         return TRUE;
     if (size) {
-        gamma = malloc(size * 3 * sizeof(CARD16));
+        gamma = xallocarray(size, 3 * sizeof(CARD16));
         if (!gamma)
             return FALSE;
     }
@@ -1027,7 +1027,7 @@ ProcRRSetCrtcConfig(ClientPtr client)
             return BadMatch;
     }
     if (numOutputs) {
-        outputs = malloc(numOutputs * sizeof(RROutputPtr));
+        outputs = xallocarray(numOutputs, sizeof(RROutputPtr));
         if (!outputs)
             return BadAlloc;
     }
diff --git a/randr/rrinfo.c b/randr/rrinfo.c
index fc57bd4..24245b7 100644
--- a/randr/rrinfo.c
+++ b/randr/rrinfo.c
@@ -55,8 +55,8 @@ RROldModeAdd(RROutputPtr output, RRScreenSizePtr size, int refresh)
         }
 
     if (output->numModes)
-        modes = realloc(output->modes,
-                        (output->numModes + 1) * sizeof(RRModePtr));
+        modes = reallocarray(output->modes,
+                             output->numModes + 1, sizeof(RRModePtr));
     else
         modes = malloc(sizeof(RRModePtr));
     if (!modes) {
@@ -266,8 +266,8 @@ RRRegisterSize(ScreenPtr pScreen,
     for (i = 0; i < pScrPriv->nSizes; i++)
         if (RRScreenSizeMatches(&tmp, &pScrPriv->pSizes[i]))
             return &pScrPriv->pSizes[i];
-    pNew = realloc(pScrPriv->pSizes,
-                   (pScrPriv->nSizes + 1) * sizeof(RRScreenSize));
+    pNew = reallocarray(pScrPriv->pSizes,
+                        pScrPriv->nSizes + 1, sizeof(RRScreenSize));
     if (!pNew)
         return 0;
     pNew[pScrPriv->nSizes++] = tmp;
@@ -289,7 +289,7 @@ RRRegisterRate(ScreenPtr pScreen, RRScreenSizePtr pSize, int rate)
         if (pSize->pRates[i].rate == rate)
             return TRUE;
 
-    pNew = realloc(pSize->pRates, (pSize->nRates + 1) * sizeof(RRScreenRate));
+    pNew = reallocarray(pSize->pRates, pSize->nRates + 1, sizeof(RRScreenRate));
     if (!pNew)
         return FALSE;
     pRate = &pNew[pSize->nRates++];
diff --git a/randr/rrmode.c b/randr/rrmode.c
index befac47..a7aa433 100644
--- a/randr/rrmode.c
+++ b/randr/rrmode.c
@@ -79,7 +79,7 @@ RRModeCreate(xRRModeInfo * modeInfo, const char *name, ScreenPtr userScreen)
     mode->userScreen = userScreen;
 
     if (num_modes)
-        newModes = realloc(modes, (num_modes + 1) * sizeof(RRModePtr));
+        newModes = reallocarray(modes, num_modes + 1, sizeof(RRModePtr));
     else
         newModes = malloc(sizeof(RRModePtr));
 
@@ -166,7 +166,7 @@ RRModesForScreen(ScreenPtr pScreen, int *num_ret)
     RRModePtr *screen_modes;
     int num_screen_modes = 0;
 
-    screen_modes = malloc((num_modes ? num_modes : 1) * sizeof(RRModePtr));
+    screen_modes = xallocarray((num_modes ? num_modes : 1), sizeof(RRModePtr));
     if (!screen_modes)
         return NULL;
 
diff --git a/randr/rrmonitor.c b/randr/rrmonitor.c
index fbdd352..c4bb617 100644
--- a/randr/rrmonitor.c
+++ b/randr/rrmonitor.c
@@ -494,8 +494,9 @@ RRMonitorAdd(ClientPtr client, ScreenPtr screen, RRMonitorPtr monitor)
      * needs to not have any side-effects on failure
      */
     if (pScrPriv->numMonitors)
-        monitors = realloc(pScrPriv->monitors,
-                           (pScrPriv->numMonitors + 1) * sizeof (RRMonitorPtr));
+        monitors = reallocarray(pScrPriv->monitors,
+                                pScrPriv->numMonitors + 1,
+                                sizeof (RRMonitorPtr));
     else
         monitors = malloc(sizeof (RRMonitorPtr));
 
diff --git a/randr/rroutput.c b/randr/rroutput.c
index 548e07d..10df4da 100644
--- a/randr/rroutput.c
+++ b/randr/rroutput.c
@@ -60,8 +60,8 @@ RROutputCreate(ScreenPtr pScreen,
     pScrPriv = rrGetScrPriv(pScreen);
 
     if (pScrPriv->numOutputs)
-        outputs = realloc(pScrPriv->outputs,
-                          (pScrPriv->numOutputs + 1) * sizeof(RROutputPtr));
+        outputs = reallocarray(pScrPriv->outputs,
+                               pScrPriv->numOutputs + 1, sizeof(RROutputPtr));
     else
         outputs = malloc(sizeof(RROutputPtr));
     if (!outputs)
@@ -124,7 +124,7 @@ RROutputSetClones(RROutputPtr output, RROutputPtr * clones, int numClones)
             return TRUE;
     }
     if (numClones) {
-        newClones = malloc(numClones * sizeof(RROutputPtr));
+        newClones = xallocarray(numClones, sizeof(RROutputPtr));
         if (!newClones)
             return FALSE;
     }
@@ -157,7 +157,7 @@ RROutputSetModes(RROutputPtr output,
     }
 
     if (numModes) {
-        newModes = malloc(numModes * sizeof(RRModePtr));
+        newModes = xallocarray(numModes, sizeof(RRModePtr));
         if (!newModes)
             return FALSE;
     }
@@ -200,8 +200,8 @@ RROutputAddUserMode(RROutputPtr output, RRModePtr mode)
             return BadMatch;
 
     if (output->userModes)
-        newModes = realloc(output->userModes,
-                           (output->numUserModes + 1) * sizeof(RRModePtr));
+        newModes = reallocarray(output->userModes,
+                                output->numUserModes + 1, sizeof(RRModePtr));
     else
         newModes = malloc(sizeof(RRModePtr));
     if (!newModes)
@@ -256,7 +256,7 @@ RROutputSetCrtcs(RROutputPtr output, RRCrtcPtr * crtcs, int numCrtcs)
             return TRUE;
     }
     if (numCrtcs) {
-        newCrtcs = malloc(numCrtcs * sizeof(RRCrtcPtr));
+        newCrtcs = xallocarray(numCrtcs, sizeof(RRCrtcPtr));
         if (!newCrtcs)
             return FALSE;
     }
diff --git a/randr/rrproperty.c b/randr/rrproperty.c
index e385e15..e56626c 100644
--- a/randr/rrproperty.c
+++ b/randr/rrproperty.c
@@ -140,7 +140,6 @@ RRChangeOutputProperty(RROutputPtr output, Atom property, Atom type,
     RRPropertyPtr prop;
     rrScrPrivPtr pScrPriv = rrGetScrPriv(output->pScreen);
     int size_in_bytes;
-    int total_size;
     unsigned long total_len;
     RRPropertyValuePtr prop_value;
     RRPropertyValueRec new_value;
@@ -180,9 +179,8 @@ RRChangeOutputProperty(RROutputPtr output, Atom property, Atom type,
     if (mode == PropModeReplace || len > 0) {
         void *new_data = NULL, *old_data = NULL;
 
-        total_size = total_len * size_in_bytes;
-        new_value.data = (void *) malloc(total_size);
-        if (!new_value.data && total_size) {
+        new_value.data = xallocarray(total_len, size_in_bytes);
+        if (!new_value.data && total_len && size_in_bytes) {
             if (add)
                 RRDestroyOutputProperty(prop);
             return BadAlloc;
@@ -350,7 +348,7 @@ RRConfigureOutputProperty(RROutputPtr output, Atom property,
         return BadMatch;
     }
 
-    new_values = malloc(num_values * sizeof(INT32));
+    new_values = xallocarray(num_values, sizeof(INT32));
     if (!new_values && num_values) {
         if (add)
             RRDestroyOutputProperty(prop);
@@ -400,7 +398,7 @@ ProcRRListOutputProperties(ClientPtr client)
     for (prop = output->properties; prop; prop = prop->next)
         numProps++;
     if (numProps)
-        if (!(pAtoms = (Atom *) malloc(numProps * sizeof(Atom))))
+        if (!(pAtoms = xallocarray(numProps, sizeof(Atom))))
             return BadAlloc;
 
     rep = (xRRListOutputPropertiesReply) {
@@ -447,7 +445,7 @@ ProcRRQueryOutputProperty(ClientPtr client)
         return BadName;
 
     if (prop->num_valid) {
-        extra = malloc(prop->num_valid * sizeof(INT32));
+        extra = xallocarray(prop->num_valid, sizeof(INT32));
         if (!extra)
             return BadAlloc;
     }
diff --git a/randr/rrproviderproperty.c b/randr/rrproviderproperty.c
index ff2c614..b79c17f 100644
--- a/randr/rrproviderproperty.c
+++ b/randr/rrproviderproperty.c
@@ -350,7 +350,7 @@ RRConfigureProviderProperty(RRProviderPtr provider, Atom property,
         return BadMatch;
     }
 
-    new_values = malloc(num_values * sizeof(INT32));
+    new_values = xallocarray(num_values, sizeof(INT32));
     if (!new_values && num_values) {
         if (add)
             RRDestroyProviderProperty(prop);
@@ -400,7 +400,7 @@ ProcRRListProviderProperties(ClientPtr client)
     for (prop = provider->properties; prop; prop = prop->next)
         numProps++;
     if (numProps)
-        if (!(pAtoms = (Atom *) malloc(numProps * sizeof(Atom))))
+        if (!(pAtoms = xallocarray(numProps, sizeof(Atom))))
             return BadAlloc;
 
     rep = (xRRListProviderPropertiesReply) {
@@ -445,7 +445,7 @@ ProcRRQueryProviderProperty(ClientPtr client)
         return BadName;
 
     if (prop->num_valid) {
-        extra = malloc(prop->num_valid * sizeof(INT32));
+        extra = xallocarray(prop->num_valid, sizeof(INT32));
         if (!extra)
             return BadAlloc;
     }
diff --git a/randr/rrtransform.c b/randr/rrtransform.c
index c8a2749..6137f85 100644
--- a/randr/rrtransform.c
+++ b/randr/rrtransform.c
@@ -70,7 +70,7 @@ RRTransformSetFilter(RRTransformPtr dst,
     xFixed *new_params;
 
     if (nparams) {
-        new_params = malloc(nparams * sizeof(xFixed));
+        new_params = xallocarray(nparams, sizeof(xFixed));
         if (!new_params)
             return FALSE;
         memcpy(new_params, params, nparams * sizeof(xFixed));
diff --git a/record/record.c b/record/record.c
index 0a466e2..1caf3f1 100644
--- a/record/record.c
+++ b/record/record.c
@@ -1074,19 +1074,19 @@ RecordAddClientToRCAP(RecordClientsAndProtocolPtr pRCAP, XID clientspec)
 {
     if (pRCAP->numClients == pRCAP->sizeClients) {
         if (pRCAP->clientIDsSeparatelyAllocated) {
-            XID *pNewIDs = (XID *) realloc(pRCAP->pClientIDs,
-                                           (pRCAP->sizeClients +
-                                            CLIENT_ARRAY_GROWTH_INCREMENT) *
-                                           sizeof(XID));
+            XID *pNewIDs =
+                reallocarray(pRCAP->pClientIDs,
+                             pRCAP->sizeClients + CLIENT_ARRAY_GROWTH_INCREMENT,
+                             sizeof(XID));
             if (!pNewIDs)
                 return;
             pRCAP->pClientIDs = pNewIDs;
             pRCAP->sizeClients += CLIENT_ARRAY_GROWTH_INCREMENT;
         }
         else {
-            XID *pNewIDs = (XID *) malloc((pRCAP->sizeClients +
-                                           CLIENT_ARRAY_GROWTH_INCREMENT) *
-                                          sizeof(XID));
+            XID *pNewIDs =
+                xallocarray(pRCAP->sizeClients + CLIENT_ARRAY_GROWTH_INCREMENT,
+                            sizeof(XID));
             if (!pNewIDs)
                 return;
             memcpy(pNewIDs, pRCAP->pClientIDs, pRCAP->numClients * sizeof(XID));
@@ -1217,7 +1217,7 @@ RecordCanonicalizeClientSpecifiers(XID *pClientspecs, int *pNumClientspecs,
     for (i = 0; i < numClients; i++) {
         if (pClientspecs[i] == XRecordAllClients || pClientspecs[i] == XRecordCurrentClients) { /* expand All/Current */
             int j, nc;
-            XID *pCanon = (XID *) malloc(sizeof(XID) * (currentMaxClients + 1));
+            XID *pCanon = xallocarray(currentMaxClients + 1, sizeof(XID));
 
             if (!pCanon)
                 return NULL;
@@ -1421,8 +1421,7 @@ static int
 RecordAllocIntervals(SetInfoPtr psi, int nIntervals)
 {
     assert(!psi->intervals);
-    psi->intervals = (RecordSetInterval *)
-        malloc(nIntervals * sizeof(RecordSetInterval));
+    psi->intervals = xallocarray(nIntervals, sizeof(RecordSetInterval));
     if (!psi->intervals)
         return BadAlloc;
     memset(psi->intervals, 0, nIntervals * sizeof(RecordSetInterval));
@@ -1584,7 +1583,7 @@ RecordRegisterClients(RecordContextPtr pContext, ClientPtr client,
      * range for extension replies.
      */
     maxSets = PREDEFSETS + 2 * stuff->nRanges;
-    si = (SetInfoPtr) malloc(sizeof(SetInfoRec) * maxSets);
+    si = xallocarray(maxSets, sizeof(SetInfoRec));
     if (!si) {
         err = BadAlloc;
         goto bailout;
@@ -1853,8 +1852,8 @@ ProcRecordCreateContext(ClientPtr client)
 
