Update to libX11 1.5.99.902 aka 1.6rc2

52 files changed, 811 insertions, 175 deletions

diff --git a/lib/libX11/ChangeLog b/lib/libX11/ChangeLog
index 0374d7b4e..76b394942 100644
--- a/lib/libX11/ChangeLog
+++ b/lib/libX11/ChangeLog
@@ -1,3 +1,625 @@
+commit 95a388158c9d73df7d24016d6a3d61506d7d53a4
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Thu May 23 19:43:35 2013 -0700
+
+    libX11 1.5.99.902 (1.6 RC2)
+    
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+
+commit a3bdd2b090915fe0163b062f0e6576fe05dd332e
+Author: Julien Cristau <jcristau@debian.org>
+Date:   Thu May 23 20:39:46 2013 +0200
+
+    xkb: fix off-by-one in _XkbReadGetNamesReply and _XkbReadVirtualModMap
+    
+    The size of the arrays is max_key_code + 1.  This makes these functions
+    consistent with the other checks added for CVE-2013-1997.
+    
+    Also check the XkbGetNames reply when names->keys was just allocated.
+    
+    Signed-off-by: Julien Cristau <jcristau@debian.org>
+    Tested-by: Colin Walters <walters@verbum.org>
+    Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+
+commit 7e30056e78e4b7979ff47f102e00327617266019
+Author: Niveditha Rau <Niveditha.Rau@Oracle.COM>
+Date:   Fri May 17 15:26:21 2013 -0700
+
+    Make sure internal headers include required headers
+    
+    Fixes builds with Solaris Studio 12.3 when lint is enabled, since it no
+    longer ignores *.h files, but complains when they reference undefined
+    typedefs or macros.
+    
+    Signed-off-by: Niveditha Rau <Niveditha.Rau@Oracle.COM>
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+
+commit 2820100bf8ba130b94253f415e7fa5ac28bb2037
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Thu May 16 23:05:36 2013 -0700
+
+    Free fs->properties in _XF86BigfontQueryFont overflow error path
+    
+    Fixes small memory leak introduced in commit 5669a22081
+    
+    Reported-by: Julien Cristau <jcristau@debian.org>
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+
+commit 3131740513133a9ff7cb12123d29ceb18584fc38
+Author: Matthieu Herrb <matthieu.herrb@laas.fr>
+Date:   Wed May 8 19:33:09 2013 +0200
+
+    XListFontsWithInfo: Re-decrement flist[0] before calling free() on it.
+    
+    Freeing a pointer that wasn't returned by malloc() is undefined
+    behavior and produces an error with OpenBSD's implementation.
+    
+    Signed-off-by: Matthieu Herrb <matthieu.herrb@laas.fr>
+    Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+
+commit 3fe4bea086149f06a142a8f1d575f627ec1e22c7
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Fri Apr 19 14:30:40 2013 -0700
+
+    Give GNU & Solaris Studio compilers hints about XEatData branches
+    
+    Try to offset the cost of all the recent checks we've added by giving
+    the compiler a hint that the branches that involve us eating data
+    are less likely to be used than the ones that process it.
+    
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+
+commit e1b457beb8d4e831ef44279dada6c475cb955738
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Sun Mar 31 12:22:35 2013 -0700
+
+    _XkbReadGetMapReply: reject maxKeyCodes smaller than the minKeyCode
+    
+    Various other bounds checks in the code assume this is true, so
+    enforce it when we first get the data from the X server.
+    
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+
+commit 12ad4c6432496897ff000eb7cfecd0fb4b290331
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Sat Mar 16 10:03:13 2013 -0700
+
+    Use calloc in XOpenDisplay to initialize structs containing pointers
+    
+    Prevents trying to free uninitialized pointers if we have to bail out
+    partway through setup, such as if we receive a corrupted or incomplete
+    connection setup block from the server.
+    
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+
+commit d38527e25f8b6e2f1174ecc21260c5c5416f972e
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Thu Mar 7 23:46:05 2013 -0800
+
+    Remove more unnecessary casts from Xmalloc/calloc calls
+    
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+
+commit b2c86b582c58f50c7b14da01cf7ebd20ef12a6b2
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Sat Mar 2 16:56:16 2013 -0800
+
+    Convert more _XEatData callers to _XEatDataWords
+    
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+    Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
+
+commit 192bbb9e2fc45df4e17b35b6d14ea0eb418dbd39
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Sat Mar 9 11:04:37 2013 -0800
+
+    Make XGetWindowProperty() always initialize returned values
+    
+    Avoids memory corruption and other errors when callers access them
+    without checking to see if XGetWindowProperty() returned an error value.
+    
+    Callers are still required to check for errors, this just reduces the
+    damage when they don't.
+    
+    Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+    Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
+
+commit db1b1c871da29aa0545182bf888df81627f165a5
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Sat Mar 2 15:08:21 2013 -0800
+
+    Avoid overflows in XListExtensions() [CVE-2013-1997 15/15]
+    
+    Ensure that when breaking the returned list into individual strings,
+    we don't walk past the end of allocated memory to write the '\0' bytes
+    
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+    Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
+
+commit 8d5936594993921acdfec778dd8f41b555e2543a
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Sat Mar 2 15:08:21 2013 -0800
+
+    Avoid overflows in XGetFontPath() [CVE-2013-1997 14/15]
+    
+    Ensure that when breaking the returned list into individual strings,
+    we don't walk past the end of allocated memory to write the '\0' bytes
+    
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+    Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
+
+commit 0c404db6a92dc2c198328bf586c02d8abbe02013
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Sat Mar 2 15:08:21 2013 -0800
+
+    Avoid overflows in XListFonts() [CVE-2013-1997 13/15]
+    
+    Ensure that when breaking the returned list into individual strings,
+    we don't walk past the end of allocated memory to write the '\0' bytes
+    
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+    Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
+
+commit 0b0f5d4358c3de7563d6af03f0d2ce454702a06a
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Sat Mar 2 15:08:21 2013 -0800
+
+    integer overflow in XGetModifierMapping() [CVE-2013-1981 13/13]
+    
+    Ensure that we don't underallocate when the server claims a very large reply
+    
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+    Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
+
+commit a351b8103b2ba78882e1c309e85893ca3abe2073
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Sat Mar 2 15:08:21 2013 -0800
+
+    integer overflow in XGetPointerMapping() & XGetKeyboardMapping() [CVE-2013-1981 12/13]
+    
+    Ensure that we don't underallocate when the server claims a very large reply
+    
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+    Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
+
+commit 833f6b70bc789d33607f6dbfee9e0a4178ec4b59
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Sat Mar 2 15:08:21 2013 -0800
+
+    integer overflow in XGetImage() [CVE-2013-1981 11/13]
+    
+    Ensure that we don't underallocate when the server claims to have sent a
+    very large reply.
+    
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+    Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
+
+commit 79d8dc08eb98842173ce239b9dd60df0e9e9ae72
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Fri Mar 8 22:25:35 2013 -0800
+
+    integer overflow in XGetWindowProperty() [CVE-2013-1981 10/13]
+    
+    If the reported number of properties is too large, the calculations
+    to allocate memory for them may overflow, leaving us returning less
+    memory to the caller than implied by the value written to *nitems.
+    
+    Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+    Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
+
+commit 164bf4dfe839b1cc75cdeee378a243d04a8200e4
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Sat Mar 2 13:18:48 2013 -0800
+
+    integer overflows in TransFileName() [CVE-2013-1981 9/13]
+    
+    When trying to process file paths the tokens %H, %L, & %S are expanded
+    to $HOME, the standard compose file path & the xlocaledir path.
+    If enough of these tokens are repeated and values like $HOME are set to
+    very large values, the calculation of the total string size required to
+    hold the expanded path can overflow, resulting in allocating a smaller
+    string than the amount of data we'll write to it.
+    
+    Simply restrict all of these values, and the total path size to PATH_MAX,
+    because really, that's all you should need for a filename path.
+    
+    Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+    Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
+
+commit 460e8a223b87d4fa0ea1e97823e998a770e0f2a2
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Fri Mar 1 18:37:37 2013 -0800
+
+    integer truncation in _XimParseStringFile() [CVE-2013-1981 8/13]
+    
+    Called from _XimCreateDefaultTree() which uses getenv("XCOMPOSEFILE")
+    to specify filename.
+    
+    If the size of off_t is larger than the size of unsigned long (as in
+    32-bit builds with large file flags), a file larger than 4 gigs could
+    have its size truncated, leading to data from that file being written
+    past the end of the undersized buffer allocated for it.
+    
+    While configure.ac does not use AC_SYS_LARGEFILE to set large file mode,
+    builders may have added the large file compilation flags to CFLAGS on
+    their own.
+    
+    size is left limited to an int, because if your Xim file is
+    larger than 2gb, you're doing it wrong.
+    
+    Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+    Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
+
+commit 226622349a4b1e16064649d4444a34fb4be4f464
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Sat Mar 2 12:39:58 2013 -0800
+
+    Unbounded recursion in _XimParseStringFile() when parsing include files [CVE-2013-2004 2/2]
+    
+    parseline() can call _XimParseStringFile() which can call parseline()
+    which can call _XimParseStringFile() which can call parseline() ....
+    eventually causing recursive stack overflow and crash.
+    
+    Limit is set to a include depth of 100 files, which should be enough
+    for all known use cases, but could be adjusted later if necessary.
+    
+    Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+    Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
+
+commit 236b603d235dc264d1c6250dca09c745458a9088
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Sat Mar 2 12:01:39 2013 -0800
+
+    Unbounded recursion in GetDatabase() when parsing include files [CVE-2013-2004 1/2]
+    
+    GetIncludeFile() can call GetDatabase() which can call GetIncludeFile()
+    which can call GetDatabase() which can call GetIncludeFile() ....
+    eventually causing recursive stack overflow and crash.
+    
+    Easily reproduced with a resource file that #includes itself.
+    
+    Limit is set to a include depth of 100 files, which should be enough
+    for all known use cases, but could be adjusted later if necessary.
+    
+    Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+    Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
+
+commit 076428918e6c35f66b9b55c3fa097ff06496d155
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Fri Mar 1 18:37:37 2013 -0800
+
+    integer overflow in ReadInFile() in Xrm.c [CVE-2013-1981 7/13]
+    
+    Called from XrmGetFileDatabase() which gets called from InitDefaults()
+    which gets the filename from getenv ("XENVIRONMENT")
+    
+    If file is exactly 0xffffffff bytes long (or longer and truncates to
+    0xffffffff, on implementations where off_t is larger than an int),
+    then size may be set to a value which overflows causing less memory
+    to be allocated than is written to by the following read() call.
+    
+    size is left limited to an int, because if your Xresources file is
+    larger than 2gb, you're very definitely doing it wrong.
+    
+    Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+    Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
+
+commit 90fd5abac2faca86f9f100353a3c9c7b89f31484