     /* make sure there is room in ppAllContexts to store the new context */
 
-    ppNewAllContexts = (RecordContextPtr *)
-        realloc(ppAllContexts, sizeof(RecordContextPtr) * (numContexts + 1));
+    ppNewAllContexts =
+        reallocarray(ppAllContexts, numContexts + 1, sizeof(RecordContextPtr));
     if (!ppNewAllContexts)
         goto bailout;
     ppAllContexts = ppNewAllContexts;
@@ -1971,8 +1970,7 @@ RecordAllocRanges(GetContextRangeInfoPtr pri, int nRanges)
 #define SZINCR 8
 
     newsize = max(pri->size + SZINCR, nRanges);
-    pNewRange = (xRecordRange *) realloc(pri->pRanges,
-                                         newsize * sizeof(xRecordRange));
+    pNewRange = reallocarray(pri->pRanges, newsize, sizeof(xRecordRange));
     if (!pNewRange)
         return BadAlloc;
 
@@ -2150,9 +2148,7 @@ ProcRecordGetContext(ClientPtr client)
 
     /* allocate and initialize space for record range info */
 
-    pRangeInfo =
-        (GetContextRangeInfoPtr) malloc(nRCAPs *
-                                        sizeof(GetContextRangeInfoRec));
+    pRangeInfo = xallocarray(nRCAPs, sizeof(GetContextRangeInfoRec));
     if (!pRangeInfo && nRCAPs > 0)
         return BadAlloc;
     for (i = 0; i < nRCAPs; i++) {
@@ -2733,7 +2729,8 @@ RecordAClientStateChange(CallbackListPtr *pcbl, void *nulldata,
 
         /* RecordDisableContext modifies contents of ppAllContexts. */
         numContextsCopy = numContexts;
-        ppAllContextsCopy = malloc(numContextsCopy * sizeof(RecordContextPtr));
+        ppAllContextsCopy = xallocarray(numContextsCopy,
+                                        sizeof(RecordContextPtr));
         assert(ppAllContextsCopy);
         memcpy(ppAllContextsCopy, ppAllContexts,
                numContextsCopy * sizeof(RecordContextPtr));
diff --git a/record/set.c b/record/set.c
index 34faa61..e0db385 100644
--- a/record/set.c
+++ b/record/set.c
@@ -303,9 +303,7 @@ IntervalListCreateSet(RecordSetInterval * pIntervals, int nIntervals,
     CARD16 first;
 
     if (nIntervals > 0) {
-        stackIntervals =
-            (RecordSetInterval *) malloc(sizeof(RecordSetInterval) *
-                                         nIntervals);
+        stackIntervals = xallocarray(nIntervals, sizeof(RecordSetInterval));
         if (!stackIntervals)
             return NULL;
 
diff --git a/render/filter.c b/render/filter.c
index 019ea7f..2741f40 100644
--- a/render/filter.c
+++ b/render/filter.c
@@ -67,7 +67,7 @@ PictureGetFilterId(const char *filter, int len, Bool makeit)
     memcpy(name, filter, len);
     name[len] = '\0';
     if (filterNames)
-        names = realloc(filterNames, (nfilterNames + 1) * sizeof(char *));
+        names = reallocarray(filterNames, nfilterNames + 1, sizeof(char *));
     else
         names = malloc(sizeof(char *));
     if (!names) {
@@ -145,7 +145,7 @@ PictureAddFilter(ScreenPtr pScreen,
             return -1;
     if (ps->filters)
         filters =
-            realloc(ps->filters, (ps->nfilters + 1) * sizeof(PictFilterRec));
+            reallocarray(ps->filters, ps->nfilters + 1, sizeof(PictFilterRec));
     else
         filters = malloc(sizeof(PictFilterRec));
     if (!filters)
@@ -177,9 +177,9 @@ PictureSetFilterAlias(ScreenPtr pScreen, const char *filter, const char *alias)
         PictFilterAliasPtr aliases;
 
         if (ps->filterAliases)
-            aliases = realloc(ps->filterAliases,
-                              (ps->nfilterAliases + 1) *
-                              sizeof(PictFilterAliasRec));
+            aliases = reallocarray(ps->filterAliases,
+                                   ps->nfilterAliases + 1,
+                                   sizeof(PictFilterAliasRec));
         else
             aliases = malloc(sizeof(PictFilterAliasRec));
         if (!aliases)
@@ -336,7 +336,7 @@ SetPicturePictFilter(PicturePtr pPicture, PictFilterPtr pFilter,
         return BadMatch;
 
     if (nparams != pPicture->filter_nparams) {
-        xFixed *new_params = malloc(nparams * sizeof(xFixed));
+        xFixed *new_params = xallocarray(nparams, sizeof(xFixed));
 
         if (!new_params && nparams)
             return BadAlloc;
diff --git a/render/miindex.c b/render/miindex.c
index 0375e8f..4119eef 100644
--- a/render/miindex.c
+++ b/render/miindex.c
@@ -254,7 +254,7 @@ miInitIndexed(ScreenPtr pScreen, PictFormatPtr pFormat)
         return FALSE;
 
     pFormat->index.nvalues = num;
-    pFormat->index.pValues = malloc(num * sizeof(xIndexValue));
+    pFormat->index.pValues = xallocarray(num, sizeof(xIndexValue));
     if (!pFormat->index.pValues) {
         free(pIndexed);
         return FALSE;
diff --git a/render/mipict.c b/render/mipict.c
index a725104..2571fda 100644
--- a/render/mipict.c
+++ b/render/mipict.c
@@ -510,7 +510,7 @@ miTriStrip(CARD8 op,
     int ntri;
 
     ntri = npoints - 2;
-    tris = malloc(ntri * sizeof(xTriangle));
+    tris = xallocarray(ntri, sizeof(xTriangle));
     if (!tris)
         return;
 
@@ -535,7 +535,7 @@ miTriFan(CARD8 op,
     int ntri;
 
     ntri = npoints - 2;
-    tris = malloc(ntri * sizeof(xTriangle));
+    tris = xallocarray(ntri, sizeof(xTriangle));
     if (!tris)
         return;
 
diff --git a/render/picture.c b/render/picture.c
index 6ff31ba..60517a4 100644
--- a/render/picture.c
+++ b/render/picture.c
@@ -837,7 +837,7 @@ initGradient(SourcePictPtr pGradient, int stopCount,
         dpos = stopPoints[i];
     }
 
-    pGradient->gradient.stops = malloc(stopCount * sizeof(PictGradientStop));
+    pGradient->gradient.stops = xallocarray(stopCount, sizeof(PictGradientStop));
     if (!pGradient->gradient.stops) {
         *error = BadAlloc;
         return;
diff --git a/render/render.c b/render/render.c
index 723f380..88d8a26 100644
--- a/render/render.c
+++ b/render/render.c
@@ -1318,14 +1318,14 @@ ProcRenderCompositeGlyphs(ClientPtr client)
     if (nglyph <= NLOCALGLYPH)
         glyphsBase = glyphsLocal;
     else {
-        glyphsBase = (GlyphPtr *) malloc(nglyph * sizeof(GlyphPtr));
+        glyphsBase = xallocarray(nglyph, sizeof(GlyphPtr));
         if (!glyphsBase)
             return BadAlloc;
     }
     if (nlist <= NLOCALDELTA)
         listsBase = listsLocal;
     else {
-        listsBase = (GlyphListPtr) malloc(nlist * sizeof(GlyphListRec));
+        listsBase = xallocarray(nlist, sizeof(GlyphListRec));
         if (!listsBase) {
             rc = BadAlloc;
             goto bail;
@@ -1793,7 +1793,7 @@ ProcRenderCreateAnimCursor(ClientPtr client)
     ncursor =
         (client->req_len -
          (bytes_to_int32(sizeof(xRenderCreateAnimCursorReq)))) >> 1;
-    cursors = malloc(ncursor * (sizeof(CursorPtr) + sizeof(CARD32)));
+    cursors = xallocarray(ncursor, sizeof(CursorPtr) + sizeof(CARD32));
     if (!cursors)
         return BadAlloc;
     deltas = (CARD32 *) (cursors + ncursor);
diff --git a/xfixes/region.c b/xfixes/region.c
index 4492f12..dd74d7f 100644
--- a/xfixes/region.c
+++ b/xfixes/region.c
@@ -777,7 +777,7 @@ ProcXFixesExpandRegion(ClientPtr client)
     nBoxes = RegionNumRects(pSource);
     pSrc = RegionRects(pSource);
     if (nBoxes) {
-        pTmp = malloc(nBoxes * sizeof(BoxRec));
+        pTmp = xallocarray(nBoxes, sizeof(BoxRec));
         if (!pTmp)
             return BadAlloc;
         for (i = 0; i < nBoxes; i++) {
commit b9e665c8b2f048feb3064ce412e0b3e9eb6797b0
Author: Alan Coopersmith <alan.coopersmith at oracle.com>
Date:   Sat Mar 21 10:52:29 2015 -0700

    Convert dix/* to new *allocarray functions
    
    v2: remove now useless parentheses
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Reviewed-by: Matt Turner <mattst88 at gmail.com>

diff --git a/dix/atom.c b/dix/atom.c
index 22cd0dc..7de7fb0 100644
--- a/dix/atom.c
+++ b/dix/atom.c
@@ -119,7 +119,7 @@ MakeAtom(const char *string, unsigned len, Bool makeit)
         if ((lastAtom + 1) >= tableLength) {
             NodePtr *table;
 
-            table = realloc(nodeTable, tableLength * (2 * sizeof(NodePtr)));
+            table = reallocarray(nodeTable, tableLength, 2 * sizeof(NodePtr));
             if (!table) {
                 if (nd->string != string) {
                     /* nd->string has been strdup'ed */
@@ -200,7 +200,7 @@ InitAtoms(void)
 {
     FreeAllAtoms();
     tableLength = InitialTableSize;
-    nodeTable = malloc(InitialTableSize * sizeof(NodePtr));
+    nodeTable = xallocarray(InitialTableSize, sizeof(NodePtr));
     if (!nodeTable)
         AtomError();
     nodeTable[None] = NULL;
diff --git a/dix/colormap.c b/dix/colormap.c
index 4d408d5..a3e5a2c 100644
--- a/dix/colormap.c
+++ b/dix/colormap.c
@@ -296,7 +296,7 @@ CreateColormap(Colormap mid, ScreenPtr pScreen, VisualPtr pVisual,
         for (pent = &pmap->red[size - 1]; pent >= pmap->red; pent--)
             pent->refcnt = AllocPrivate;
         pmap->freeRed = 0;
-        ppix = malloc(size * sizeof(Pixel));
+        ppix = xallocarray(size, sizeof(Pixel));
         if (!ppix) {
             free(pmap);
             return BadAlloc;
@@ -337,7 +337,7 @@ CreateColormap(Colormap mid, ScreenPtr pScreen, VisualPtr pVisual,
             for (pent = &pmap->green[size - 1]; pent >= pmap->green; pent--)
                 pent->refcnt = AllocPrivate;
             pmap->freeGreen = 0;
-            ppix = malloc(size * sizeof(Pixel));
+            ppix = xallocarray(size, sizeof(Pixel));
             if (!ppix) {
                 free(pmap->clientPixelsRed[client]);
                 free(pmap);
@@ -352,7 +352,7 @@ CreateColormap(Colormap mid, ScreenPtr pScreen, VisualPtr pVisual,
             for (pent = &pmap->blue[size - 1]; pent >= pmap->blue; pent--)
                 pent->refcnt = AllocPrivate;
             pmap->freeBlue = 0;
-            ppix = malloc(size * sizeof(Pixel));
+            ppix = xallocarray(size, sizeof(Pixel));
             if (!ppix) {
                 free(pmap->clientPixelsGreen[client]);
                 free(pmap->clientPixelsRed[client]);
@@ -702,7 +702,7 @@ UpdateColors(ColormapPtr pmap)
 
     pVisual = pmap->pVisual;
     size = pVisual->ColormapEntries;
-    defs = malloc(size * sizeof(xColorItem));
+    defs = xallocarray(size, sizeof(xColorItem));
     if (!defs)
         return;
     n = 0;
@@ -792,8 +792,8 @@ AllocColor(ColormapPtr pmap,
         *pgreen = pmap->red[pixR].co.local.green;
         *pblue = pmap->red[pixR].co.local.blue;
         npix = pmap->numPixelsRed[client];
-        ppix = (Pixel *) realloc(pmap->clientPixelsRed[client],
-                                 (npix + 1) * sizeof(Pixel));
+        ppix = reallocarray(pmap->clientPixelsRed[client],
+                            npix + 1, sizeof(Pixel));
         if (!ppix)
             return BadAlloc;
         ppix[npix] = pixR;
@@ -814,22 +814,22 @@ AllocColor(ColormapPtr pmap,
         *pgreen = pmap->green[pixG].co.local.green;
         *pblue = pmap->blue[pixB].co.local.blue;
         npix = pmap->numPixelsRed[client];
-        ppix = (Pixel *) realloc(pmap->clientPixelsRed[client],
-                                 (npix + 1) * sizeof(Pixel));
+        ppix = reallocarray(pmap->clientPixelsRed[client],
+                            npix + 1, sizeof(Pixel));
         if (!ppix)
             return BadAlloc;
         ppix[npix] = pixR;
         pmap->clientPixelsRed[client] = ppix;
         npix = pmap->numPixelsGreen[client];
-        ppix = (Pixel *) realloc(pmap->clientPixelsGreen[client],
-                                 (npix + 1) * sizeof(Pixel));
+        ppix = reallocarray(pmap->clientPixelsGreen[client],
+                            npix + 1, sizeof(Pixel));
         if (!ppix)
             return BadAlloc;
         ppix[npix] = pixG;
         pmap->clientPixelsGreen[client] = ppix;
         npix = pmap->numPixelsBlue[client];
-        ppix = (Pixel *) realloc(pmap->clientPixelsBlue[client],
-                                 (npix + 1) * sizeof(Pixel));
+        ppix = reallocarray(pmap->clientPixelsBlue[client],
+                            npix + 1, sizeof(Pixel));
         if (!ppix)
             return BadAlloc;
         ppix[npix] = pixB;
@@ -1279,7 +1279,7 @@ FindColor(ColormapPtr pmap, EntryPtr pentFirst, int size, xrgb * prgb,
         break;
     }
     npix = nump[client];
-    ppix = (Pixel *) realloc(pixp[client], (npix + 1) * sizeof(Pixel));
+    ppix = reallocarray(pixp[client], npix + 1, sizeof(Pixel));
     if (!ppix) {
         pent->refcnt--;
         if (!pent->fShared)
@@ -1647,9 +1647,9 @@ AllocDirect(int client, ColormapPtr pmap, int c, int r, int g, int b,
     for (p = pixels; p < pixels + c; p++)
         *p = 0;
 
-    ppixRed = malloc(npixR * sizeof(Pixel));
-    ppixGreen = malloc(npixG * sizeof(Pixel));
-    ppixBlue = malloc(npixB * sizeof(Pixel));
+    ppixRed = xallocarray(npixR, sizeof(Pixel));
+    ppixGreen = xallocarray(npixG, sizeof(Pixel));
+    ppixBlue = xallocarray(npixB, sizeof(Pixel));
     if (!ppixRed || !ppixGreen || !ppixBlue) {
         free(ppixBlue);
         free(ppixGreen);
@@ -1662,19 +1662,19 @@ AllocDirect(int client, ColormapPtr pmap, int c, int r, int g, int b,
     okB = AllocCP(pmap, pmap->blue, c, b, contig, ppixBlue, pbmask);
 
     if (okR && okG && okB) {
-        rpix = (Pixel *) realloc(pmap->clientPixelsRed[client],
-                                 (pmap->numPixelsRed[client] + (c << r)) *
-                                 sizeof(Pixel));
+        rpix = reallocarray(pmap->clientPixelsRed[client],
+                            pmap->numPixelsRed[client] + (c << r),
+                            sizeof(Pixel));
         if (rpix)
             pmap->clientPixelsRed[client] = rpix;
-        gpix = (Pixel *) realloc(pmap->clientPixelsGreen[client],
-                                 (pmap->numPixelsGreen[client] + (c << g)) *
-                                 sizeof(Pixel));
+        gpix = reallocarray(pmap->clientPixelsGreen[client],
+                            pmap->numPixelsGreen[client] + (c << g),
+                            sizeof(Pixel));
         if (gpix)
             pmap->clientPixelsGreen[client] = gpix;
-        bpix = (Pixel *) realloc(pmap->clientPixelsBlue[client],
-                                 (pmap->numPixelsBlue[client] + (c << b)) *
-                                 sizeof(Pixel));
+        bpix = reallocarray(pmap->clientPixelsBlue[client],
+                            pmap->numPixelsBlue[client] + (c << b),
+                            sizeof(Pixel));
         if (bpix)
             pmap->clientPixelsBlue[client] = bpix;
     }
@@ -1747,7 +1747,7 @@ AllocPseudo(int client, ColormapPtr pmap, int c, int r, Bool contig,
     npix = c << r;
     if ((r >= 32) || (npix > pmap->freeRed) || (npix < c))
         return BadAlloc;
-    if (!(ppixTemp = malloc(npix * sizeof(Pixel))))
+    if (!(ppixTemp = xallocarray(npix, sizeof(Pixel))))
         return BadAlloc;
     ok = AllocCP(pmap, pmap->red, c, r, contig, ppixTemp, pmask);
 
@@ -1755,9 +1755,8 @@ AllocPseudo(int client, ColormapPtr pmap, int c, int r, Bool contig,
 
         /* all the allocated pixels are added to the client pixel list,
          * but only the unique ones are returned to the client */
-        ppix = (Pixel *) realloc(pmap->clientPixelsRed[client],
-                                 (pmap->numPixelsRed[client] +
-                                  npix) * sizeof(Pixel));
+        ppix = reallocarray(pmap->clientPixelsRed[client],
+                            pmap->numPixelsRed[client] + npix, sizeof(Pixel));
         if (!ppix) {
             for (p = ppixTemp; p < ppixTemp + npix; p++)
                 pmap->red[*p].refcnt = 0;
@@ -1960,7 +1959,7 @@ AllocShared(ColormapPtr pmap, Pixel * ppix, int c, int r, int g, int b,
 
     npixClientNew = c << (r + g + b);
     npixShared = (c << r) + (c << g) + (c << b);
-    psharedList = malloc(npixShared * sizeof(SHAREDCOLOR *));
+    psharedList = xallocarray(npixShared, sizeof(SHAREDCOLOR *));
     if (!psharedList)
         return FALSE;
     ppshared = psharedList;
@@ -2204,7 +2203,7 @@ FreeCo(ColormapPtr pmap, int client, int color, int npixIn, Pixel * ppixIn,
                     npix++;
                 }
             }
-            pptr = (Pixel *) realloc(ppixClient, npixNew * sizeof(Pixel));
+            pptr = reallocarray(ppixClient, npixNew, sizeof(Pixel));
             if (pptr)
                 ppixClient = pptr;
             npixClient = npixNew;
@@ -2469,8 +2468,8 @@ IsMapInstalled(Colormap map, WindowPtr pWin)
     Colormap *pmaps;
     int imap, nummaps, found;
 
-    pmaps =
-        malloc(pWin->drawable.pScreen->maxInstalledCmaps * sizeof(Colormap));
+    pmaps = xallocarray(pWin->drawable.pScreen->maxInstalledCmaps,
+                        sizeof(Colormap));
     if (!pmaps)
         return FALSE;
     nummaps = (*pWin->drawable.pScreen->ListInstalledColormaps)
@@ -2521,8 +2520,8 @@ ResizeVisualArray(ScreenPtr pScreen, int new_visual_count, DepthPtr depth)
     first_new_vid = depth->numVids;
     first_new_visual = pScreen->numVisuals;
 
-    vids =
-        realloc(depth->vids, (depth->numVids + new_visual_count) * sizeof(XID));
+    vids = reallocarray(depth->vids, depth->numVids + new_visual_count,
+                        sizeof(XID));
     if (!vids)
         return FALSE;
 
@@ -2530,7 +2529,7 @@ ResizeVisualArray(ScreenPtr pScreen, int new_visual_count, DepthPtr depth)
     depth->vids = vids;
 
     numVisuals = pScreen->numVisuals + new_visual_count;
-    visuals = realloc(pScreen->visuals, numVisuals * sizeof(VisualRec));
+    visuals = reallocarray(pScreen->visuals, numVisuals, sizeof(VisualRec));
     if (!visuals) {
         return FALSE;
     }
diff --git a/dix/devices.c b/dix/devices.c
index d8e7f9c..b2de6f1 100644
--- a/dix/devices.c
+++ b/dix/devices.c
@@ -1469,8 +1469,8 @@ InitStringFeedbackClassDeviceStruct(DeviceIntPtr dev,
     feedc->ctrl.num_symbols_displayed = 0;
     feedc->ctrl.max_symbols = max_symbols;
     feedc->ctrl.symbols_supported =
-        malloc(sizeof(KeySym) * num_symbols_supported);
-    feedc->ctrl.symbols_displayed = malloc(sizeof(KeySym) * max_symbols);
+        xallocarray(num_symbols_supported, sizeof(KeySym));
+    feedc->ctrl.symbols_displayed = xallocarray(max_symbols, sizeof(KeySym));
     if (!feedc->ctrl.symbols_supported || !feedc->ctrl.symbols_displayed) {
         free(feedc->ctrl.symbols_supported);
         free(feedc->ctrl.symbols_displayed);
diff --git a/dix/dispatch.c b/dix/dispatch.c
index 7dcdeab..9208582 100644
--- a/dix/dispatch.c
+++ b/dix/dispatch.c
@@ -344,7 +344,7 @@ Dispatch(void)
     nextFreeClientID = 1;
     nClients = 0;
 
-    clientReady = malloc(sizeof(int) * MaxClients);
+    clientReady = xallocarray(MaxClients, sizeof(int));
     if (!clientReady)
         return;
 
@@ -963,7 +963,7 @@ ProcQueryTree(ClientPtr client)
     if (numChildren) {
         int curChild = 0;
 