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Sat Mar 2 11:44:19 2013 -0800
+
+    Integer overflows in stringSectionSize() cause buffer overflow in ReadColornameDB() [CVE-2013-1981 6/13]
+    
+    LoadColornameDB() calls stringSectionSize() to do a first pass over the
+    file (which may be provided by the user via XCMSDB environment variable)
+    to determine how much memory needs to be allocated to read in the file,
+    then allocates the returned sizes and calls ReadColornameDB() to load the
+    data from the file into that newly allocated memory.
+    
+    If stringSectionSize() overflows the signed ints used to calculate the
+    file size (say if you have an xcmsdb with ~4 billion lines in or a
+    combined string length of ~4 gig - which while it may have been
+    inconceivable when Xlib was written, is quite possible today), then
+    LoadColornameDB() may allocate a memory buffer much smaller than the
+    amount of data ReadColornameDB() will write to it.
+    
+    The total size is left limited to an int, because if your xcmsdb file
+    is larger than 2gb, you're doing it wrong.
+    
+    Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+    Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
+
+commit b9ba832401734e1cbd30a930c0d11d850293f3f9
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Sat Mar 2 11:25:25 2013 -0800
+
+    unvalidated length in _XimXGetReadData() [CVE-2013-1997 12/15]
+    
+    Check the provided buffer size against the amount of data we're going to
+    write into it, not against the reported length from the ClientMessage.
+    
+    Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+    Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
+
+commit de2e6c322c4aca22856b380f67f8e488e7510015
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Sat Mar 2 11:11:08 2013 -0800
+
+    unvalidated index/length in _XkbReadGetNamesReply() [CVE-2013-1997 11/15]
+    
+    If the X server returns key name indexes outside the range of the number
+    of keys it told us to allocate, out of bounds memory writes could occur.
+    
+    Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+    Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
+
+commit 2df882eeb3a70256170127a746a9ba26376599a1
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Sat Mar 2 11:01:04 2013 -0800
+
+    unvalidated index in _XkbReadVirtualModMap() [CVE-2013-1997 10/15]
+    
+    If the X server returns modifier map indexes outside the range of the number
+    of keys it told us to allocate, out of bounds memory writes could occur.
+    
+    Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+    Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
+
+commit 4d7c422a37eb9617fb22f8e37527c2b34b105665
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Sat Mar 2 11:04:44 2013 -0800
+
+    unvalidated index in _XkbReadExplicitComponents() [CVE-2013-1997 9/15]
+    
+    If the X server returns key indexes outside the range of the number of
+    keys it told us to allocate, out of bounds memory writes could occur.
+    
+    Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+    Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
+
+commit e56a2ada719c5cfac5ed61a52a80ade86c0f5957
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Sat Mar 2 10:51:51 2013 -0800
+
+    unvalidated index in _XkbReadModifierMap() [CVE-2013-1997 8/15]
+    
+    If the X server returns modifier map indexes outside the range of the number
+    of keys it told us to allocate, out of bounds memory writes could occur.
+    
+    Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+    Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
+
+commit 06c086e8a1d8374ea9a95ff989f053c96bb1bdca
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Sat Mar 2 10:39:21 2013 -0800
+
+    unvalidated index in _XkbReadKeyBehaviors() [CVE-2013-1997 7/15]
+    
+    If the X server returns key behavior indexes outside the range of the number
+    of keys it told us to allocate, out of bounds memory writes could occur.
+    
+    Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+    Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
+
+commit 00626c3830b869259098985afa38933d77ccec72
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Sat Mar 2 09:40:22 2013 -0800
+
+    unvalidated index in _XkbReadKeyActions() [CVE-2013-1997 6/15]
+    
+    If the X server returns key action indexes outside the range of the number
+    of keys it told us to allocate, out of bounds memory access could occur.
+    
+    Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+    Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
+
+commit fd7d4956bc7a1c4b5c38661b12777ebee4d685d9
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Sat Mar 2 09:28:33 2013 -0800
+
+    unvalidated index in _XkbReadKeySyms() [CVE-2013-1997 5/15]
+    
+    If the X server returns keymap indexes outside the range of the number of
+    keys it told us to allocate, out of bounds memory access could occur.
+    
+    Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+    Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
+
+commit 59ae16a00d18588e98af57d26e442af8ea42b7aa
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Sat Mar 2 09:18:26 2013 -0800
+
+    unvalidated indexes in _XkbReadGetGeometryReply() [CVE-2013-1997 4/15]
+    
+    If the X server returns color indexes outside the range of the number of
+    colors it told us to allocate, out of bounds memory access could occur.
+    
+    Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+    Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
+
+commit bff938b9fe1629cbacb726509edfa2a3840b7207
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Sat Mar 2 09:12:47 2013 -0800
+
+    unvalidated indexes in _XkbReadGeomShapes() [CVE-2013-1997 3/15]
+    
+    If the X server returns shape indexes outside the range of the number
+    of shapes it told us to allocate, out of bounds memory access could occur.
+    
+    Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+    Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
+
+commit f293659d5a4024bda386305bb7ebeb4647c40934
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Fri Mar 1 22:49:01 2013 -0800
+
+    unvalidated index in _XkbReadGetDeviceInfoReply() [CVE-2013-1997 2/15]
+    
+    If the X server returns more buttons than are allocated in the XKB
+    device info structures, out of bounds writes could occur.
+    
+    Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+    Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
+
+commit cddc4e7e3cb4b9b7ad25f8591971a86901c249f2
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Fri Mar 1 19:30:09 2013 -0800
+
+    unvalidated lengths in XAllocColorCells() [CVE-2013-1997 1/15]
+    
+    If a broken server returned larger than requested values for nPixels or
+    nMasks, XAllocColorCells would happily overflow the buffers provided by
+    the caller to write the results into.
+    
+    Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+    Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
+
+commit 2cd62b5eb99ffbb2fce99f3c459455e630b35bf7
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Fri Mar 1 22:49:01 2013 -0800
+
+    integer overflow in XListHosts() [CVE-2013-1981 5/13]
+    
+    If the reported number of host entries is too large, the calculations
+    to allocate memory for them may overflow, leaving us writing beyond the
+    bounds of the allocation.
+    
+    Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+    Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
+
+commit 1f6a3dbf699b85c0ea715ef21de7e7095a714e12
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Fri Mar 1 22:49:01 2013 -0800
+
+    integer overflow in XGetMotionEvents() [CVE-2013-1981 4/13]
+    
+    If the reported number of motion events is too large, the calculations
+    to allocate memory for them may overflow, leaving us writing beyond the
+    bounds of the allocation.
+    
+    v2: Ensure nEvents is set to 0 when returning NULL events pointer
+    
+    Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+
+commit 39515b7c3ba8cae9021bf6695e378ae19487082f
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Fri Mar 1 22:49:01 2013 -0800
+
+    integer overflow in XListFontsWithInfo() [CVE-2013-1981 3/13]
+    
+    If the reported number of remaining fonts is too large, the calculations
+    to allocate memory for them may overflow, leaving us writing beyond the
+    bounds of the allocation.
+    
+    v2: Fix reply_left calculations, check calculated sizes fit in reply_left
+    v3: On error cases, also set values to be returned in pointer args to 0/NULL
+    
+    Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+
+commit 5669a220816b7d58fcaf0c302ead16fbe5c87817
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Fri Mar 1 21:05:27 2013 -0800
+
+    integer overflow in _XF86BigfontQueryFont() [CVE-2013-1981 2/13]
+    
+    Similar to _XQueryFont, but with more ways to go wrong and overflow.
+    Only compiled if libX11 is built with XF86BigFont support.
+    
+    v2: Fix reply_left calculations, check calculated sizes fit in reply_left
+    
+    Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+
+commit 6df8a63d34b7514077188e2062a13774f920c085
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Fri Mar 1 21:05:27 2013 -0800
+
+    integer overflow in _XQueryFont() on 32-bit platforms [CVE-2013-1981 1/13]
+    
+    If the CARD32 reply.nCharInfos * sizeof(XCharStruct) overflows an
+    unsigned long, then too small of a buffer will be allocated for the
+    data copied in from the reply.
+    
+    v2: Fix reply_left calculations, check calculated sizes fit in reply_left
+    
+    Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+
+commit 9f5d83706543696fc944c1835a403938c06f2cc5
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Fri Mar 1 20:54:24 2013 -0800
+
+    Add _XEatDataWords to discard a given number of 32-bit words of reply data
+    
+    Matches the units of the length field in X protocol replies, and provides
+    a single implementation of overflow checking to avoid having to replicate
+    those checks in every caller.
+    
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+    Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
+
+commit d7f04c340ade3834e603c23d543132e1ee4e0c63
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Sat Mar 2 13:03:55 2013 -0800
+
+    Move repeated #ifdef magic to find PATH_MAX into a common header
+    
+    Lets stop duplicating the mess all over
+    
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+    Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
+
+commit f3a553a4e4a55d9d19deda1ea01883e1d5d682b1
+Author: Pander <pander@users.sourceforge.net>
+Date:   Tue May 7 18:38:14 2013 -0400
+
+    Add compose sequences for J́ and j́.
+    
+    The resulting sequences are:
+    
+      U+004A LATIN CAPITAL LETTER J  U+0301 COMBINING ACUTE ACCENT
+      U+006A LATIN SMALL LETTER J    U+0301 COMBINING ACUTE ACCENT
+    
+    Used in Dutch, per:
+    
+      http://lists.x.org/archives/xorg-devel/2013-February/035514.html
+      https://nl.wikipedia.org/wiki/Accenttekens_in_de_Nederlandse_spelling
+    
+    Signed-off-by: Pander <pander@users.sourceforge.net>
+    Signed-off-by: James Cloos <cloos@jhcloos.com>
+
+commit f49bb2dd6d4ea45c55bd21acc0efe2b764441020
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Sat Mar 16 18:30:56 2013 -0700
+
+    Move big request comment in XOpenDisplay to the right place
+    
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+
 commit 3996543c1b2919e97d61a5d70fe1ebd7cd76fc83
 Author: Alan Coopersmith <alan.coopersmith@oracle.com>
 Date:   Sat Mar 9 19:16:03 2013 -0800
diff --git a/lib/libX11/configure b/lib/libX11/configure
index 221a30b43..d01e6f8c2 100644
--- a/lib/libX11/configure
+++ b/lib/libX11/configure
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for libX11 1.5.99.901.
+# Generated by GNU Autoconf 2.69 for libX11 1.5.99.902.
 #
 # Report bugs to <https://bugs.freedesktop.org/enter_bug.cgi?product=xorg>.
 #
@@ -651,8 +651,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='libX11'
 PACKAGE_TARNAME='libX11'
-PACKAGE_VERSION='1.5.99.901'
-PACKAGE_STRING='libX11 1.5.99.901'
+PACKAGE_VERSION='1.5.99.902'
+PACKAGE_STRING='libX11 1.5.99.902'
 PACKAGE_BUGREPORT='https://bugs.freedesktop.org/enter_bug.cgi?product=xorg'
 PACKAGE_URL=''
 