-        childIDs = malloc(numChildren * sizeof(Window));
+        childIDs = xallocarray(numChildren, sizeof(Window));
         if (!childIDs)
             return BadAlloc;
         for (pChild = pWin->lastChild; pChild != pHead;
diff --git a/dix/dixfonts.c b/dix/dixfonts.c
index bc2732f..be389e8 100644
--- a/dix/dixfonts.c
+++ b/dix/dixfonts.c
@@ -168,9 +168,8 @@ QueueFontWakeup(FontPathElementPtr fpe)
         }
     }
     if (num_slept_fpes == size_slept_fpes) {
-        new = (FontPathElementPtr *)
-            realloc(slept_fpes,
-                    sizeof(FontPathElementPtr) * (size_slept_fpes + 4));
+        new = reallocarray(slept_fpes, size_slept_fpes + 4,
+                           sizeof(FontPathElementPtr));
         if (!new)
             return;
         slept_fpes = new;
@@ -424,7 +423,7 @@ OpenFont(ClientPtr client, XID fid, Mask flags, unsigned lenfname,
      * copy the current FPE list, so that if it gets changed by another client
      * while we're blocking, the request still appears atomic
      */
-    c->fpe_list = malloc(sizeof(FontPathElementPtr) * num_fpes);
+    c->fpe_list = xallocarray(num_fpes, sizeof(FontPathElementPtr));
     if (!c->fpe_list) {
         free((void *) c->fontname);
         free(c);
@@ -821,7 +820,7 @@ ListFonts(ClientPtr client, unsigned char *pattern, unsigned length,
 
     if (!(c = malloc(sizeof *c)))
         return BadAlloc;
-    c->fpe_list = malloc(sizeof(FontPathElementPtr) * num_fpes);
+    c->fpe_list = xallocarray(num_fpes, sizeof(FontPathElementPtr));
     if (!c->fpe_list) {
         free(c);
         return BadAlloc;
@@ -1072,7 +1071,7 @@ StartListFontsWithInfo(ClientPtr client, int length, unsigned char *pattern,
 
     if (!(c = malloc(sizeof *c)))
         goto badAlloc;
-    c->fpe_list = malloc(sizeof(FontPathElementPtr) * num_fpes);
+    c->fpe_list = xallocarray(num_fpes, sizeof(FontPathElementPtr));
     if (!c->fpe_list) {
         free(c);
         goto badAlloc;
@@ -1441,7 +1440,7 @@ doImageText(ClientPtr client, ITclosurePtr c)
             *new_closure = *c;
             c = new_closure;
 
-            data = malloc(c->nChars * itemSize);
+            data = xallocarray(c->nChars, itemSize);
             if (!data) {
                 free(c);
                 c = old_closure;
@@ -1597,7 +1596,7 @@ SetFontPathElements(int npaths, unsigned char *paths, int *bad, Bool persist)
     unsigned char *cp = paths;
     FontPathElementPtr fpe = NULL, *fplist;
 
-    fplist = malloc(sizeof(FontPathElementPtr) * npaths);
+    fplist = xallocarray(npaths, sizeof(FontPathElementPtr));
     if (!fplist) {
         *bad = 0;
         return BadAlloc;
@@ -1894,8 +1893,7 @@ RegisterFPEFunctions(NameCheckFunc name_func,
     FPEFunctions *new;
 
     /* grow the list */
-    new = (FPEFunctions *) realloc(fpe_functions,
-                                   (num_fpe_types + 1) * sizeof(FPEFunctions));
+    new = reallocarray(fpe_functions, num_fpe_types + 1, sizeof(FPEFunctions));
     if (!new)
         return -1;
     fpe_functions = new;
diff --git a/dix/enterleave.c b/dix/enterleave.c
index 54f4b85..7f1f941 100644
--- a/dix/enterleave.c
+++ b/dix/enterleave.c
@@ -714,7 +714,7 @@ DeliverStateNotifyEvent(DeviceIntPtr dev, WindowPtr win)
         }
     }
 
-    sev = ev = (deviceStateNotify *) malloc(evcount * sizeof(xEvent));
+    sev = ev = xallocarray(evcount, sizeof(xEvent));
     FixDeviceStateNotify(dev, ev, NULL, NULL, NULL, first);
 
     if (b != NULL) {
diff --git a/dix/events.c b/dix/events.c
index c232eba..7d2bb6b 100644
--- a/dix/events.c
+++ b/dix/events.c
@@ -4785,8 +4785,8 @@ SetInputFocus(ClientPtr client,
             depth++;
         if (depth > focus->traceSize) {
             focus->traceSize = depth + 1;
-            focus->trace = realloc(focus->trace,
-                                   focus->traceSize * sizeof(WindowPtr));
+            focus->trace = reallocarray(focus->trace, focus->traceSize,
+                                        sizeof(WindowPtr));
         }
         focus->traceGood = depth;
         for (pWin = focusWin, depth--; pWin; pWin = pWin->parent, depth--)
diff --git a/dix/extension.c b/dix/extension.c
index 56e3abc..e81f673 100644
--- a/dix/extension.c
+++ b/dix/extension.c
@@ -103,8 +103,7 @@ AddExtension(const char *name, int NumEvents, int NumErrors,
         return ((ExtensionEntry *) NULL);
     }
     i = NumExtensions;
-    newexts = (ExtensionEntry **) realloc(extensions,
-                                          (i + 1) * sizeof(ExtensionEntry *));
+    newexts = reallocarray(extensions, i + 1, sizeof(ExtensionEntry *));
     if (!newexts) {
         free((void *) ext->name);
         dixFreePrivates(ext->devPrivates, PRIVATE_EXTENSION);
@@ -153,8 +152,7 @@ AddExtensionAlias(const char *alias, ExtensionEntry * ext)
 
     if (!ext)
         return FALSE;
-    aliases = realloc(ext->aliases,
-                      (ext->num_aliases + 1) * sizeof(char *));
+    aliases = reallocarray(ext->aliases, ext->num_aliases + 1, sizeof(char *));
     if (!aliases)
         return FALSE;
     ext->aliases = aliases;
diff --git a/dix/grabs.c b/dix/grabs.c
index b92f1e7..2a307a2 100644
--- a/dix/grabs.c
+++ b/dix/grabs.c
@@ -594,10 +594,10 @@ DeletePassiveGrabFromList(GrabPtr pMinuendGrab)
         i++;
     if (!i)
         return TRUE;
-    deletes = malloc(i * sizeof(GrabPtr));
-    adds = malloc(i * sizeof(GrabPtr));
-    updates = malloc(i * sizeof(Mask **));
-    details = malloc(i * sizeof(Mask *));
+    deletes = xallocarray(i, sizeof(GrabPtr));
+    adds = xallocarray(i, sizeof(GrabPtr));
+    updates = xallocarray(i, sizeof(Mask **));
+    details = xallocarray(i, sizeof(Mask *));
     if (!deletes || !adds || !updates || !details) {
         free(details);
         free(updates);
diff --git a/dix/property.c b/dix/property.c
index ff7f31a..99608af 100644
--- a/dix/property.c
+++ b/dix/property.c
@@ -136,8 +136,8 @@ ProcRotateProperties(ClientPtr client)
         return rc;
 
     atoms = (Atom *) &stuff[1];
-    props = malloc(stuff->nAtoms * sizeof(PropertyPtr));
-    saved = malloc(stuff->nAtoms * sizeof(PropertyRec));
+    props = xallocarray(stuff->nAtoms, sizeof(PropertyPtr));
+    saved = xallocarray(stuff->nAtoms, sizeof(PropertyRec));
     if (!props || !saved) {
         rc = BadAlloc;
         goto out;
@@ -313,7 +313,7 @@ dixChangeWindowProperty(ClientPtr pClient, WindowPtr pWin, Atom property,
             /* do nothing */
         }
         else if (mode == PropModeAppend) {
-            data = malloc((pProp->size + len) * sizeInBytes);
+            data = xallocarray(pProp->size + len, sizeInBytes);
             if (!data)
                 return BadAlloc;
             memcpy(data, pProp->data, pProp->size * sizeInBytes);
@@ -322,7 +322,7 @@ dixChangeWindowProperty(ClientPtr pClient, WindowPtr pWin, Atom property,
             pProp->size += len;
         }
         else if (mode == PropModePrepend) {
-            data = malloc(sizeInBytes * (len + pProp->size));
+            data = xallocarray(len + pProp->size, sizeInBytes);
             if (!data)
                 return BadAlloc;
             memcpy(data + totalSize, pProp->data, pProp->size * sizeInBytes);
@@ -581,7 +581,7 @@ ProcListProperties(ClientPtr client)
     for (pProp = wUserProps(pWin); pProp; pProp = pProp->next)
         numProps++;
 
-    if (numProps && !(pAtoms = malloc(numProps * sizeof(Atom))))
+    if (numProps && !(pAtoms = xallocarray(numProps, sizeof(Atom))))
         return BadAlloc;
 
     numProps = 0;
diff --git a/dix/region.c b/dix/region.c
index 04e5901..fd73139 100644
--- a/dix/region.c
+++ b/dix/region.c
@@ -1247,7 +1247,7 @@ RegionValidate(RegionPtr badreg, Bool *pOverlap)
         if (sizeRI == numRI) {
             /* Oops, allocate space for new region information */
             sizeRI <<= 1;
-            rit = (RegionInfo *) realloc(ri, sizeRI * sizeof(RegionInfo));
+            rit = (RegionInfo *) reallocarray(ri, sizeRI, sizeof(RegionInfo));
             if (!rit)
                 goto bail;
             ri = rit;
diff --git a/dix/resource.c b/dix/resource.c
index 964f0b3..af8e162 100644
--- a/dix/resource.c
+++ b/dix/resource.c
@@ -510,7 +510,7 @@ CreateNewResourceType(DeleteType deleteFunc, const char *name)
 
     if (next & lastResourceClass)
         return 0;
-    types = realloc(resourceTypes, (next + 1) * sizeof(*resourceTypes));
+    types = reallocarray(resourceTypes, next + 1, sizeof(*resourceTypes));
     if (!types)
         return 0;
 
@@ -834,10 +834,10 @@ RebuildTable(int client)
      */
 
     j = 2 * clientTable[client].buckets;
-    tails = malloc(j * sizeof(ResourcePtr *));
+    tails =  xallocarray(j, sizeof(ResourcePtr *));
     if (!tails)
         return;
-    resources = malloc(j * sizeof(ResourcePtr));
+    resources =  xallocarray(j, sizeof(ResourcePtr));
     if (!resources) {
         free(tails);
         return;
diff --git a/dix/touch.c b/dix/touch.c
index 1eeed78..49d16ab 100644
--- a/dix/touch.c
+++ b/dix/touch.c
@@ -101,7 +101,7 @@ TouchResizeQueue(ClientPtr client, void *closure)
          * don't need to do it often */
         size = dev->last.num_touches + dev->last.num_touches / 2 + 1;
 
-        tmp = realloc(dev->last.touches, size * sizeof(*dev->last.touches));
+        tmp = reallocarray(dev->last.touches, size, sizeof(*dev->last.touches));
         if (tmp) {
             int j;
 
@@ -350,7 +350,7 @@ TouchBeginTouch(DeviceIntPtr dev, int sourceid, uint32_t touchid,
 
     /* If we get here, then we've run out of touches: enlarge dev->touch and
      * try again. */
-    tmp = realloc(t->touches, (t->num_touches + 1) * sizeof(*ti));
+    tmp = reallocarray(t->touches, t->num_touches + 1, sizeof(*ti));
     if (tmp) {
         t->touches = tmp;
         t->num_touches++;
@@ -547,8 +547,8 @@ TouchBuildDependentSpriteTrace(DeviceIntPtr dev, SpritePtr sprite)
         return FALSE;
 
     if (srcsprite->spriteTraceGood > sprite->spriteTraceSize) {
-        trace = realloc(sprite->spriteTrace,
-                        srcsprite->spriteTraceSize * sizeof(*trace));
+        trace = reallocarray(sprite->spriteTrace,
+                             srcsprite->spriteTraceSize, sizeof(*trace));
         if (!trace) {
             sprite->spriteTraceGood = 0;
             return FALSE;
commit df4e41fdb47cdeab5155224557ed8ab4ec4dc659
Author: Alan Coopersmith <alan.coopersmith at oracle.com>
Date:   Sat Mar 21 10:08:25 2015 -0700

    Convert os/* to new *allocarray functions
    
    v2: remove now useless parentheses
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Reviewed-by: Matt Turner <mattst88 at gmail.com>

diff --git a/os/connection.c b/os/connection.c
index 7ff44e1..c36b125 100644
--- a/os/connection.c
+++ b/os/connection.c
@@ -309,7 +309,7 @@ InitConnectionLimits(void)
 
 #if !defined(WIN32)
     if (!ConnectionTranslation)
-        ConnectionTranslation = (int *) xnfalloc(sizeof(int) * (lastfdesc + 1));
+        ConnectionTranslation = xnfallocarray(lastfdesc + 1, sizeof(int));
 #else
     InitConnectionTranslation();
 #endif
@@ -429,7 +429,9 @@ CreateWellKnownSockets(void)
         display = dynamic_display;
     }
 
-    ListenTransFds = malloc(ListenTransCount * sizeof (int));
+    ListenTransFds = xallocarray(ListenTransCount, sizeof (int));
+    if (ListenTransFds == NULL)
+        FatalError ("Failed to create listening socket array");
 
     for (i = 0; i < ListenTransCount; i++) {
         int fd = _XSERVTransGetConnectionNumber(ListenTransConns[i]);
@@ -1291,11 +1293,10 @@ ListenOnOpenFD(int fd, int noxauth)
 
     /* Allocate space to store it */
     ListenTransFds =
-        (int *) realloc(ListenTransFds, (ListenTransCount + 1) * sizeof(int));
+        xnfreallocarray(ListenTransFds, ListenTransCount + 1, sizeof(int));
     ListenTransConns =
-        (XtransConnInfo *) realloc(ListenTransConns,
-                                   (ListenTransCount +
-                                    1) * sizeof(XtransConnInfo));
+        xnfreallocarray(ListenTransConns, ListenTransCount + 1,
+                        sizeof(XtransConnInfo));
 
     /* Store it */
     ListenTransConns[ListenTransCount] = ciptr;
diff --git a/os/utils.c b/os/utils.c
index 23f4117..aef52c4 100644
--- a/os/utils.c
+++ b/os/utils.c
@@ -2001,7 +2001,7 @@ xstrtokenize(const char *str, const char *separators)
     if (!tmp)
         goto error;
     for (tok = strtok(tmp, separators); tok; tok = strtok(NULL, separators)) {
-        nlist = realloc(list, (num + 2) * sizeof(*list));
+        nlist = reallocarray(list, num + 2, sizeof(*list));
         if (!nlist)
             goto error;
         list = nlist;
commit ae75d50395fdd7a6bc382ba73e923c460764c702
Author: Alan Coopersmith <alan.coopersmith at oracle.com>
Date:   Sat Mar 21 09:28:07 2015 -0700

    Add no-fail equivalents of allocarray & reallocarray
    
    v2: Remove extra 's' from comment
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Reviewed-by: Matt Turner <mattst88 at gmail.com>

diff --git a/include/os.h b/include/os.h
index 2633741..6638c84 100644
--- a/include/os.h
+++ b/include/os.h
@@ -76,6 +76,8 @@ typedef struct _NewClientRec *NewClientPtr;
 #define xnfstrdup(s) XNFstrdup(s)
 
 #define xallocarray(num, size) reallocarray(NULL, (num), (size))
+#define xnfallocarray(num, size) XNFreallocarray(NULL, (num), (size))
+#define xnfreallocarray(ptr, num, size) XNFreallocarray((ptr), (num), (size))
 #endif
 
 #include <stdio.h>
@@ -241,6 +243,13 @@ extern _X_EXPORT void *
 XNFrealloc(void * /*ptr */ , unsigned long /*amount */ );
 
 /*
+ * This function reallocarray(3)s passed buffer, terminating the server if
+ * there is not enough memory or the arguments overflow when multiplied.
+ */
+extern _X_EXPORT void *
+XNFreallocarray(void *ptr, size_t nmemb, size_t size);
+
+/*
  * This function strdup(3)s passed string. The only difference from the library
  * function that it is safe to pass NULL, as NULL will be returned.
  */
diff --git a/os/utils.c b/os/utils.c
index 24a8751..23f4117 100644
--- a/os/utils.c
+++ b/os/utils.c
@@ -1158,6 +1158,16 @@ XNFrealloc(void *ptr, unsigned long amount)
     return ret;
 }
 
+void *
+XNFreallocarray(void *ptr, size_t nmemb, size_t size)
+{
+    void *ret = reallocarray(ptr, nmemb, size);
+
+    if (!ret)
+        FatalError("XNFreallocarray: Out of memory");
+    return ret;
+}
+
 char *
 Xstrdup(const char *s)
 {
commit c213b29d14aaf2f4523d638abc762eaaa873cf83
Author: Alan Coopersmith <alan.coopersmith at oracle.com>
Date:   Sat Mar 21 08:58:04 2015 -0700

    Add xallocarray() helper macro
    
    Uses reallocarray to perform integer overflow detection when allocating
    an array, using NULL as the previous pointer to force a new allocation.
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Reviewed-by: Matt Turner <mattst88 at gmail.com>

diff --git a/include/os.h b/include/os.h
index ffa5f39..2633741 100644
--- a/include/os.h
+++ b/include/os.h
@@ -74,6 +74,8 @@ typedef struct _NewClientRec *NewClientPtr;
 
 #define xstrdup(s) Xstrdup(s)
 #define xnfstrdup(s) XNFstrdup(s)
+
+#define xallocarray(num, size) reallocarray(NULL, (num), (size))
 #endif
 
 #include <stdio.h>
commit 0887c9463fc7d36d7874e7f978df4109542f7307
Author: Alan Coopersmith <alan.coopersmith at oracle.com>
Date:   Sat Mar 21 08:42:19 2015 -0700

    Import reallocarray() from OpenBSD
    
    Wrapper for realloc() that checks for overflow when multiplying
    arguments together, so we don't have to add overflow checks to
    every single call.  For documentation on usage, see:
    http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man3/calloc.3
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Acked-by: Matt Turner <mattst88 at gmail.com>

diff --git a/configure.ac b/configure.ac
index 606298b..a5bdbbf 100644
--- a/configure.ac
+++ b/configure.ac
@@ -219,7 +219,7 @@ dnl Checks for library functions.
 AC_CHECK_FUNCS([backtrace ffs geteuid getuid issetugid getresuid \
 	getdtablesize getifaddrs getpeereid getpeerucred getprogname getzoneid \
 	mmap seteuid shmctl64 strncasecmp vasprintf vsnprintf walkcontext])
-AC_REPLACE_FUNCS([strcasecmp strcasestr strlcat strlcpy strndup])
+AC_REPLACE_FUNCS([reallocarray strcasecmp strcasestr strlcat strlcpy strndup])
 
 AC_CHECK_DECLS([program_invocation_short_name], [], [], [[#include <errno.h>]])
 
diff --git a/include/dix-config.h.in b/include/dix-config.h.in
index 1aa77a5..86cf6f2 100644
--- a/include/dix-config.h.in
+++ b/include/dix-config.h.in
@@ -149,6 +149,9 @@
 /* Define to 1 if you have the <ndir.h> header file, and it defines `DIR'. */
 #undef HAVE_NDIR_H
 
+/* Define to 1 if you have the `reallocarray' function. */
+#undef HAVE_REALLOCARRAY
+
 /* Define to 1 if you have the <rpcsvc/dbm.h> header file. */
 #undef HAVE_RPCSVC_DBM_H
 
diff --git a/include/os.h b/include/os.h
index 9d8b859..ffa5f39 100644
--- a/include/os.h
+++ b/include/os.h
@@ -517,7 +517,14 @@ ddxGiveUp(enum ExitCode error);
 extern _X_EXPORT int
 TimeSinceLastInputEvent(void);
 
-/* strcasecmp.c */
+/* Function fallbacks provided by AC_REPLACE_FUNCS in configure.ac */
+
+#ifndef HAVE_REALLOCARRAY
+#define reallocarray xreallocarray
+extern _X_EXPORT void *
+reallocarray(void *optr, size_t nmemb, size_t size);
+#endif
+
 #ifndef HAVE_STRCASECMP
 #define strcasecmp xstrcasecmp
 extern _X_EXPORT int
diff --git a/include/xorg-server.h.in b/include/xorg-server.h.in
index 4cb9487..3152dbd 100644
--- a/include/xorg-server.h.in
+++ b/include/xorg-server.h.in
@@ -47,6 +47,9 @@
 /* Define to 1 if you have the `ffs' function. */
 #undef HAVE_FFS
 
+/* Define to 1 if you have the `reallocarray' function. */
+#undef HAVE_REALLOCARRAY
+
 /* Define to 1 if you have the `strcasecmp' function. */
 #undef HAVE_STRCASECMP
 
diff --git a/os/reallocarray.c b/os/reallocarray.c
new file mode 100644
index 0000000..c415e09
--- /dev/null
+++ b/os/reallocarray.c
@@ -0,0 +1,43 @@
+/*	$OpenBSD: reallocarray.c,v 1.2 2014/12/08 03:45:00 bcook Exp $	*/
+/*
+ * Copyright (c) 2008 Otto Moerbeek <otto at drijf.net>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifdef HAVE_DIX_CONFIG_H
+#include <dix-config.h>
+#endif
+
+#include <sys/types.h>
+#include <errno.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include "os.h"
+
+/*
+ * This is sqrt(SIZE_MAX+1), as s1*s2 <= SIZE_MAX
+ * if both s1 < MUL_NO_OVERFLOW and s2 < MUL_NO_OVERFLOW
+ */
+#define MUL_NO_OVERFLOW	((size_t)1 << (sizeof(size_t) * 4))
+
+void *
+reallocarray(void *optr, size_t nmemb, size_t size)
+{
+	if ((nmemb >= MUL_NO_OVERFLOW || size >= MUL_NO_OVERFLOW) &&
+	    nmemb > 0 && SIZE_MAX / nmemb < size) {
+		errno = ENOMEM;
+		return NULL;
+	}
+	return realloc(optr, size * nmemb);
+}
commit b96dc999968320ad6322b50c79d847efcfcd02b2
Author: Alan Coopersmith <alan.coopersmith at oracle.com>
Date:   Sat Mar 21 15:21:14 2015 -0700

    Add XNFcallocarray() to allow xnfcalloc() to check for overflow
    
    The xnfcalloc() macro took two arguments but simply multiplied them
    together without checking for overflow and defeating any overflow
    checking that calloc() might have done.  Let's not do that.
    
    The original XNFcalloc() function is left for now to preserve driver
    ABI, but is marked as deprecated so it can be removed in a future round
    of ABI break/cleanup.
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Reviewed-by: Matt Turner <mattst88 at gmail.com>

diff --git a/config/config.c b/config/config.c
index b5d634b..de45cc3 100644
--- a/config/config.c
+++ b/config/config.c
@@ -130,7 +130,8 @@ device_is_duplicate(const char *config_info)
 struct OdevAttributes *
 config_odev_allocate_attributes(void)
 {
-    struct OdevAttributes *attribs = XNFcalloc(sizeof (struct OdevAttributes));
+    struct OdevAttributes *attribs =
+        xnfcalloc(1, sizeof (struct OdevAttributes));
     attribs->fd = -1;
     return attribs;
 }
diff --git a/hw/xfree86/utils/cvt/cvt.c b/hw/xfree86/utils/cvt/cvt.c
index d5df17f..9413c20 100644
--- a/hw/xfree86/utils/cvt/cvt.c
+++ b/hw/xfree86/utils/cvt/cvt.c
@@ -54,11 +54,11 @@ XNFalloc(unsigned long n)
 
 /* xnfcalloc implementation used by the server code we built in */
 void *
-XNFcalloc(unsigned long n)
+XNFcallocarray(size_t nmemb, size_t size)
 {
     void *r;
 
-    r = calloc(1, n);
+    r = calloc(nmemb, size);
     if (!r) {
         perror("calloc failed");
         exit(1);
diff --git a/include/os.h b/include/os.h
index 3e68c49..9d8b859 100644
--- a/include/os.h
+++ b/include/os.h
@@ -69,7 +69,7 @@ typedef struct _NewClientRec *NewClientPtr;
 
 #ifndef xnfalloc
 #define xnfalloc(size) XNFalloc((unsigned long)(size))
-#define xnfcalloc(_num, _size) XNFcalloc((unsigned long)(_num)*(unsigned long)(_size))
+#define xnfcalloc(_num, _size) XNFcallocarray((_num), (_size))
 #define xnfrealloc(ptr, size) XNFrealloc((void *)(ptr), (unsigned long)(size))
 
 #define xstrdup(s) Xstrdup(s)
@@ -222,7 +222,14 @@ XNFalloc(unsigned long /*amount */ );
  * enough memory.
  */
 extern _X_EXPORT void *
-XNFcalloc(unsigned long /*amount */ );
+XNFcalloc(unsigned long /*amount */ ) _X_DEPRECATED;
+
+/*
+ * This function calloc(3)s buffer, terminating the server if there is not
+ * enough memory or the arguments overflow when multiplied
+ */
+extern _X_EXPORT void *
+XNFcallocarray(size_t nmemb, size_t size);
 
 /*
  * This function realloc(3)s passed buffer, terminating the server if there is
diff --git a/os/utils.c b/os/utils.c
index 75769f1..24a8751 100644
--- a/os/utils.c
+++ b/os/utils.c
@@ -1128,10 +1128,20 @@ XNFalloc(unsigned long amount)
     return ptr;
 }
 