@@ -1505,7 +1505,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures libX11 1.5.99.901 to adapt to many kinds of systems.
+\`configure' configures libX11 1.5.99.902 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1575,7 +1575,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of libX11 1.5.99.901:";;
+     short | recursive ) echo "Configuration of libX11 1.5.99.902:";;
    esac
   cat <<\_ACEOF
 
@@ -1738,7 +1738,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-libX11 configure 1.5.99.901
+libX11 configure 1.5.99.902
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -2264,7 +2264,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by libX11 $as_me 1.5.99.901, which was
+It was created by libX11 $as_me 1.5.99.902, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
@@ -4482,7 +4482,7 @@ fi
 
 # Define the identity of the package.
  PACKAGE='libX11'
- VERSION='1.5.99.901'
+ VERSION='1.5.99.902'
 
 
 cat >>confdefs.h <<_ACEOF
@@ -21429,7 +21429,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by libX11 $as_me 1.5.99.901, which was
+This file was extended by libX11 $as_me 1.5.99.902, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -21495,7 +21495,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-libX11 config.status 1.5.99.901
+libX11 config.status 1.5.99.902
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 
diff --git a/lib/libX11/configure.ac b/lib/libX11/configure.ac
index 7734219f4..1f24bd27b 100644
--- a/lib/libX11/configure.ac
+++ b/lib/libX11/configure.ac
@@ -1,7 +1,7 @@
 
 # Initialize Autoconf
 AC_PREREQ([2.60])
-AC_INIT([libX11], [1.5.99.901],
+AC_INIT([libX11], [1.5.99.902],
         [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], [libX11])
 AC_CONFIG_SRCDIR([Makefile.am])
 AC_CONFIG_HEADERS([src/config.h include/X11/XlibConf.h])
diff --git a/lib/libX11/include/X11/Xlibint.h b/lib/libX11/include/X11/Xlibint.h
index d63a53431..acbad6beb 100644
--- a/lib/libX11/include/X11/Xlibint.h
+++ b/lib/libX11/include/X11/Xlibint.h
@@ -832,6 +832,15 @@ typedef struct _XExten {		/* private to extension mechanism */
 	struct _XExten *next_flush;	/* next in list of those with flushes */
 } _XExtension;
 
+/* Temporary definition until we can depend on an xproto release with it */
+#ifdef _X_COLD
+# define _XLIB_COLD _X_COLD
+#elif defined(__GNUC__) && ((__GNUC__ * 100 + __GNUC_MINOR__) >= 403) /* 4.3+ */
+# define _XLIB_COLD __attribute__((__cold__))
+#else
+# define _XLIB_COLD /* nothing */
+#endif
+
 /* extension hooks */
 
 #ifdef DataRoutineIsProcedure
@@ -854,11 +863,14 @@ extern int (*_XErrorFunction)(
 extern void _XEatData(
     Display*		/* dpy */,
     unsigned long	/* n */
-);
+) _XLIB_COLD;
 extern void _XEatDataWords(
     Display*		/* dpy */,
     unsigned long	/* n */
-);
+) _XLIB_COLD;
+#if defined(__SUNPRO_C) /* Studio compiler alternative to "cold" attribute */
+# pragma rarely_called(_XEatData, _XEatDataWords)
+#endif
 extern char *_XAllocScratch(
     Display*		/* dpy */,
     unsigned long	/* nbytes */
diff --git a/lib/libX11/nls/en_US.UTF-8/Compose.pre b/lib/libX11/nls/en_US.UTF-8/Compose.pre
index 8b45d920d..ab8237643 100644
--- a/lib/libX11/nls/en_US.UTF-8/Compose.pre
+++ b/lib/libX11/nls/en_US.UTF-8/Compose.pre
@@ -618,6 +618,7 @@ XCOMM Part 3
 <Multi_key> <I> <quotedbl> 		: "Ï"   Idiaeresis # LATIN CAPITAL LETTER I WITH DIAERESIS
 <Multi_key> <diaeresis> <I> 		: "Ï"   Idiaeresis # LATIN CAPITAL LETTER I WITH DIAERESIS
 <Multi_key> <I> <diaeresis> 		: "Ï"   Idiaeresis # LATIN CAPITAL LETTER I WITH DIAERESIS
+<Multi_key> <J> <acute> 		: "J́"    # LATIN CAPITAL LETTER J U004A with COMBINING ACUTE ACCENT U0301
 <Multi_key> <D> <H>              	: "Ð"   ETH # LATIN CAPITAL LETTER ETH
 <dead_tilde> <N>                 	: "Ñ"   Ntilde # LATIN CAPITAL LETTER N WITH TILDE
 <Multi_key> <asciitilde> <N>     	: "Ñ"   Ntilde # LATIN CAPITAL LETTER N WITH TILDE
@@ -738,6 +739,7 @@ XCOMM Part 3
 <Multi_key> <i> <quotedbl> 		: "ï"   idiaeresis # LATIN SMALL LETTER I WITH DIAERESIS
 <Multi_key> <diaeresis> <i> 		: "ï"   idiaeresis # LATIN SMALL LETTER I WITH DIAERESIS
 <Multi_key> <i> <diaeresis> 		: "ï"   idiaeresis # LATIN SMALL LETTER I WITH DIAERESIS
+<Multi_key> <j> <acute> 		: "j́"    # LATIN SMALL LETTER J U006A with COMBINING ACUTE ACCENT U0301
 <Multi_key> <d> <h>              	: "ð"   eth # LATIN SMALL LETTER ETH
 <dead_tilde> <n>                 	: "ñ"   ntilde # LATIN SMALL LETTER N WITH TILDE
 <Multi_key> <asciitilde> <n>     	: "ñ"   ntilde # LATIN SMALL LETTER N WITH TILDE
diff --git a/lib/libX11/src/Cmap.h b/lib/libX11/src/Cmap.h
index 062b5383b..78cc3ea67 100644
--- a/lib/libX11/src/Cmap.h
+++ b/lib/libX11/src/Cmap.h
@@ -2,6 +2,8 @@
 #ifndef _CMAP_H_
 #define _CMAP_H_
 
+#include <X11/Xlib.h>
+
 extern void
 _XcmsDeleteCmapRec(
     Display *dpy,
diff --git a/lib/libX11/src/Context.c b/lib/libX11/src/Context.c
index 79ae7d66c..4bb465b1a 100644
--- a/lib/libX11/src/Context.c
+++ b/lib/libX11/src/Context.c
@@ -111,7 +111,7 @@ static void ResizeTable(DB db)
     otable = db->table;
     for (i = INITHASHMASK+1; (i + i) < db->numentries; )
 	i += i;
-    db->table = (TableEntry *) Xcalloc((unsigned)i, sizeof(TableEntry));
+    db->table = Xcalloc(i, sizeof(TableEntry));
     if (!db->table) {
 	db->table = otable;
 	return;
@@ -180,11 +180,11 @@ int XSaveContext(
 	UnlockDisplay(display);
     }
     if (!db) {
-	db = (DB) Xmalloc(sizeof(DBRec));
+	db = Xmalloc(sizeof(DBRec));
 	if (!db)
 	    return XCNOMEM;
 	db->mask = INITHASHMASK;
-	db->table = (TableEntry *)Xcalloc(db->mask + 1, sizeof(TableEntry));
+	db->table = Xcalloc(db->mask + 1, sizeof(TableEntry));
 	if (!db->table) {
 	    Xfree((char *)db);
 	    return XCNOMEM;
@@ -210,7 +210,7 @@ int XSaveContext(
 	    return 0;
 	}
     }
-    entry = (TableEntry) Xmalloc(sizeof(TableEntryRec));
+    entry = Xmalloc(sizeof(TableEntryRec));
     if (!entry)
 	return XCNOMEM;
     entry->rid = rid;
diff --git a/lib/libX11/src/Cr.h b/lib/libX11/src/Cr.h
index 800c9ab1c..635e9e452 100644
--- a/lib/libX11/src/Cr.h
+++ b/lib/libX11/src/Cr.h
@@ -2,6 +2,8 @@
 #ifndef _CR_H_
 #define _CR_H_
 
+#include <X11/Xlib.h>
+
 extern int _XUpdateGCCache(
     register GC gc,
     register unsigned long mask,
diff --git a/lib/libX11/src/CrGC.c b/lib/libX11/src/CrGC.c
index 11de94c1f..2d5f17c00 100644
--- a/lib/libX11/src/CrGC.c
+++ b/lib/libX11/src/CrGC.c
@@ -72,7 +72,7 @@ GC XCreateGC (
     register _XExtension *ext;
 
     LockDisplay(dpy);
-    if ((gc = (GC)Xmalloc (sizeof(struct _XGC))) == NULL) {
+    if ((gc = Xmalloc (sizeof(struct _XGC))) == NULL) {
 	UnlockDisplay(dpy);
 	SyncHandle();
 	return (NULL);
diff --git a/lib/libX11/src/Depths.c b/lib/libX11/src/Depths.c
index f49655cb2..a8b719d00 100644
--- a/lib/libX11/src/Depths.c
+++ b/lib/libX11/src/Depths.c
@@ -49,7 +49,7 @@ int *XListDepths (
 	register Depth *dp;
 	register int i;
 
-	depths = (int *) Xmalloc (count * sizeof(int));
+	depths = Xmalloc (count * sizeof(int));
 	if (!depths) return NULL;
 	for (i = 0, dp = scr->depths; i < count; i++, dp++)
 	  depths[i] = dp->depth;
diff --git a/lib/libX11/src/FSWrap.c b/lib/libX11/src/FSWrap.c
index 910e602f4..12d0406ba 100644
--- a/lib/libX11/src/FSWrap.c
+++ b/lib/libX11/src/FSWrap.c
@@ -112,7 +112,7 @@ _XParseBaseFontNameList(
 	if (!*ptr)
 	    break;
     }
-    if (!(list = (char **) Xmalloc((unsigned)sizeof(char *) * (*num + 1)))) {
+    if (!(list = Xmalloc(sizeof(char *) * (*num + 1)))) {
 	Xfree(psave);
 	return (char **)NULL;
     }
@@ -133,7 +133,7 @@ copy_string_list(
     if (string_list == NULL || list_count <= 0)
 	return (char **) NULL;
 
-    string_list_ret = (char **) Xmalloc(sizeof(char *) * list_count);
+    string_list_ret = Xmalloc(sizeof(char *) * list_count);
     if (string_list_ret == NULL)
 	return (char **) NULL;
 
@@ -142,7 +142,7 @@ copy_string_list(
     for (length = 0; count-- > 0; list_src++)
 	length += strlen(*list_src) + 1;
 
-    dst = (char *) Xmalloc(length);
+    dst = Xmalloc(length);
     if (dst == NULL) {
 	Xfree(string_list_ret);
 	return (char **) NULL;
diff --git a/lib/libX11/src/Font.c b/lib/libX11/src/Font.c
index 5dbdb2972..3beb8a523 100644
--- a/lib/libX11/src/Font.c
+++ b/lib/libX11/src/Font.c
@@ -215,7 +215,7 @@ _XQueryFont (
 	DeqAsyncHandler(dpy, &async);
     reply_left = reply.length -
 	((SIZEOF(xQueryFontReply) - SIZEOF(xReply)) >> 2);
-    if (! (fs = (XFontStruct *) Xmalloc (sizeof (XFontStruct)))) {
+    if (! (fs = Xmalloc (sizeof (XFontStruct)))) {
 	_XEatDataWords(dpy, reply_left);
 	return (XFontStruct *)NULL;
     }
@@ -323,7 +323,7 @@ _XF86BigfontCodes (
     if (pData)
 	return (XF86BigfontCodes *) pData->private_data;
 
-    pData = (XExtData *) Xmalloc(sizeof(XExtData) + sizeof(XF86BigfontCodes));
+    pData = Xmalloc(sizeof(XExtData) + sizeof(XF86BigfontCodes));
     if (!pData) {
 	/* Out of luck. */
 	return (XF86BigfontCodes *) NULL;
@@ -459,7 +459,7 @@ _XF86BigfontQueryFont (
 	DeqAsyncHandler(dpy, &async1);
     reply_left = reply.length -
 	((SIZEOF(xXF86BigfontQueryFontReply) - SIZEOF(xReply)) >> 2);
-    if (! (fs = (XFontStruct *) Xmalloc (sizeof (XFontStruct)))) {
+    if (! (fs = Xmalloc (sizeof (XFontStruct)))) {
 	_XEatDataWords(dpy, reply_left);
 	return (XFontStruct *)NULL;
     }
@@ -521,14 +521,14 @@ _XF86BigfontQueryFont (
 
 	    nbytes = reply.nUniqCharInfos * SIZEOF(xCharInfo)
 	             + (reply.nCharInfos+1)/2 * 2 * sizeof(CARD16);
-	    pUniqCI = (xCharInfo *) Xmalloc (nbytes);
+	    pUniqCI = Xmalloc (nbytes);
 	    if (!pUniqCI) {
 		if (fs->properties) Xfree((char *) fs->properties);
 		Xfree((char *) fs);
 		_XEatDataWords(dpy, reply_left);
 		return (XFontStruct *)NULL;
 	    }
-	    if (! (fs->per_char = (XCharStruct *) Xmalloc (reply.nCharInfos * sizeof(XCharStruct)))) {
+	    if (! (fs->per_char = Xmalloc (reply.nCharInfos * sizeof(XCharStruct)))) {
 		Xfree((char *) pUniqCI);
 		if (fs->properties) Xfree((char *) fs->properties);
 		Xfree((char *) fs);
@@ -555,7 +555,7 @@ _XF86BigfontQueryFont (
 	    XEDataObject fs_union;
 	    char *addr;
 
-	    pData = (XExtData *) Xmalloc(sizeof(XExtData));
+	    pData = Xmalloc(sizeof(XExtData));
 	    if (!pData) {
 		if (fs->properties) Xfree((char *) fs->properties);
 		Xfree((char *) fs);
diff --git a/lib/libX11/src/GetAtomNm.c b/lib/libX11/src/GetAtomNm.c
index 9823c690c..32de50d23 100644
--- a/lib/libX11/src/GetAtomNm.c
+++ b/lib/libX11/src/GetAtomNm.c
@@ -46,7 +46,7 @@ char *_XGetAtomName(
 	for (idx = TABLESIZE; --idx >= 0; ) {
 	    if ((e = *table++) && (e->atom == atom)) {
 		idx = strlen(EntryName(e)) + 1;
-		if ((name = (char *)Xmalloc(idx)))
+		if ((name = Xmalloc(idx)))
 		    strcpy(name, EntryName(e));
 		return name;
 	    }
@@ -73,12 +73,12 @@ char *XGetAtomName(
 	SyncHandle();
 	return(NULL);
     }
-    if ((name = (char *) Xmalloc(rep.nameLength+1))) {
+    if ((name = Xmalloc(rep.nameLength + 1))) {
 	_XReadPad(dpy, name, (long)rep.nameLength);
 	name[rep.nameLength] = '\0';
 	_XUpdateAtomCache(dpy, name, atom, 0, -1, 0);
     } else {
-	_XEatData(dpy, (unsigned long) (rep.nameLength + 3) & ~3);
+	_XEatDataWords(dpy, rep.length);
 	name = (char *) NULL;
     }
     UnlockDisplay(dpy);
@@ -124,7 +124,7 @@ Bool _XGetAtomNameHandler(
 	_XGetAsyncReply(dpy, (char *)&replbuf, rep, buf, len,
 			(SIZEOF(xGetAtomNameReply) - SIZEOF(xReply)) >> 2,
 			False);
-    state->names[state->idx] = (char *) Xmalloc(repl->nameLength+1);
+    state->names[state->idx] = Xmalloc(repl->nameLength + 1);
     _XGetAsyncData(dpy, state->names[state->idx], buf, len,
 		   SIZEOF(xGetAtomNameReply), repl->nameLength,
 		   repl->length << 2);
@@ -170,13 +170,13 @@ XGetAtomNames (
     }
     if (missed >= 0) {
 	if (_XReply(dpy, (xReply *)&rep, 0, xFalse)) {
-	    if ((names_return[missed] = (char *) Xmalloc(rep.nameLength+1))) {
+	    if ((names_return[missed] = Xmalloc(rep.nameLength + 1))) {
 		_XReadPad(dpy, names_return[missed], (long)rep.nameLength);
 		names_return[missed][rep.nameLength] = '\0';
 		_XUpdateAtomCache(dpy, names_return[missed], atoms[missed],
 				  0, -1, 0);
 	    } else {
-		_XEatData(dpy, (unsigned long) (rep.nameLength + 3) & ~3);
+		_XEatDataWords(dpy, rep.length);
 		async_state.status = 0;
 	    }
 	}
diff --git a/lib/libX11/src/GetHints.c b/lib/libX11/src/GetHints.c
index 4800fe793..3c410d33d 100644
--- a/lib/libX11/src/GetHints.c
+++ b/lib/libX11/src/GetHints.c
@@ -128,7 +128,7 @@ XWMHints *XGetWMHints (
                 return(NULL);
 		}
 	/* static copies not allowed in library, due to reentrancy constraint*/
-	if ((hints = (XWMHints *) Xcalloc (1, (unsigned) sizeof(XWMHints)))) {
+	if ((hints = Xcalloc (1, sizeof(XWMHints)))) {
 	    hints->flags = prop->flags;
 	    hints->input = (prop->input ? True : False);
 	    hints->initial_state = cvtINT32toInt (prop->initialState);
@@ -203,8 +203,7 @@ Status XGetIconSizes (
 	/* static copies not allowed in library, due to reentrancy constraint*/
 
 	nitems /= NumPropIconSizeElements;
-	if (! (hp = hints = (XIconSize *)
-	  Xcalloc ((unsigned) nitems, (unsigned) sizeof(XIconSize)))) {
+	if (! (hp = hints = Xcalloc (nitems, sizeof(XIconSize)))) {
 	    if (prop) Xfree ((char *) prop);
 	    return 0;
 	}
@@ -317,14 +316,14 @@ XGetClassHint(
 
    if ( (actual_type == XA_STRING) && (actual_format == 8) ) {
 	len_name = strlen((char *) data);
-	if (! (classhint->res_name = Xmalloc((unsigned) (len_name+1)))) {
+	if (! (classhint->res_name = Xmalloc(len_name + 1))) {
 	    Xfree((char *) data);
 	    return (0);
 	}
 	strcpy(classhint->res_name, (char *) data);
 	if (len_name == nitems) len_name--;
 	len_class = strlen((char *) (data+len_name+1));
-	if (! (classhint->res_class = Xmalloc((unsigned) (len_class+1)))) {
+	if (! (classhint->res_class = Xmalloc(len_class + 1))) {
 	    Xfree(classhint->res_name);
 	    classhint->res_name = (char *) NULL;
 	    Xfree((char *) data);
diff --git a/lib/libX11/src/GetProp.c b/lib/libX11/src/GetProp.c
index ae14edcf9..9eb422ee3 100644
--- a/lib/libX11/src/GetProp.c
+++ b/lib/libX11/src/GetProp.c
@@ -49,6 +49,13 @@ XGetWindowProperty(
     register xGetPropertyReq *req;
     xError error = {0};
 
+    /* Always initialize return values, in case callers fail to initialize
+       them and fail to check the return code for an error. */
+    *actual_type = None;
+    *actual_format = 0;
+    *nitems = *bytesafter = 0L;
+    *prop = (unsigned char *) NULL;
+
     LockDisplay(dpy);
     GetReq (GetProperty, req);
     req->window = w;
@@ -65,7 +72,6 @@ XGetWindowProperty(
 	return (1);	/* not Success */
 	}
 
-    *prop = (unsigned char *) NULL;
     if (reply.propertyType != None) {
 	unsigned long nbytes, netbytes;
 	int format = reply.format;
diff --git a/lib/libX11/src/GetRGBCMap.c b/lib/libX11/src/GetRGBCMap.c
index 9e227a263..2f0b752a8 100644
--- a/lib/libX11/src/GetRGBCMap.c
+++ b/lib/libX11/src/GetRGBCMap.c
@@ -99,8 +99,7 @@ Status XGetRGBColormaps (
     /*
      * allocate array
      */
-    cmaps = (XStandardColormap *) Xmalloc (ncmaps *
-					   sizeof (XStandardColormap));
+    cmaps = Xmalloc (ncmaps * sizeof (XStandardColormap));
     if (!cmaps) {
 	if (data) Xfree ((char *) data);
 	return False;
diff --git a/lib/libX11/src/ImUtil.c b/lib/libX11/src/ImUtil.c
index fa8d464aa..240a26181 100644
--- a/lib/libX11/src/ImUtil.c
+++ b/lib/libX11/src/ImUtil.c
@@ -332,7 +332,7 @@ XImage *XCreateImage (
 	    (xpad != 8 && xpad != 16 && xpad != 32) ||
 	    offset < 0)
 	    return (XImage *) NULL;
-	if ((image = (XImage *) Xcalloc(1, (unsigned) sizeof(XImage))) == NULL)
+	if ((image = Xcalloc(1, sizeof(XImage))) == NULL)
 	    return (XImage *) NULL;
 
 	image->width = width;
@@ -842,7 +842,7 @@ static XImage *_XSubImage (
 	register unsigned long pixel;
 	char *data;
 
-	if ((subimage = (XImage *) Xcalloc (1, sizeof (XImage))) == NULL)
+	if ((subimage = Xcalloc (1, sizeof (XImage))) == NULL)
 	    return (XImage *) NULL;
 	subimage->width = width;
 	subimage->height = height;
@@ -868,7 +868,7 @@ static XImage *_XSubImage (
 	_XInitImageFuncPtrs (subimage);
 	dsize = subimage->bytes_per_line * height;
 	if (subimage->format == XYPixmap) dsize = dsize * subimage->depth;
-	if (((data = Xcalloc (1, (unsigned) dsize)) == NULL) && (dsize > 0)) {
+	if (((data = Xcalloc (1, dsize)) == NULL) && (dsize > 0)) {
 	    Xfree((char *) subimage);
 	    return (XImage *) NULL;
 	}
diff --git a/lib/libX11/src/InitExt.c b/lib/libX11/src/InitExt.c
index 19515ccd0..75991bd6d 100644
--- a/lib/libX11/src/InitExt.c
+++ b/lib/libX11/src/InitExt.c
@@ -49,7 +49,7 @@ XExtCodes *XInitExtension (
 		&codes.first_error)) return (NULL);
 