+/* The original XNFcalloc was used with the xnfcalloc macro which multiplied
+ * the arguments at the call site without allowing calloc to check for overflow.
+ * XNFcallocarray was added to fix that without breaking ABI.
+ */
 void *
 XNFcalloc(unsigned long amount)
 {
-    void *ret = calloc(1, amount);
+    return XNFcallocarray(1, amount);
+}
+
+void *
+XNFcallocarray(size_t nmemb, size_t size)
+{
+    void *ret = calloc(nmemb, size);
 
     if (!ret)
         FatalError("XNFcalloc: Out of memory");
commit f3ba909753cd216fc9eca4618a76cc283ccbf51e
Author: Alan Coopersmith <alan.coopersmith at oracle.com>
Date:   Sat Mar 21 11:07:24 2015 -0700

    Let calloc handle multiplication
    
    It's going to multiply anyway, so if we have non-constant values, might
    as well let it do the multiplication instead of adding another multiply,
    and good versions of calloc will check for & avoid overflow in the process.
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Reviewed-by: Matt Turner <mattst88 at gmail.com>

diff --git a/Xext/panoramiXprocs.c b/Xext/panoramiXprocs.c
index 413a66a..5291a4a 100644
--- a/Xext/panoramiXprocs.c
+++ b/Xext/panoramiXprocs.c
@@ -1106,7 +1106,7 @@ PanoramiXCopyArea(ClientPtr client)
         }
 
         pitch = PixmapBytePad(stuff->width, drawables[0]->depth);
-        if (!(data = calloc(1, stuff->height * pitch)))
+        if (!(data = calloc(stuff->height, pitch)))
             return BadAlloc;
 
         XineramaGetImageData(drawables, srcx, srcy,
diff --git a/Xi/xiquerypointer.c b/Xi/xiquerypointer.c
index 7ec0c85..b9e2958 100644
--- a/Xi/xiquerypointer.c
+++ b/Xi/xiquerypointer.c
@@ -152,10 +152,10 @@ ProcXIQueryPointer(ClientPtr client)
         rep.buttons_len =
             bytes_to_int32(bits_to_bytes(pDev->button->numButtons));
         rep.length += rep.buttons_len;
-        buttons_size = rep.buttons_len * 4;
-        buttons = calloc(1, buttons_size);
+        buttons = calloc(rep.buttons_len, 4);
         if (!buttons)
             return BadAlloc;
+        buttons_size = rep.buttons_len * 4;
 
         for (i = 1; i < pDev->button->numButtons; i++)
             if (BitIsOn(pDev->button->down, i))
diff --git a/dix/dispatch.c b/dix/dispatch.c
index 17fa75e..7dcdeab 100644
--- a/dix/dispatch.c
+++ b/dix/dispatch.c
@@ -2786,7 +2786,7 @@ ProcQueryColors(ClientPtr client)
 
         count =
             bytes_to_int32((client->req_len << 2) - sizeof(xQueryColorsReq));
-        prgbs = calloc(1, count * sizeof(xrgb));
+        prgbs = calloc(count, sizeof(xrgb));
         if (!prgbs && count)
             return BadAlloc;
         if ((rc =
@@ -2908,10 +2908,10 @@ ProcCreateCursor(ClientPtr client)
     if (stuff->x > width || stuff->y > height)
         return BadMatch;
 
-    n = BitmapBytePad(width) * height;
-    srcbits = calloc(1, n);
+    srcbits = calloc(BitmapBytePad(width), height);
     if (!srcbits)
         return BadAlloc;
+    n = BitmapBytePad(width) * height;
     mskbits = malloc(n);
     if (!mskbits) {
         free(srcbits);
diff --git a/dix/glyphcurs.c b/dix/glyphcurs.c
index eca6a4c..3ff6ae8 100644
--- a/dix/glyphcurs.c
+++ b/dix/glyphcurs.c
@@ -78,7 +78,6 @@ ServerBitsFromGlyph(FontPtr pfont, unsigned ch, CursorMetricPtr cm,
     GCPtr pGC;
     xRectangle rect;
     PixmapPtr ppix;
-    long nby;
     char *pbits;
     ChangeGCVal gcval[3];
     unsigned char char2b[2];
@@ -88,8 +87,7 @@ ServerBitsFromGlyph(FontPtr pfont, unsigned ch, CursorMetricPtr cm,
     char2b[1] = (unsigned char) (ch & 0xff);
 
     pScreen = screenInfo.screens[0];
-    nby = BitmapBytePad(cm->width) * (long) cm->height;
-    pbits = calloc(1, nby);
+    pbits = calloc(BitmapBytePad(cm->width), cm->height);
     if (!pbits)
         return BadAlloc;
 
diff --git a/hw/xfree86/common/xf86Bus.c b/hw/xfree86/common/xf86Bus.c
index 889294f..02f7bf2 100644
--- a/hw/xfree86/common/xf86Bus.c
+++ b/hw/xfree86/common/xf86Bus.c
@@ -260,7 +260,7 @@ xf86AllocateEntity(void)
                               sizeof(EntityPtr) * xf86NumEntities);
     xf86Entities[xf86NumEntities - 1] = xnfcalloc(1, sizeof(EntityRec));
     xf86Entities[xf86NumEntities - 1]->entityPrivates =
-        xnfcalloc(sizeof(DevUnion) * xf86EntityPrivateCount, 1);
+        xnfcalloc(xf86EntityPrivateCount, sizeof(DevUnion));
     return xf86NumEntities - 1;
 }
 
diff --git a/hw/xfree86/common/xf86Config.c b/hw/xfree86/common/xf86Config.c
index d42572f..098d2dd 100644
--- a/hw/xfree86/common/xf86Config.c
+++ b/hw/xfree86/common/xf86Config.c
@@ -1502,7 +1502,7 @@ configLayout(serverLayoutPtr servlayoutp, XF86ConfLayoutPtr conf_layout,
     if (!count)                 /* alloc enough storage even if no screen is specified */
         count = 1;
 
-    slp = xnfcalloc(1, (count + 1) * sizeof(screenLayoutRec));
+    slp = xnfcalloc((count + 1), sizeof(screenLayoutRec));
     slp[count].screen = NULL;
     /*
      * now that we have storage, loop over the list again and fill in our
diff --git a/hw/xfree86/common/xf86Configure.c b/hw/xfree86/common/xf86Configure.c
index cc7ff1b..7ab378f 100644
--- a/hw/xfree86/common/xf86Configure.c
+++ b/hw/xfree86/common/xf86Configure.c
@@ -645,10 +645,10 @@ DoConfigure(void)
 
     xf86DoConfigurePass1 = FALSE;
 
-    dev2screen = xnfcalloc(1, xf86NumDrivers * sizeof(int));
+    dev2screen = xnfcalloc(xf86NumDrivers, sizeof(int));
 
     {
-        Bool *driverProbed = xnfcalloc(1, xf86NumDrivers * sizeof(Bool));
+        Bool *driverProbed = xnfcalloc(xf86NumDrivers, sizeof(Bool));
 
         for (screennum = 0; screennum < nDevToConfig; screennum++) {
             int k, l, n, oldNumScreens;
commit a28202a148508837911c5932a0d14af4b145bece
Author: Alan Coopersmith <alan.coopersmith at oracle.com>
Date:   Sat Mar 21 08:19:30 2015 -0700

    Remove remaining doc references to Xalloc, Xrealloc, and Xfree
    
    Functions were removed in commit cad9b053d52f62432
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Reviewed-by: Matt Turner <mattst88 at gmail.com>

diff --git a/doc/Xserver-spec.xml b/doc/Xserver-spec.xml
index 4c34419..72a544b 100644
--- a/doc/Xserver-spec.xml
+++ b/doc/Xserver-spec.xml
@@ -1992,7 +1992,7 @@ regions, these blocks may need to be reallocated by your region
 software.  For instance, in the sample server, a RegionRec has some
 header information and a pointer to a dynamically allocated rectangle
 list.  Periodically, the rectangle list needs to be expanded with
-Xrealloc(), whereupon the new pointer is remembered in the RegionRec.</para>
+realloc(), whereupon the new pointer is remembered in the RegionRec.</para>
 <para>
 Most of the region operations come in two forms: a function pointer in
 the Screen structure, and a macro.  The server can be compiled so that
@@ -2598,7 +2598,7 @@ VisualRec data structure along with other display characteristics like the
 depth and other numbers.</para>
 <para>
 The allowable DepthRec's and VisualRec's are pointed to by fields in the ScreenRec.
-These are set up when InitOutput() is called; you should Xalloc() appropriate blocks
+These are set up when InitOutput() is called; you should malloc() appropriate blocks
 or use static variables initialized to the correct values.</para>
 </section>
 <section>
@@ -3897,7 +3897,7 @@ for CT_NONE, etc. are in Xserver/include/gc.h.)  This routine is
 responsible for incrementing any necessary reference counts (e.g. for
 a pixmap clip mask) for the new clipmask and freeing anything that
 used to be in the GC's clipMask field.  The lists of rectangles passed
-in can be freed with Xfree(), the regions can be destroyed with the
+in can be freed with free(), the regions can be destroyed with the
 RegionDestroy field in the screen, and pixmaps can be destroyed by
 calling the screen's DestroyPixmap function.  DIX and MI code expect
 what they pass in to this to be freed or otherwise inaccessible, and
@@ -5104,9 +5104,6 @@ mi and fb implementations.</para>
 <row><entry><function>WaitForSomething</function></entry><entry><literal>os</literal></entry><entry><para></para></entry></row>
 <row><entry><function>WindowExposures</function></entry><entry><literal>mi</literal></entry><entry><para>Window</para></entry></row>
 <row><entry><function>WriteToClient</function></entry><entry><literal>os</literal></entry><entry><para></para></entry></row>
-<row><entry><function>Xalloc</function></entry><entry><literal>os</literal></entry><entry><para></para></entry></row>
-<row><entry><function>Xfree</function></entry><entry><literal>os</literal></entry><entry><para></para></entry></row>
-<row><entry><function>Xrealloc</function></entry><entry><literal>os</literal></entry><entry><para></para></entry></row>
 	    </tbody>
 	  </tgroup>
 	</table>
commit 2a6d253b3f2ec4775412b4ae96a96b0b668ec827
Author: Alan Coopersmith <alan.coopersmith at oracle.com>
Date:   Sat Feb 28 10:04:09 2015 -0800

    Remove apSolaris.shar (old "aperture" kernel driver for Solaris)
    
    Modern Solaris releases provide this functionality in the OS via the
    xsvc driver.   Since the move to libpciaccess, nothing in Xorg uses
    this aperture driver any more.
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>

diff --git a/hw/xfree86/os-support/solaris/Makefile.am b/hw/xfree86/os-support/solaris/Makefile.am
index 6cda4b3..e534bc8 100644
--- a/hw/xfree86/os-support/solaris/Makefile.am
+++ b/hw/xfree86/os-support/solaris/Makefile.am
@@ -33,5 +33,4 @@ AM_CFLAGS = -DUSESTDRES -DHAVE_SYSV_IPC $(XORG_CFLAGS) $(DIX_CFLAGS)
 
 AM_CPPFLAGS = $(XORG_INCS) 
 