 	LockDisplay (dpy);
-	if (! (ext = (_XExtension *) Xcalloc (1, sizeof (_XExtension))) ||
+	if (! (ext = Xcalloc (1, sizeof (_XExtension))) ||
 	    ! (ext->name = strdup(name))) {
 	    if (ext) Xfree((char *) ext);
 	    UnlockDisplay(dpy);
@@ -71,7 +71,7 @@ XExtCodes *XAddExtension (Display *dpy)
     register _XExtension *ext;
 
     LockDisplay (dpy);
-    if (! (ext = (_XExtension *) Xcalloc (1, sizeof (_XExtension)))) {
+    if (! (ext = Xcalloc (1, sizeof (_XExtension)))) {
 	UnlockDisplay(dpy);
 	return (XExtCodes *) NULL;
     }
diff --git a/lib/libX11/src/IntAtom.c b/lib/libX11/src/IntAtom.c
index 7a5625840..25466ca20 100644
--- a/lib/libX11/src/IntAtom.c
+++ b/lib/libX11/src/IntAtom.c
@@ -72,7 +72,7 @@ Atom _XInternAtom(
 
     /* look in the cache first */
     if (!(atoms = dpy->atoms)) {
-	dpy->atoms = atoms = (AtomTable *)Xcalloc(1, sizeof(AtomTable));
+	dpy->atoms = atoms = Xcalloc(1, sizeof(AtomTable));
 	dpy->free_funcs->atoms = _XFreeAtomTable;
     }
     sig = 0;
@@ -127,7 +127,7 @@ _XUpdateAtomCache(
 
     if (!dpy->atoms) {
 	if (idx < 0) {
-	    dpy->atoms = (AtomTable *)Xcalloc(1, sizeof(AtomTable));
+	    dpy->atoms = Xcalloc(1, sizeof(AtomTable));
 	    dpy->free_funcs->atoms = _XFreeAtomTable;
 	}
 	if (!dpy->atoms)
@@ -147,7 +147,7 @@ _XUpdateAtomCache(
 	    }
 	}
     }
-    e = (Entry)Xmalloc(sizeof(EntryRec) + n + 1);
+    e = Xmalloc(sizeof(EntryRec) + n + 1);
     if (e) {
 	e->sig = sig;
 	e->atom = atom;
diff --git a/lib/libX11/src/Key.h b/lib/libX11/src/Key.h
index 0fe89ba37..bb254393c 100644
--- a/lib/libX11/src/Key.h
+++ b/lib/libX11/src/Key.h
@@ -2,6 +2,9 @@
 #ifndef _KEY_H_
 #define _KEY_H_
 
+#include <X11/Xlib.h>
+#include <X11/Xresource.h>
+
 #ifndef NEEDKTABLE
 extern const unsigned char _XkeyTable[];
 #endif
diff --git a/lib/libX11/src/KeyBind.c b/lib/libX11/src/KeyBind.c
index f22feca59..2110772ce 100644
--- a/lib/libX11/src/KeyBind.c
+++ b/lib/libX11/src/KeyBind.c
@@ -997,11 +997,9 @@ XRebindKeysym (
     tmp = dpy->key_bindings;
     nb = sizeof(KeySym) * nm;
 
-    if ((! (p = (struct _XKeytrans *) Xcalloc( 1, sizeof(struct _XKeytrans)))) ||
-	((! (p->string = (char *) Xmalloc( (unsigned) nbytes))) &&
-	 (nbytes > 0)) ||
-	((! (p->modifiers = (KeySym *) Xmalloc( (unsigned) nb))) &&
-	 (nb > 0))) {
+    if ((! (p = Xcalloc( 1, sizeof(struct _XKeytrans)))) ||
+	((! (p->string = Xmalloc(nbytes))) && (nbytes > 0)) ||
+	((! (p->modifiers = Xmalloc(nb))) && (nb > 0))) {
 	if (p) {
 	    if (p->string) Xfree(p->string);
 	    if (p->modifiers) Xfree((char *) p->modifiers);
diff --git a/lib/libX11/src/LiICmaps.c b/lib/libX11/src/LiICmaps.c
index e98161916..45a2f2fd3 100644
--- a/lib/libX11/src/LiICmaps.c
+++ b/lib/libX11/src/LiICmaps.c
@@ -34,7 +34,7 @@ Colormap *XListInstalledColormaps(
     Window win,
     int *n)  /* RETURN */
 {
-    long nbytes;
+    unsigned long nbytes;
     Colormap *cmaps;
     xListInstalledColormapsReply rep;
     register xResourceReq *req;
@@ -51,14 +51,14 @@ Colormap *XListInstalledColormaps(
 
     if (rep.nColormaps) {
 	nbytes = rep.nColormaps * sizeof(Colormap);
-	cmaps = (Colormap *) Xmalloc((unsigned) nbytes);
-	nbytes = rep.nColormaps << 2;
+	cmaps = Xmalloc(nbytes);
 	if (! cmaps) {
-	    _XEatData(dpy, (unsigned long) nbytes);
+	    _XEatDataWords(dpy, rep.length);
 	    UnlockDisplay(dpy);
 	    SyncHandle();
 	    return((Colormap *) NULL);
 	}
+	nbytes = rep.nColormaps << 2;
 	_XRead32 (dpy, (long *) cmaps, nbytes);
     }
     else cmaps = (Colormap *) NULL;
diff --git a/lib/libX11/src/LiProps.c b/lib/libX11/src/LiProps.c
index 72560aba7..d9c746563 100644
--- a/lib/libX11/src/LiProps.c
+++ b/lib/libX11/src/LiProps.c
@@ -34,7 +34,7 @@ Atom *XListProperties(
     Window window,
     int *n_props)  /* RETURN */
 {
-    long nbytes;
+    unsigned long nbytes;
     xListPropertiesReply rep;
     Atom *properties;
     register xResourceReq *req;
@@ -50,14 +50,14 @@ Atom *XListProperties(
 
     if (rep.nProperties) {
 	nbytes = rep.nProperties * sizeof(Atom);
-	properties = (Atom *) Xmalloc ((unsigned) nbytes);
-	nbytes = rep.nProperties << 2;
+	properties = Xmalloc (nbytes);
 	if (! properties) {
-	    _XEatData(dpy, (unsigned long) nbytes);
+	    _XEatDataWords(dpy, rep.length);
 	    UnlockDisplay(dpy);
 	    SyncHandle();
 	    return (Atom *) NULL;
 	}
+	nbytes = rep.nProperties << 2;
 	_XRead32 (dpy, (long *) properties, nbytes);
     }
     else properties = (Atom *) NULL;
diff --git a/lib/libX11/src/ModMap.c b/lib/libX11/src/ModMap.c
index 122ca80db..5c5b42612 100644
--- a/lib/libX11/src/ModMap.c
+++ b/lib/libX11/src/ModMap.c
@@ -97,11 +97,11 @@ XSetModifierMapping(
 XModifierKeymap *
 XNewModifiermap(int keyspermodifier)
 {
-    XModifierKeymap *res = (XModifierKeymap *) Xmalloc((sizeof (XModifierKeymap)));
+    XModifierKeymap *res = Xmalloc((sizeof (XModifierKeymap)));
     if (res) {
 	res->max_keypermod = keyspermodifier;
 	res->modifiermap = (keyspermodifier > 0 ?
-			    (KeyCode *) Xmalloc((unsigned) (8 * keyspermodifier))
+			    Xmalloc(8 * keyspermodifier)
 			    : (KeyCode *) NULL);
 	if (keyspermodifier && (res->modifiermap == NULL)) {
 	    Xfree((char *) res);
diff --git a/lib/libX11/src/OpenDis.c b/lib/libX11/src/OpenDis.c
index 9379fec83..fc67d1a66 100644
--- a/lib/libX11/src/OpenDis.c
+++ b/lib/libX11/src/OpenDis.c
@@ -112,7 +112,7 @@ XOpenDisplay (
 /*
  * Attempt to allocate a display structure. Return NULL if allocation fails.
  */
-	if ((dpy = (Display *)Xcalloc(1, sizeof(Display))) == NULL) {
+	if ((dpy = Xcalloc(1, sizeof(Display))) == NULL) {
 		return(NULL);
 	}
 
@@ -246,9 +246,7 @@ XOpenDisplay (
 	dpy->qlen = 0;
 
 	/* Set up free-function record */
-	if ((dpy->free_funcs = (_XFreeFuncRec *)Xcalloc(1,
-							sizeof(_XFreeFuncRec)))
-	    == NULL) {
+	if ((dpy->free_funcs = Xcalloc(1, sizeof(_XFreeFuncRec))) == NULL) {
 	    OutOfMemory (dpy);
 	    return(NULL);
 	}
@@ -316,7 +314,7 @@ XOpenDisplay (
 	    return (NULL);
 	}
 
-	dpy->vendor = (char *) Xmalloc((unsigned) (u.setup->nbytesVendor + 1));
+	dpy->vendor = Xmalloc(u.setup->nbytesVendor + 1);
 	if (dpy->vendor == NULL) {
 	    OutOfMemory(dpy);
 	    return (NULL);
@@ -342,9 +340,7 @@ XOpenDisplay (
 /*
  * Now iterate down setup information.....
  */
-	dpy->pixmap_format =
-	    (ScreenFormat *)Xmalloc(
-		(unsigned) (dpy->nformats *sizeof(ScreenFormat)));
+	dpy->pixmap_format = Xcalloc(dpy->nformats, sizeof(ScreenFormat));
 	if (dpy->pixmap_format == NULL) {
 	        OutOfMemory (dpy);
 		return(NULL);
@@ -372,8 +368,7 @@ XOpenDisplay (
 /*
  * next the Screen structures.
  */
-	dpy->screens =
-	    (Screen *)Xmalloc((unsigned) dpy->nscreens*sizeof(Screen));
+	dpy->screens = Xcalloc(dpy->nscreens, sizeof(Screen));
 	if (dpy->screens == NULL) {
 	        OutOfMemory (dpy);
 		return(NULL);
@@ -415,8 +410,7 @@ XOpenDisplay (
 /*
  * lets set up the depth structures.
  */
-	    sp->depths = (Depth *)Xmalloc(
-			(unsigned)sp->ndepths*sizeof(Depth));
+	    sp->depths = Xcalloc(sp->ndepths, sizeof(Depth));
 	    if (sp->depths == NULL) {
 		OutOfMemory (dpy);
 		return(NULL);
@@ -438,8 +432,7 @@ XOpenDisplay (
 		dp->nvisuals = u.dp->nVisuals;
 		u.dp = (xDepth *) (((char *) u.dp) + sz_xDepth);
 		if (dp->nvisuals > 0) {
-		    dp->visuals =
-		      (Visual *)Xmalloc((unsigned)dp->nvisuals*sizeof(Visual));
+		    dp->visuals = Xcalloc(dp->nvisuals, sizeof(Visual));
 		    if (dp->visuals == NULL) {
 			OutOfMemory (dpy);
 			return(NULL);
@@ -499,6 +492,9 @@ XOpenDisplay (
 	    return(NULL);
 	}
 