-EXTRA_DIST = solaris-amd64.S solaris-ia32.S solaris-sparcv8plus.S \
-	apSolaris.shar sun_inout.s
+EXTRA_DIST = solaris-amd64.S solaris-ia32.S solaris-sparcv8plus.S sun_inout.s
diff --git a/hw/xfree86/os-support/solaris/apSolaris.shar b/hw/xfree86/os-support/solaris/apSolaris.shar
deleted file mode 100644
index a3548f7..0000000
--- a/hw/xfree86/os-support/solaris/apSolaris.shar
+++ /dev/null
@@ -1,806 +0,0 @@
-#!/bin/sh
-#
-# This is a shell archive.  Save it in a file, remove anything before
-# this line, and then unpack it by entering "sh file".  Note, it may
-# create directories; files and directories will be owned by you and
-# have default permissions.
-# Made on Sun Jun 25 20:24:59 CEST 2006 by Martin Bochnig at martux.org
-#
-# This archive contains:
-#
-#	./aperture
-#	
-#	./aperture/Makefile
-#	./aperture/Makefile.amd64
-#	./aperture/Makefile.sparcv9
-#	./aperture/README
-#	./aperture/aperture.c
-#	./aperture/aperture.conf
-#	./aperture/devlink.tab
-#
-echo c - ./aperture
-mkdir -p ./aperture > /dev/null 2>&1
-#
-echo x - ./aperture/Makefile
-sed 's/^X//' >./aperture/Makefile << 'END-of-./aperture/Makefile'
-X#
-X#   File: makefile for aperture Framebuffer Driver
-X# Author: Doug Anson (danson at lgc.com)
-X#   Date: 2/15/94
-X# Modified: David Holland (davidh at use.com)
-X#   Date: 2/23/94
-X#   - Changed name, and debugging structure
-X# Modified: Marc Aurele La France (tsi at xfree86.org)
-X#   Date: 2001.06.08
-X#   - SPARC support, cleanup and turf aptest.
-X#
-X# >>NOTE<< Have a look at Makefile.sparcv9 for  specifics.
-X#
-X# Modified: Martin Bochnig (martin at martux.org)
-X#   Date: 2006.06.24
-X#   - Slightly modified to also build on Solaris 10 and 11.
-X#   - amd64 64 bit kernel support
-X#   - cosmetical changes to also support sun4v, not only sun4u
-X#
-X# >>NOTE<< Have a look at Makefile.amd64 for amd64 specifics.
-X#
-X# GNU gcc compiler
-XCC=gcc
-XCFLGS=-fno-builtin -Wall -O3
-X
-X#
-X# SUNWspro compiler
-X#CC=/opt/SUNWspro/bin/cc
-X#CFLGS=-Xa -xnolib -xO3
-X
-X#
-X# Debug error reporting
-X#DEBUG_FLG=
-X#DEBUG_FLG=-DAPERTURE_DEBUG
-X
-X#
-X# Files and object declarations
-XKERNEL_FLGS=-D_KERNEL -DSUNDDI
-XCFLAGS= $(CFLGS) $(KERNEL_FLGS) $(DEBUG_FLG)
-XCFILES= aperture.c
-XOBJS= aperture.o
-XDRIVER= aperture
-X
-X#
-X# Make rules
-Xall: $(DRIVER)
-X
-X$(DRIVER): $(OBJS)
-X	@if [ -f "Makefile.`isainfo -k`" ]; then \
-X		make -f Makefile.`isainfo -k` $(DRIVER); \
-X	else \
-X		rm -f $(DRIVER); \
-X		ld -r -o $(DRIVER) $(OBJS); \
-X	fi
-X
-Xinstall: $(DRIVER)
-X	@if [ -f "Makefile.`isainfo -k`" ]; then \
-X		make -f Makefile.`isainfo -k` install; \
-X	else \
-X		cp aperture.conf /kernel/drv; \
-X		cp $(DRIVER) /kernel/drv; \
-X	fi
-X
-Xadd_drv:
-X	@if [ -f "Makefile.`isainfo -k`" ]; then \
-X		make -f Makefile.`isainfo -k` add_drv; \
-X	else \
-X		add_drv aperture; \
-X	fi
-X
-Xclean:
-X	rm -f *% *.BAK $(OBJS) $(DRIVER) core
-X
-X.SUFFIXES: .i
-X
-X.c.i:
-X	$(CC) -E $(CFLAGS) $*.c > $@
-X
-X.c.o:
-X	@if [ -f "Makefile.`isainfo -k`" ]; then \
-X		make -f Makefile.`isainfo -k` $@; \
-X	else \
-X		rm -f $@; \
-X		$(CC) -c $(CFLAGS) $*.c -o $@; \
-X	fi
-END-of-./aperture/Makefile
-echo x - ./aperture/Makefile.amd64
-sed 's/^X//' >./aperture/Makefile.amd64 << 'END-of-./aperture/Makefile.amd64'
-X#
-X#   File: Makefile for aperture Framebuffer Driver
-X# Author: Doug Anson (danson at lgc.com)
-X#   Date: 2/15/94
-X# Modified: David Holland (davidh at use.com)
-X#   Date: 2/23/94
-X#   - Changed name, and debugging structure
-X# Modified: Marc Aurele La France (tsi at xfree86.org)
-X#   Date: 2001.06.08
-X#   - SPARC support, cleanup and turf aptest.
-X# Modified: Martin Bochnig (martin at martux.org)
-X#   - amd64 64 bit kernel support, cosmetics and also
-X#     supporting sun4v (and arbitrary sparcv9) platforms
-X#     as well as SunOS 5.10 or higher now
-X#   - Changed name
-X#
-X
-X#
-X# GNU gcc compiler, version 3.2 or later
-X#
-XCC=gcc
-XCFLGS=-fno-builtin -Wall -O3 -m64 -mcmodel=kernel
-X
-X#
-X# SUNWspro compiler (untested, might not properly work for amd64 here)
-X#CC=/opt/SUNWspro/bin/cc
-X#CFLGS=-Xa -xarch=v9 -xnolib -xO3
-X
-X#
-X# Debug error reporting
-X#DEBUG_FLG=
-X#DEBUG_FLG=-DAPERTURE_DEBUG
-X
-X#
-X# Files and object declarations
-XKERNEL_FLGS=-D_KERNEL -DSUNDDI
-XCFLAGS= $(CFLGS) $(KERNEL_FLGS) $(DEBUG_FLG)
-XCFILES= aperture.c
-XOBJS= aperture.o
-XDRIVER= aperture
-X
-X#
-X# Make rules
-Xall: $(DRIVER)
-X
-X$(DRIVER): $(OBJS)
-X	rm -f $(DRIVER)
-X	ld -r -o $(DRIVER) $(OBJS)
-X
-Xinstall: $(DRIVER)
-X	cp aperture.conf /kernel/drv
-X	cp $(DRIVER) /kernel/drv/amd64
-X
-Xadd_drv:
-X	add_drv aperture
-X
-Xclean:
-X	rm -f *% *.BAK $(OBJS) $(DRIVER) core
-X
-X.SUFFIXES: .i
-X
-X.c.i:
-X	$(CC) -E $(CFLAGS) $*.c > $@
-END-of-./aperture/Makefile.amd64
-echo x - ./aperture/Makefile.sparcv9
-sed 's/^X//' >./aperture/Makefile.sparcv9 << 'END-of-./aperture/Makefile.sparcv9'
-X#
-X#   File: makefile for aperture Framebuffer Driver
-X# Author: Doug Anson (danson at lgc.com)
-X#   Date: 2/15/94
-X# Modified: David Holland (davidh at use.com)
-X#   Date: 2/23/94
-X#   - Changed name, and debugging structure
-X# Modified: Marc Aurele La France (tsi at xfree86.org)
-X#   Date: 2001.06.08
-X#   - SPARC support, cleanup and turf aptest.
-X# Modified: Martin Bochnig (martin at martux.org)
-X#   Date: 2006.06.24
-X#   - Changed name for generic sparcv9 support
-X#   - updated to better work with Solaris 10 and 11
-X#
-X
-X#
-X# GNU gcc compiler, version 3.2 or later
-X#
-XCC=gcc
-XCFLGS=-fno-builtin -Wall -O3 -m64
-X
-X#
-X# SUNWspro compiler
-X#CC=/opt/SUNWspro/bin/cc
-X#CFLGS=-Xa -xarch=v9 -xnolib -xO3
-X
-X#
-X# Debug error reporting
-X#DEBUG_FLG=
-X#DEBUG_FLG=-DAPERTURE_DEBUG
-X
-X#
-X# Files and object declarations
-XKERNEL_FLGS=-D_KERNEL -DSUNDDI
-XCFLAGS= $(CFLGS) $(KERNEL_FLGS) $(DEBUG_FLG)
-XCFILES= aperture.c
-XOBJS= aperture.o
-XDRIVER= aperture
-X
-X#
-X# Make rules
-Xall: $(DRIVER)
-X
-X$(DRIVER): $(OBJS)
-X	rm -f $(DRIVER)
-X	ld -r -o $(DRIVER) $(OBJS)
-X
-Xinstall: $(DRIVER)
-X	cp aperture.conf /kernel/drv
-X	cp $(DRIVER) /kernel/drv/sparcv9
-X
-Xadd_drv:
-X	add_drv aperture
-X
-Xclean:
-X	rm -f *% *.BAK $(OBJS) $(DRIVER) core
-X
-X.SUFFIXES: .i
-X
-X.c.i:
-X	$(CC) -E $(CFLAGS) $*.c > $@
-END-of-./aperture/Makefile.sparcv9
-echo x - ./aperture/README
-sed 's/^X//' >./aperture/README << 'END-of-./aperture/README'
-XFramebuffer aperture driver.
-X
-XThis driver was written to provide a device that, unlike /dev/mem, allows
-Xmmap()'ing of ranges beyond installed memory.
-X
-XThe original x86-based version of this driver was the collaborative work of
-XDoug Anson (danson at lgc.com), and David Holland (davidh at use.com).  It has since
-Xbeen rewritten to also work on sparc machines and - later on - also on sparcv9 
-Xand recently amd64 64 bit kernels.
-XIt flawlessly compiles and installs on Solaris 10 and 11 now.
-X
-X
-XInstallation instructions:
-X
-X1) Check the Makefile, for appropriate CC, and CFLAGS definitions.  Compiling
-X   with APERTURE_DEBUG defined means the driver will generate reams of
-X   debugging output.  You'll probably want to leave this off...
-X
-X2) Type 'make' (or 'gmake').  Both the driver and test program should compile 
-X   without any problems. No warning messages should be generated.
-X
-X3) Become 'root'.
-X
-X4) Type 'make install' and 'make add_drv'.  The screen should look something
-X   like this:
-X
-X	# make install
-X	cp aperture aperture.conf /kernel/drv
-X	# make add_drv
-X	add_drv aperture
-X
-X   On a sparcv9 machine this will mention the /kernel/drv/sparcv9 directory
-X   instead of /kernel/drv. Similarily /kernel/drv/amd64 should be used on amd64.
-X
-X   This installs the driver to the system.
-X
-X5) While as root modify the file /etc/devlink.tab, adding these lines:
-X
-X# The following entry is for the framebuffer driver
-Xtype=ddi_pseudo;name=aperture	fbs/\M0
-X
-X   Add that line exactly as shown. You may also simply add the
-X   contents of the devlink.tab file supplied to /etc/devlink.tab.
-X   It contains the lines as well.  (Yes, that is a tab between
-X   aperture and fbs, not spaces - very important)
-X
-X6) Perform a reconfiguration boot of the system.
-X
-X	# touch /reconfigure
-X	# init 6
-X
-XBug reports, questions, suggestions, etc can be sent to xfree86 at xfree86.org.
-END-of-./aperture/README
-echo x - ./aperture/aperture.c
-sed 's/^X//' >./aperture/aperture.c << 'END-of-./aperture/aperture.c'
-X/*
-X * Copyright (C) 2001 The XFree86 Project, Inc.  All Rights Reserved.
-X *
-X * Permission is hereby granted, free of charge, to any person obtaining a copy
-X * of this software and associated documentation files (the "Software"), to
-X * deal in the Software without restriction, including without limitation the
-X * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
-X * sell copies of the Software, and to permit persons to whom the Software is
-X * furnished to do so, subject to the following conditions:
-X *
-X * The above copyright notice and this permission notice shall be included in
-X * all copies or substantial portions of the Software.