+/*
+ * get availability of large requests
+ */
 	dpy->bigreq_size = xcb_get_maximum_request_length(dpy->xcb->connection);
 	if(dpy->bigreq_size <= dpy->max_request_size)
 		dpy->bigreq_size = 0;
@@ -525,7 +521,6 @@ XOpenDisplay (
 	(void) XSynchronize(dpy, _Xdebug);
 
 /*
- * get availability of large requests, and
  * get the resource manager database off the root window.
  */
 	LockDisplay(dpy);
@@ -550,7 +545,7 @@ XOpenDisplay (
 		    dpy->xdefaults[reply.nItems] = '\0';
 		}
 		else if (reply.propertyType != None)
-		    _XEatData(dpy, reply.nItems * (reply.format >> 3));
+		    _XEatDataWords(dpy, reply.length);
 	    }
 	}
 	UnlockDisplay(dpy);
diff --git a/lib/libX11/src/PixFormats.c b/lib/libX11/src/PixFormats.c
index 8e4a10027..6d9f64d2c 100644
--- a/lib/libX11/src/PixFormats.c
+++ b/lib/libX11/src/PixFormats.c
@@ -38,8 +38,8 @@ XPixmapFormatValues *XListPixmapFormats (
     Display *dpy,
     int *count)	/* RETURN */
 {
-    XPixmapFormatValues *formats = (XPixmapFormatValues *)
-	Xmalloc((unsigned) (dpy->nformats * sizeof (XPixmapFormatValues)));
+    XPixmapFormatValues *formats =
+	Xmalloc(dpy->nformats * sizeof (XPixmapFormatValues));
 
     if (formats) {
 	register int i;
diff --git a/lib/libX11/src/PolyReg.c b/lib/libX11/src/PolyReg.c
index 74c8765fe..6d0277332 100644
--- a/lib/libX11/src/PolyReg.c
+++ b/lib/libX11/src/PolyReg.c
@@ -95,8 +95,7 @@ InsertEdgeInET(
     {
         if (*iSLLBlock > SLLSPERBLOCK-1)
         {
-            tmpSLLBlock =
-		  (ScanLineListBlock *)Xmalloc(sizeof(ScanLineListBlock));
+            tmpSLLBlock = Xmalloc(sizeof(ScanLineListBlock));
             (*SLLBlock)->next = tmpSLLBlock;
             tmpSLLBlock->next = (ScanLineListBlock *)NULL;
             *SLLBlock = tmpSLLBlock;
@@ -410,8 +409,7 @@ static int PtsToRegion(
 
     numRects = ((numFullPtBlocks * NUMPTSTOBUFFER) + iCurPtBlock) >> 1;
 
-    if (!(reg->rects = (BOX *)Xrealloc((char *)reg->rects,
-	    (unsigned) (sizeof(BOX) * numRects))))  {
+    if (!(reg->rects = Xrealloc(reg->rects, sizeof(BOX) * numRects))) {
 	Xfree(prevRects);
 	return(0);
     }
@@ -521,8 +519,7 @@ XPolygonRegion(
 
     if (Count < 2) return region;
 
-    if (! (pETEs = (EdgeTableEntry *)
-	   Xmalloc((unsigned) (sizeof(EdgeTableEntry) * Count)))) {
+    if (! (pETEs = Xmalloc(sizeof(EdgeTableEntry) * Count))) {
 	XDestroyRegion(region);
 	return (Region) NULL;
     }
@@ -559,7 +556,7 @@ XPolygonRegion(
                  *  send out the buffer
                  */
                 if (iPts == NUMPTSTOBUFFER) {
-                    tmpPtBlock = (POINTBLOCK *)Xmalloc(sizeof(POINTBLOCK));
+                    tmpPtBlock = Xmalloc(sizeof(POINTBLOCK));
                     curPtBlock->next = tmpPtBlock;
                     curPtBlock = tmpPtBlock;
                     pts = curPtBlock->pts;
@@ -605,7 +602,7 @@ XPolygonRegion(
                      *  send out the buffer
                      */
                     if (iPts == NUMPTSTOBUFFER) {
-                        tmpPtBlock = (POINTBLOCK *)Xmalloc(sizeof(POINTBLOCK));
+                        tmpPtBlock = Xmalloc(sizeof(POINTBLOCK));
                         curPtBlock->next = tmpPtBlock;
                         curPtBlock = tmpPtBlock;
                         pts = curPtBlock->pts;
diff --git a/lib/libX11/src/PropAlloc.c b/lib/libX11/src/PropAlloc.c
index 516283080..87817d88a 100644
--- a/lib/libX11/src/PropAlloc.c
+++ b/lib/libX11/src/PropAlloc.c
@@ -39,20 +39,19 @@ in this Software without prior written authorization from The Open Group.
 
 XSizeHints *XAllocSizeHints (void)
 {
-    return ((XSizeHints *) Xcalloc (1, (unsigned) sizeof (XSizeHints)));
+    return Xcalloc (1, sizeof (XSizeHints));
 }
 
 
 XStandardColormap *XAllocStandardColormap (void)
 {
-    return ((XStandardColormap *)
-	    Xcalloc (1, (unsigned) sizeof (XStandardColormap)));
+    return Xcalloc (1, sizeof (XStandardColormap));
 }
 
 
 XWMHints *XAllocWMHints (void)
 {
-    return ((XWMHints *) Xcalloc (1, (unsigned) sizeof (XWMHints)));
+    return Xcalloc (1, sizeof (XWMHints));
 }
 
 
@@ -64,7 +63,7 @@ XClassHint *XAllocClassHint (void)
 
 XIconSize *XAllocIconSize (void)
 {
-    return ((XIconSize *) Xcalloc (1, (unsigned) sizeof (XIconSize)));
+    return Xcalloc (1, sizeof (XIconSize));
 }
 
 
diff --git a/lib/libX11/src/PutBEvent.c b/lib/libX11/src/PutBEvent.c
index f9d4c29bd..1768e032c 100644
--- a/lib/libX11/src/PutBEvent.c
+++ b/lib/libX11/src/PutBEvent.c
@@ -41,7 +41,7 @@ _XPutBackEvent (
 	XEvent store = *event;
 
 	if (!dpy->qfree) {
-    	    if ((dpy->qfree = (_XQEvent *) Xmalloc (sizeof (_XQEvent))) == NULL) {
+	    if ((dpy->qfree = Xmalloc (sizeof (_XQEvent))) == NULL) {
 		return 0;
 	    }
 	    dpy->qfree->next = NULL;
diff --git a/lib/libX11/src/PutImage.c b/lib/libX11/src/PutImage.c
index 6dad4f13a..2a694f099 100644
--- a/lib/libX11/src/PutImage.c
+++ b/lib/libX11/src/PutImage.c
@@ -680,7 +680,7 @@ SendXYImage(
 
     length = ROUNDUP(length, 4);
     if ((dpy->bufptr + length) > dpy->bufmax) {
-	if ((buf = _XAllocScratch(dpy, (unsigned long) (length))) == NULL) {
+	if ((buf = _XAllocScratch(dpy, length)) == NULL) {
 	    UnGetReq(PutImage);
 	    return;
 	}
@@ -703,13 +703,13 @@ SendXYImage(
 	bytes_per_temp_plane = bytes_per_line * req->height;
 	temp_length = ROUNDUP(bytes_per_temp_plane * image->depth, 4);
 	if (buf == dpy->bufptr) {
-	    if (! (temp = _XAllocScratch(dpy, (unsigned long) temp_length))) {
+	    if (! (temp = _XAllocScratch(dpy, temp_length))) {
 		UnGetReq(PutImage);
 		return;
 	    }
 	}
 	else
-	    if ((extra = temp = Xmalloc((unsigned) temp_length)) == NULL) {
+	    if ((extra = temp = Xmalloc(temp_length)) == NULL) {
 		UnGetReq(PutImage);
 		return;
 	    }
@@ -778,8 +778,7 @@ SendZImage(
 	  (req_yoffset * image->bytes_per_line) +
 	  ((req_xoffset * image->bits_per_pixel) >> 3);
     if ((image->bits_per_pixel == 4) && ((unsigned int) req_xoffset & 0x01)) {
-	if (! (shifted_src = (unsigned char *)
-	       Xmalloc((unsigned) (req->height * image->bytes_per_line)))) {
+	if (! (shifted_src = Xmalloc(req->height * image->bytes_per_line))) {
 	    UnGetReq(PutImage);
 	    return;
 	}
@@ -810,7 +809,7 @@ SendZImage(
 	dest = (unsigned char *)dpy->bufptr;
     else
 	if ((dest = (unsigned char *)
-	     _XAllocScratch(dpy, (unsigned long)(length))) == NULL) {
+	     _XAllocScratch(dpy, length)) == NULL) {
 	    if (shifted_src) Xfree((char *) shifted_src);
 	    UnGetReq(PutImage);
 	    return;
@@ -1001,7 +1000,7 @@ XPutImage (
 	    img.bits_per_pixel = dest_bits_per_pixel;
 	    img.bytes_per_line = ROUNDUP((dest_bits_per_pixel * width),
 					 dest_scanline_pad) >> 3;
-	    img.data = Xmalloc((unsigned) (img.bytes_per_line * height));
+	    img.data = Xmalloc(img.bytes_per_line * height);
 	    if (img.data == NULL)
 		return 0;
 	    _XInitImageFuncPtrs(&img);
diff --git a/lib/libX11/src/QuColors.c b/lib/libX11/src/QuColors.c
index 237b8bf03..13a63eb25 100644
--- a/lib/libX11/src/QuColors.c
+++ b/lib/libX11/src/QuColors.c
@@ -37,9 +37,7 @@ _XQueryColors(
     int ncolors)
 {
     register int i;
-    xrgb *color;
     xQueryColorsReply rep;
-    long nbytes;
     register xQueryColorsReq *req;
 
     GetReq(QueryColors, req);
@@ -52,8 +50,9 @@ _XQueryColors(
        /* XXX this isn't very efficient */
 
     if (_XReply(dpy, (xReply *) &rep, 0, xFalse) != 0) {
-	if ((color = (xrgb *)
-	    Xmalloc((unsigned) (nbytes = (long) ncolors * SIZEOF(xrgb))))) {
+	unsigned long nbytes = (long) ncolors * SIZEOF(xrgb);
+	xrgb *color = Xmalloc(nbytes);
+	if (color != NULL) {
 
 	    _XRead(dpy, (char *) color, nbytes);
 
@@ -67,7 +66,8 @@ _XQueryColors(
 	    }
 	    Xfree((char *)color);
 	}
-	else _XEatData(dpy, (unsigned long) nbytes);
+	else
+	    _XEatDataWords(dpy, rep.length);
     }
 }
 
diff --git a/lib/libX11/src/QuTree.c b/lib/libX11/src/QuTree.c
index 3cea282fa..8da2ae261 100644
--- a/lib/libX11/src/QuTree.c
+++ b/lib/libX11/src/QuTree.c
@@ -37,7 +37,7 @@ Status XQueryTree (
     Window **children,	/* RETURN */
     unsigned int *nchildren)  /* RETURN */
 {
-    long nbytes;
+    unsigned long nbytes;
     xQueryTreeReply rep;
     register xResourceReq *req;
 
@@ -52,14 +52,14 @@ Status XQueryTree (
     *children = (Window *) NULL;
     if (rep.nChildren != 0) {
 	nbytes = rep.nChildren * sizeof(Window);
-	*children = (Window *) Xmalloc((unsigned) nbytes);
-	nbytes = rep.nChildren << 2;
+	*children = Xmalloc(nbytes);
 	if (! *children) {
-	    _XEatData(dpy, (unsigned long) nbytes);
+	    _XEatDataWords(dpy, rep.length);
 	    UnlockDisplay(dpy);
 	    SyncHandle();
 	    return (0);
 	}
+	nbytes = rep.nChildren << 2;
 	_XRead32 (dpy, (long *) *children, nbytes);
     }
     *parent = rep.parent;
diff --git a/lib/libX11/src/Quarks.c b/lib/libX11/src/Quarks.c
index 4eb90c51d..60fe127bd 100644
--- a/lib/libX11/src/Quarks.c
+++ b/lib/libX11/src/Quarks.c
@@ -186,15 +186,14 @@ ExpandQuarkTable(void)
 	newmask = (oldmask << 1) + 1;
     else {
 	if (!stringTable) {
-	    stringTable = (XrmString **)Xmalloc(sizeof(XrmString *) *
-						CHUNKPER);
+	    stringTable = Xmalloc(sizeof(XrmString *) * CHUNKPER);
 	    if (!stringTable)
 		return False;
 	    stringTable[0] = (XrmString *)NULL;
 	}
 #ifdef PERMQ
 	if (!permTable)
-	    permTable = (Bits **)Xmalloc(sizeof(Bits *) * CHUNKPER);
+	    permTable = Xmalloc(sizeof(Bits *) * CHUNKPER);
 	if (!permTable)
 	    return False;
 #endif
@@ -289,13 +288,13 @@ nomatch:    if (!rehash)
     q = nextQuark;
     if (!(q & QUANTUMMASK)) {
 	if (!(q & CHUNKMASK)) {
-	    if (!(new = Xrealloc((char *)stringTable,
+	    if (!(new = Xrealloc(stringTable,
 				 sizeof(XrmString *) *
 				 ((q >> QUANTUMSHIFT) + CHUNKPER))))
 		goto fail;
 	    stringTable = (XrmString **)new;
 #ifdef PERMQ
-	    if (!(new = Xrealloc((char *)permTable,
+	    if (!(new = Xrealloc(permTable,
 				 sizeof(Bits *) *
 				 ((q >> QUANTUMSHIFT) + CHUNKPER))))
 		goto fail;
diff --git a/lib/libX11/src/RdBitF.c b/lib/libX11/src/RdBitF.c
index ab7d800d3..727204fca 100644
--- a/lib/libX11/src/RdBitF.c
+++ b/lib/libX11/src/RdBitF.c
@@ -191,7 +191,7 @@ XReadBitmapFileData (
 	bytes_per_line = (ww+7)/8 + padding;
 
 	size = bytes_per_line * hh;
-	bits = (unsigned char *) Xmalloc ((unsigned int) size);
+	bits = Xmalloc (size);
 	if (!bits)
 	  RETURN (BitmapNoMemory);
 
diff --git a/lib/libX11/src/Region.c b/lib/libX11/src/Region.c
index 41047b242..d3d431a64 100644
--- a/lib/libX11/src/Region.c
+++ b/lib/libX11/src/Region.c
@@ -139,9 +139,9 @@ XCreateRegion(void)
 {
     Region temp;
 
-    if (! (temp = ( Region )Xmalloc( (unsigned) sizeof( REGION ))))
+    if (! (temp = Xmalloc(sizeof( REGION ))))
 	return (Region) NULL;
-    if (! (temp->rects = ( BOX * )Xmalloc( (unsigned) sizeof( BOX )))) {
+    if (! (temp->rects = Xmalloc(sizeof( BOX )))) {
 	Xfree((char *) temp);
 	return (Region) NULL;
     }
@@ -521,9 +521,9 @@ miRegionCopy(
             {
 		BOX *prevRects = dstrgn->rects;
 
-                if (! (dstrgn->rects = (BOX *)
-		       Xrealloc((char *) dstrgn->rects,
-				(unsigned) rgn->numRects * (sizeof(BOX))))) {
+		dstrgn->rects = Xrealloc(dstrgn->rects,
+					 rgn->numRects * (sizeof(BOX)));
+		if (! dstrgn->rects) {
 		    Xfree(prevRects);
 		    return;
 		}
@@ -788,8 +788,7 @@ miRegionOp(
      */
     newReg->size = max(reg1->numRects,reg2->numRects) * 2;
 
-    if (! (newReg->rects = (BoxPtr)
-	   Xmalloc ((unsigned) (sizeof(BoxRec) * newReg->size)))) {
+    if (! (newReg->rects = Xmalloc (sizeof(BoxRec) * newReg->size))) {
 	newReg->size = 0;
 	return;
     }
@@ -980,8 +979,8 @@ miRegionOp(
 	{
 	    BoxPtr prev_rects = newReg->rects;
 	    newReg->size = newReg->numRects;
-	    newReg->rects = (BoxPtr) Xrealloc ((char *) newReg->rects,
-				   (unsigned) (sizeof(BoxRec) * newReg->size));
+	    newReg->rects = Xrealloc (newReg->rects,
+				      sizeof(BoxRec) * newReg->size);
 	    if (! newReg->rects)
 		newReg->rects = prev_rects;
 	}
@@ -993,7 +992,7 @@ miRegionOp(
 	     */
 	    newReg->size = 1;
 	    Xfree((char *) newReg->rects);
-	    newReg->rects = (BoxPtr) Xmalloc(sizeof(BoxRec));
+	    newReg->rects = Xmalloc(sizeof(BoxRec));
 	}
     }
     Xfree ((char *) oldRects);
diff --git a/lib/libX11/src/RegstFlt.c b/lib/libX11/src/RegstFlt.c
index 9a560e794..5a1faa7e9 100644
--- a/lib/libX11/src/RegstFlt.c
+++ b/lib/libX11/src/RegstFlt.c
@@ -85,7 +85,7 @@ _XRegisterFilterByMask(
 {
     XFilterEventRec		*rec;
 
-    rec = (XFilterEventList)Xmalloc(sizeof(XFilterEventRec));
+    rec = Xmalloc(sizeof(XFilterEventRec));
     if (!rec)
 	return;
     rec->window = window;
@@ -117,7 +117,7 @@ _XRegisterFilterByType(
 {
     XFilterEventRec		*rec;
 
-    rec = (XFilterEventList)Xmalloc(sizeof(XFilterEventRec));
+    rec = Xmalloc(sizeof(XFilterEventRec));
     if (!rec)
 	return;
     rec->window = window;
diff --git a/lib/libX11/src/SetFPath.c b/lib/libX11/src/SetFPath.c
index 89955c23e..b1afd8201 100644
--- a/lib/libX11/src/SetFPath.c
+++ b/lib/libX11/src/SetFPath.c
@@ -52,7 +52,7 @@ XSetFontPath (
 	}
 	nbytes = (n + 3) & ~3;
 	req->length += nbytes >> 2;
-	if ((p = (char *) Xmalloc ((unsigned) nbytes))) {
+	if ((p = Xmalloc (nbytes))) {
 		/*
 	 	 * pack into counted strings.
 	 	 */
diff --git a/lib/libX11/src/SetHints.c b/lib/libX11/src/SetHints.c
index 1cde48f85..0ae076438 100644
--- a/lib/libX11/src/SetHints.c
+++ b/lib/libX11/src/SetHints.c
@@ -184,7 +184,7 @@ XSetIconSizes (
 #define size_of_the_real_thing sizeof	/* avoid grepping screwups */
 	unsigned nbytes = count * size_of_the_real_thing(xPropIconSize);
 #undef size_of_the_real_thing
-	if ((prop = pp = (xPropIconSize *) Xmalloc (nbytes))) {
+	if ((prop = pp = Xmalloc (nbytes))) {
 	    for (i = 0; i < count; i++) {
 		pp->minWidth  = list->min_width;
 		pp->minHeight = list->min_height;
@@ -216,7 +216,7 @@ XSetCommand (
 	for (i = 0, nbytes = 0; i < argc; i++) {
 		nbytes += safestrlen(argv[i]) + 1;
 	}
-	if ((bp = buf = Xmalloc((unsigned) nbytes))) {
+	if ((bp = buf = Xmalloc(nbytes))) {
 	    /* copy arguments into single buffer */
 	    for (i = 0; i < argc; i++) {
 		if (argv[i]) {
@@ -299,7 +299,7 @@ XSetClassHint(
 
 	len_nm = safestrlen(classhint->res_name);
 	len_cl = safestrlen(classhint->res_class);
-	if ((class_string = s = Xmalloc((unsigned) (len_nm + len_cl + 2)))) {
+	if ((class_string = s = Xmalloc(len_nm + len_cl + 2))) {
 	    if (len_nm) {
 		strcpy(s, classhint->res_name);
 		s += len_nm + 1;
diff --git a/lib/libX11/src/StrToText.c b/lib/libX11/src/StrToText.c
index b5327e8fc..ef927f3d9 100644
--- a/lib/libX11/src/StrToText.c
+++ b/lib/libX11/src/StrToText.c
@@ -78,7 +78,7 @@ Status XStringListToTextProperty (
 	    }
 	}
     } else {
-	proto.value = (unsigned char *) Xmalloc (1);	/* easier for client */
+	proto.value = Xmalloc (1);		/* easier for client */
 	if (!proto.value) return False;
 
 	proto.value[0] = '\0';
diff --git a/lib/libX11/src/TextToStr.c b/lib/libX11/src/TextToStr.c
index 216391c2e..36d9f0706 100644
--- a/lib/libX11/src/TextToStr.c
+++ b/lib/libX11/src/TextToStr.c
@@ -72,10 +72,10 @@ Status XTextPropertyToStringList (
     /*
      * allocate list and duplicate
      */
-    list = (char **) Xmalloc (nelements * sizeof (char *));
+    list = Xmalloc (nelements * sizeof (char *));
     if (!list) return False;
 