-X *
-X * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-X * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-X * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
-X * XFREE86 PROJECT BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
-X * IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
-X * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-X *
-X * Except as contained in this notice, the name of the XFree86 Project shall
-X * not be used in advertising or otherwise to promote the sale, use or other
-X * dealings in this Software without prior written authorization from the
-X * XFree86 Project.
-X */
-X
-X/*
-X * Aperture driver for Solaris.
-X */
-X
-X/*
-X * Modified: Martin Bochnig (martin at martux.org)
-X * Log:      Commented out obsolete kernel interfaces DDI_IDENTIFIED and DDI_NOT_IDENTIFIED
-X *           not supported by SunOS 5.10 or higher anymore, 
-X *           see http://docs.sun.com/app/docs/doc/819-2255/6n4ibnffr?a=view
-X */
-X
-X#include <sys/conf.h>
-X#include <sys/ddi.h>
-X#include <sys/modctl.h>
-X#include <sys/open.h>
-X#include <sys/stat.h>
-X#include <sys/sunddi.h>
-X
-X#define DEV_IDENT  "aperture"
-X#define DEV_BANNER "XFree86 aperture driver"
-X
-X#ifndef D_64BIT
-X#define D_64BIT 0
-X#endif
-X
-X#ifndef NULL
-X#define NULL ((void *)0)
-X#endif
-X
-X/*
-X * open(9E)
-X */
-X/*ARGSUSED*/
-Xstatic int
-Xaperture_open
-X(
-X#ifdef __STDC__
-X	dev_t *devp,
-X	int flag,
-X	int typ,
-X	struct cred *cred
-X#endif
-X)
-X#ifndef __STDC__
-X	dev_t *devp;
-X	int flag;
-X	int typ;
-X	struct cred *cred;
-X#endif
-X{
-X	int error;
-X
-X#ifdef APERTURE_DEBUG
-X
-X	cmn_err(CE_CONT, DEV_IDENT ":  entering open()\n");
-X
-X#endif
-X
-X	if ((typ != OTYP_CHR) || (getminor(*devp)))
-X		error = EINVAL;
-X	else
-X		error = 0;
-X
-X#ifdef APERTURE_DEBUG
-X
-X	cmn_err(CE_CONT, DEV_IDENT ":  leaving open() = %d\n", error);
-X
-X#endif
-X
-X	return error;
-X}
-X
-X/*
-X * mmap(9E)
-X */
-X/*ARGSUSED*/
-Xstatic int
-Xaperture_mmap
-X(
-X#ifdef __STDC__
-X	dev_t dev,
-X	off_t off,
-X	int prot
-X#endif
-X)
-X#ifndef __STDC__
-X	dev_t dev;
-X	off_t off;
-X	int prot;
-X#endif
-X{
-X	pfn_t pf;
-X	int error;
-X
-X#ifdef APERTURE_DEBUG
-X
-X	cmn_err(CE_CONT, DEV_IDENT ":  entering mmap(0x%016lx)\n", off);
-X
-X#endif
-X
-X	pf = btop((unsigned long)off);
-X
-X	/* Deal with mmap(9E) interface limits */
-X	error = (int)pf;
-X	if ((error < 0) || (pf != (pfn_t)error))
-X		error = -1;
-X
-X#ifdef APERTURE_DEBUG
-X
-X	cmn_err(CE_CONT, DEV_IDENT ":  leaving mmap() = 0x%08lx", error);
-X
-X#endif
-X
-X	return error;
-X}
-X
-Xstatic struct cb_ops aperture_cb_ops =
-X{
-X	aperture_open,		/* open */
-X	nulldev,		/* close */
-X	nodev,			/* strategy */
-X	nodev,			/* print */
-X	nodev,			/* dump */
-X	nodev,			/* read */
-X	nodev,			/* write */
-X	nodev,			/* ioctl */
-X	nodev,			/* devmap */
-X	aperture_mmap,		/* mmap */
-X	ddi_segmap,		/* segmap */
-X	nochpoll,		/* poll */
-X	ddi_prop_op,		/* cb_prop_op */
-X	0,			/* streamtab  */
-X	D_NEW | D_MP | D_64BIT	/* Driver compatibility flag */
-X};
-X
-X
-Xstatic dev_info_t *aperture_dip;	/* private copy of devinfo pointer */
-X
-X/*
-X * getinfo(9E)
-X */
-X/*ARGSUSED*/
-Xstatic int
-Xaperture_getinfo
-X(
-X#ifdef __STDC__
-X	dev_info_t *dip,
-X	ddi_info_cmd_t infocmd,
-X	void *arg,
-X	void **result
-X#endif
-X)
-X#ifndef __STDC__
-X	dev_info_t *dip;
-X	ddi_info_cmd_t infocmd;
-X	void *arg;
-X	void **result;
-X#endif
-X{
-X	int error;
-X
-X#ifdef APERTURE_DEBUG
-X
-X	cmn_err(CE_CONT, DEV_IDENT ":  entering getinfo()\n");
-X
-X#endif
-X
-X	switch (infocmd) {
-X	case DDI_INFO_DEVT2DEVINFO:
-X		*result = aperture_dip;
-X		error = DDI_SUCCESS;
-X		break;
-X	case DDI_INFO_DEVT2INSTANCE:
-X		*result = NULL;
-X		error = DDI_SUCCESS;
-X		break;
-X	default:
-X		error = DDI_FAILURE;
-X	}
-X
-X#ifdef APERTURE_DEBUG
-X
-X	cmn_err(CE_CONT, DEV_IDENT ":  leaving getinfo() = %d\n", error);
-X
-X#endif
-X
-X	return error;
-X}
-X
-X/*
-X * identify(9E)
-X */
-X/*ARGSUSED*/
-Xstatic int
-Xaperture_identify
-X(
-X#ifdef __STDC__
-X	dev_info_t *dip
-X#endif
-X)
-X#ifndef __STDC__
-X	dev_info_t *dip;
-X#endif
-X{
-X	int error;
-X
-X#ifdef APERTURE_DEBUG
-X
-X	cmn_err(CE_CONT, DEV_IDENT ":  entering identify()\n");
-X
-X#endif
-X
-X	if (strcmp(ddi_get_name(dip), DEV_IDENT))
-X	  error = 1 /* DDI_NOT_IDENTIFIED obsolete since SunOS 5.10 */ ;
-X	else
-X	  error = 2 /* DDI_IDENTIFIED obsolete since SunOS 5.10 */ ;
-X
-X#ifdef APERTURE_DEBUG
-X
-X	cmn_err(CE_CONT, DEV_IDENT ":  leaving identify() = %d\n", error);
-X
-X#endif
-X
-X	return error;
-X}
-X
-X/*
-X * attach(9E)
-X */
-X/*ARGSUSED*/
-Xstatic int
-Xaperture_attach
-X(
-X#ifdef __STDC__
-X	dev_info_t *dip,
-X	ddi_attach_cmd_t cmd
-X#endif
-X)
-X#ifndef __STDC__
-X	dev_info_t *dip;
-X	ddi_attach_cmd_t cmd;
-X#endif
-X{
-X	int error;
-X
-X#ifdef APERTURE_DEBUG
-X
-X	cmn_err(CE_CONT, DEV_IDENT ":  entering attach()\n");
-X
-X#endif
-X
-X	if (cmd != DDI_ATTACH)
-X	{
-X
-X#ifdef APERTURE_DEBUG
-X
-X		cmn_err(CE_CONT, DEV_IDENT ":  not attach(, DDI_ATTACH)\n");
-X
-X#endif
-X
-X		error = DDI_FAILURE;
-X	}
-X	else
-X	{
-X		error = ddi_create_minor_node(dip, ddi_get_name(dip), S_IFCHR,
-X					      (minor_t)ddi_get_instance(dip),
-X					      NULL, 0 /* NODESPECIFIC_DEV obsolete since SunOS 5.10 */ );
-X
-X		if (error == DDI_SUCCESS)
-X		{
-X			aperture_dip = dip;
-X			ddi_report_dev(dip);
-X		}
-X	}
-X
-X#ifdef APERTURE_DEBUG
-X
-X	cmn_err(CE_CONT, DEV_IDENT ":  leaving attach() = %d\n", error);
-X
-X#endif
-X
-X	return error;
-X}
-X
-X/*
-X * detach(9E)
-X */
-Xstatic int
-Xaperture_detach
-X(
-X#ifdef __STDC__
-X	dev_info_t *dip,
-X	ddi_detach_cmd_t cmd
-X#endif
-X)
-X#ifndef __STDC__
-X	dev_info_t *dip;
-X	ddi_detach_cmd_t cmd;
-X#endif
-X{
-X	int error;
-X
-X#ifdef APERTURE_DEBUG
-X
-X	cmn_err(CE_CONT, DEV_IDENT ":  entering detach()\n");
-X
-X#endif
-X
-X	if (cmd != DDI_DETACH)
-X	{
-X		error = DDI_FAILURE;
-X	}
-X	else
-X	{
-X		ddi_remove_minor_node(dip, NULL);
-X		aperture_dip = NULL;
-X		error = DDI_SUCCESS;
-X	}
-X
-X#if APERTURE_DEBUG
-X
-X	cmn_err(CE_CONT, DEV_IDENT ":  leaving detach() = %d\n", error);
-X
-X#endif
-X
-X	return error;
-X}
-X
-X
-Xstatic struct dev_ops aperture_ops =
-X{
-X	DEVO_REV,		/* revision */
-X	0,			/* refcnt  */
-X	aperture_getinfo,	/* getinfo */
-X	aperture_identify,	/* identify */
-X	nulldev,		/* probe */
-X	aperture_attach,	/* attach */
-X	aperture_detach,	/* detach */
-X	nodev,			/* reset */
-X	&aperture_cb_ops,	/* driver operations */
-X	NULL			/* bus operations */
-X};
-X
-X
-Xstatic struct modldrv modldrv =
-X{
-X	&mod_driverops,		/* mod_ops structure pointer */
-X	DEV_BANNER,		/* driver banner string */
-X	&aperture_ops,		/* dev_ops structure pointer */
-X};
-X
-X
-Xstatic struct modlinkage modlinkage =
-X{
-X	MODREV_1,		/* module API revision */
-X	{
-X		&modldrv,	/* module driver structure pointer */
-X		NULL		/* list termination */
-X	}
-X};
-X
-X
-X/*
-X * _init(9E)
-X */
-Xint
-X_init
-X(
-X#ifdef __STDC__
-X	void
-X#endif
-X)
-X{
-X	int error;
-X
-X#ifdef APERTURE_DEBUG
-X
-X	cmn_err(CE_CONT, DEV_IDENT ":  entering _init()\n");
-X
-X#endif
-X
-X	error = mod_install(&modlinkage);
-X
-X#ifdef APERTURE_DEBUG
-X
-X	cmn_err(CE_CONT, DEV_IDENT ":  leaving _init() = %d\n", error);
-X
-X#endif
-X
-X	return error;
-X}
-X
-X/*
-X * _info(9E)
-X */
-Xint
-X_info
-X(
-X#ifdef __STDC__
-X	struct modinfo *modinfop
-X#endif
-X)
-X#ifndef __STDC__
-X	struct modinfo *modinfop;
-X#endif
-X{
-X	int error;
-X
-X#ifdef APERTURE_DEBUG
-X
-X	cmn_err(CE_CONT, DEV_IDENT ":  entering _info()\n");
-X
-X#endif
-X
-X	error = mod_info(&modlinkage, modinfop);
-X
-X#ifdef APERTURE_DEBUG
-X
-X	cmn_err(CE_CONT, DEV_IDENT ":  leaving _info() = %d\n", error);
-X
-X#endif
-X
-X	return error;
-X}
-X
-X/*
-X * _fini(9E)
-X */
-Xint
-X_fini
-X(
-X#ifdef __STDC__
-X	void
-X#endif
-X)
-X{
-X	int error;
-X
-X#ifdef APERTURE_DEBUG
-X
-X	cmn_err(CE_CONT, DEV_IDENT ":  entering _fini()\n");
-X
-X#endif
-X
-X	error = mod_remove(&modlinkage);
-X
-X#ifdef APERTURE_DEBUG
-X
-X	cmn_err(CE_CONT, DEV_IDENT ":  leaving _fini() = %d\n", error);
-X
-X#endif
-X
-X	return error;
-X}
-END-of-./aperture/aperture.c
-echo x - ./aperture/aperture.conf
-sed 's/^X//' >./aperture/aperture.conf << 'END-of-./aperture/aperture.conf'
-X#
-X# Copyright 1994 Doug Anson, danson at lgc.com & David Holland, davidh at use.com
-X#
-X# File:   aperture.conf
-X# Author: Doug Anson (danson at lgc.com)
-X# 
-X# Modified: David Holland (davidh at use.com)
-X# Log:	    Change comments		02/23/94
-X#	    Change defaults/comments	09/25/94
-X#
-X# Modified: Marc Aurele La France (tsi at xfree86.org)
-X# Log:      SPARC changes		2001.09
-X#
-X# Purpose:  This conf file is used by the aperture driver.
-X#
-Xname="aperture" parent="pseudo";
-END-of-./aperture/aperture.conf
-echo x - ./aperture/devlink.tab
-sed 's/^X//' >./aperture/devlink.tab << 'END-of-./aperture/devlink.tab'
-X# The following entry is for the aperture driver
-Xtype=ddi_pseudo;name=aperture	fbs/\M0
-END-of-./aperture/devlink.tab
-exit
-


More information about the xorg-commit mailing list