-    start = (char *) Xmalloc ((datalen + 1) * sizeof (char));	/* for <NUL> */
+    start = Xmalloc ((datalen + 1) * sizeof (char));	/* for <NUL> */
     if (!start) {
 	Xfree ((char *) list);
 	return False;
diff --git a/lib/libX11/src/VisUtil.c b/lib/libX11/src/VisUtil.c
index 3434c0161..aa679928a 100644
--- a/lib/libX11/src/VisUtil.c
+++ b/lib/libX11/src/VisUtil.c
@@ -75,8 +75,7 @@ XVisualInfo *XGetVisualInfo(
 
   count = 0;
   total = 10;
-  if (! (vip_base = vip = (XVisualInfo *)
-	 Xmalloc((unsigned) (sizeof(XVisualInfo) * total)))) {
+  if (! (vip_base = vip = Xmalloc(sizeof(XVisualInfo) * total))) {
       UnlockDisplay(dpy);
       return (XVisualInfo *) NULL;
   }
@@ -132,9 +131,8 @@ XVisualInfo *XGetVisualInfo(
                 {
 		  XVisualInfo *old_vip_base = vip_base;
                   total += 10;
-                  if (! (vip_base = (XVisualInfo *)
-			 Xrealloc((char *) vip_base,
-				  (unsigned) (sizeof(XVisualInfo) * total)))) {
+                  if (! (vip_base = Xrealloc(vip_base,
+					     sizeof(XVisualInfo) * total))) {
 		      Xfree((char *) old_vip_base);
 		      UnlockDisplay(dpy);
 		      return (XVisualInfo *) NULL;
diff --git a/lib/libX11/src/WrBitF.c b/lib/libX11/src/WrBitF.c
index 1ec6280fb..75a93a79d 100644
--- a/lib/libX11/src/WrBitF.c
+++ b/lib/libX11/src/WrBitF.c
@@ -53,7 +53,7 @@ static char *Format_Image(
   bytes_per_line = (width+7)/8;
   *resultsize = bytes_per_line * height;           /* Calculate size of data */
 
-  data = (char *) Xmalloc( *resultsize );           /* Get space for data */
+  data = Xmalloc( *resultsize );                   /* Get space for data */
   if (!data)
     return(ERR_RETURN);
 
diff --git a/lib/libX11/src/Xintatom.h b/lib/libX11/src/Xintatom.h
index 82dba36e1..516a72b1d 100644
--- a/lib/libX11/src/Xintatom.h
+++ b/lib/libX11/src/Xintatom.h
@@ -2,6 +2,7 @@
 #ifndef _XINTATOM_H_
 #define _XINTATOM_H_ 1
 
+#include <X11/Xlib.h>
 #include <X11/Xfuncproto.h>
 
 /* IntAtom.c */
diff --git a/lib/libX11/src/Xintconn.h b/lib/libX11/src/Xintconn.h
index db59061a0..cd9aee32e 100644
--- a/lib/libX11/src/Xintconn.h
+++ b/lib/libX11/src/Xintconn.h
@@ -3,6 +3,7 @@
 #define _XINTCONN_H_ 1
 
 #include <X11/Xfuncproto.h>
+#include <X11/Xlib.h>
 
 _XFUNCPROTOBEGIN
 
diff --git a/lib/libX11/src/XlibInt.c b/lib/libX11/src/XlibInt.c
index 1c964fdea..b06e57baa 100644
--- a/lib/libX11/src/XlibInt.c
+++ b/lib/libX11/src/XlibInt.c
@@ -152,7 +152,7 @@ Bool _XPollfdCacheInit(
 #ifdef USE_POLL
     struct pollfd *pfp;
 
-    pfp = (struct pollfd *)Xmalloc(POLLFD_CACHE_SIZE * sizeof(struct pollfd));
+    pfp = Xmalloc(POLLFD_CACHE_SIZE * sizeof(struct pollfd));
     if (!pfp)
 	return False;
     pfp[0].fd = dpy->fd;
@@ -374,10 +374,10 @@ _XRegisterInternalConnection(
     struct _XConnWatchInfo *watchers;
     XPointer *wd;
 
-    new_conni = (struct _XConnectionInfo*)Xmalloc(sizeof(struct _XConnectionInfo));
+    new_conni = Xmalloc(sizeof(struct _XConnectionInfo));
     if (!new_conni)
 	return 0;
-    new_conni->watch_data = (XPointer *)Xmalloc(dpy->watcher_count * sizeof(XPointer));
+    new_conni->watch_data = Xmalloc(dpy->watcher_count * sizeof(XPointer));
     if (!new_conni->watch_data) {
 	Xfree(new_conni);
 	return 0;
@@ -464,7 +464,7 @@ XInternalConnectionNumbers(
     count = 0;
     for (info_list=dpy->im_fd_info; info_list; info_list=info_list->next)
 	count++;
-    fd_list = (int*) Xmalloc (count * sizeof(int));
+    fd_list = Xmalloc (count * sizeof(int));
     if (!fd_list) {
 	UnlockDisplay(dpy);
 	return 0;
@@ -537,9 +537,8 @@ XAddConnectionWatch(
 
     /* allocate new watch data */
     for (info_list=dpy->im_fd_info; info_list; info_list=info_list->next) {
-	wd_array = (XPointer *)Xrealloc((char *)info_list->watch_data,
-					(dpy->watcher_count + 1) *
-					sizeof(XPointer));
+	wd_array = Xrealloc(info_list->watch_data,
+			    (dpy->watcher_count + 1) * sizeof(XPointer));
 	if (!wd_array) {
 	    UnlockDisplay(dpy);
 	    return 0;
@@ -548,7 +547,7 @@ XAddConnectionWatch(
 	wd_array[dpy->watcher_count] = NULL;	/* for cleanliness */
     }
 
-    new_watcher = (struct _XConnWatchInfo*)Xmalloc(sizeof(struct _XConnWatchInfo));
+    new_watcher = Xmalloc(sizeof(struct _XConnWatchInfo));
     if (!new_watcher) {
 	UnlockDisplay(dpy);
 	return 0;
@@ -756,8 +755,7 @@ void _XEnq(
 		/* If dpy->qfree is non-NULL do this, else malloc a new one. */
 		dpy->qfree = qelt->next;
 	}
-	else if ((qelt =
-	    (_XQEvent *) Xmalloc((unsigned)sizeof(_XQEvent))) == NULL) {
+	else if ((qelt = Xmalloc(sizeof(_XQEvent))) == NULL) {
 		/* Malloc call failed! */
 		ESET(ENOMEM);
 		_XIOError(dpy);
@@ -1518,7 +1516,7 @@ char *_XAllocScratch(
 {
 	if (nbytes > dpy->scratch_length) {
 	    if (dpy->scratch_buffer) Xfree (dpy->scratch_buffer);
-	    if ((dpy->scratch_buffer = Xmalloc((unsigned) nbytes)))
+	    if ((dpy->scratch_buffer = Xmalloc(nbytes)))
 		dpy->scratch_length = nbytes;
 	    else dpy->scratch_length = 0;
 	}
diff --git a/lib/libX11/src/Xprivate.h b/lib/libX11/src/Xprivate.h
index 006b1705e..6bfe70baa 100644
--- a/lib/libX11/src/Xprivate.h
+++ b/lib/libX11/src/Xprivate.h
@@ -8,6 +8,8 @@
 #ifndef XPRIVATE_H
 #define XPRIVATE_H
 
+#include <X11/Xlib.h>
+
 extern _X_HIDDEN void _XIDHandler(Display *dpy);
 extern _X_HIDDEN void _XSeqSyncFunction(Display *dpy);
 extern _X_HIDDEN void _XSetPrivSyncFunction(Display *dpy);
diff --git a/lib/libX11/src/Xresinternal.h b/lib/libX11/src/Xresinternal.h
index c2f355fe6..b5cc7ffc4 100644
--- a/lib/libX11/src/Xresinternal.h
+++ b/lib/libX11/src/Xresinternal.h
@@ -2,6 +2,8 @@
 #ifndef _XRESINTERNAL_H_
 #define _XRESINTERNAL_H_
 
+#include <X11/Xlib.h>
+#include <X11/Xresource.h>
 #include <inttypes.h>
 
 /* type defines */
diff --git a/lib/libX11/src/Xrm.c b/lib/libX11/src/Xrm.c
index 2c0c324c0..d8272ee78 100644
--- a/lib/libX11/src/Xrm.c
+++ b/lib/libX11/src/Xrm.c
@@ -495,7 +495,7 @@ static XrmDatabase NewDatabase(void)
 {
     register XrmDatabase db;
 
-    db = (XrmDatabase) Xmalloc(sizeof(XrmHashBucketRec));
+    db = Xmalloc(sizeof(XrmHashBucketRec));
     if (db) {
 	_XCreateMutex(&db->linfo);
 	db->table = (NTable)NULL;
@@ -828,7 +828,7 @@ static void PutEntry(
     NTable *nprev, *firstpprev;
 
 #define NEWTABLE(q,i) \
-    table = (NTable)Xmalloc(sizeof(LTableRec)); \
+    table = Xmalloc(sizeof(LTableRec)); \
     if (!table) \
 	return; \
     table->name = q; \
@@ -841,7 +841,7 @@ static void PutEntry(
 	nprev = NodeBuckets(table); \
     } else { \
 	table->leaf = 1; \
-	if (!(nprev = (NTable *)Xmalloc(sizeof(VEntry *)))) {\
+	if (!(nprev = Xmalloc(sizeof(VEntry *)))) {\
 	    Xfree(table); \
 	    return; \
         } \
@@ -955,9 +955,8 @@ static void PutEntry(
 	prev = nprev;
     }
     /* now allocate the value entry */
-    entry = (VEntry)Xmalloc(((type == XrmQString) ?
-			     sizeof(VEntryRec) : sizeof(DEntryRec)) +
-			    value->size);
+    entry = Xmalloc(((type == XrmQString) ?
+		     sizeof(VEntryRec) : sizeof(DEntryRec)) + value->size);
     if (!entry)
 	return;
     entry->name = q = *quarks;
@@ -987,13 +986,12 @@ static void PutEntry(
 	if (resourceQuarks) {
 	    unsigned char *prevQuarks = resourceQuarks;
 
-	    resourceQuarks = (unsigned char *)Xrealloc((char *)resourceQuarks,
-						       size);
+	    resourceQuarks = Xrealloc(resourceQuarks, size);
 	    if (!resourceQuarks) {
 		Xfree(prevQuarks);
 	    }
 	} else
-	    resourceQuarks = (unsigned char *)Xmalloc(size);
+	    resourceQuarks = Xmalloc(size);
 	if (resourceQuarks) {
 	    bzero((char *)&resourceQuarks[oldsize], size - oldsize);
 	    maxResourceQuark = (size << 3) - 1;
@@ -1138,11 +1136,11 @@ static void GetDatabase(
 
     str_len = strlen (str);
     if (DEF_BUFF_SIZE > str_len) lhs = lhs_s;
-    else if ((lhs = (char*) Xmalloc (str_len)) == NULL)
+    else if ((lhs = Xmalloc (str_len)) == NULL)
 	return;
 
     alloc_chars = DEF_BUFF_SIZE < str_len ? str_len : DEF_BUFF_SIZE;
-    if ((rhs = (char*) Xmalloc (alloc_chars)) == NULL) {
+    if ((rhs = Xmalloc (alloc_chars)) == NULL) {
 	if (lhs != lhs_s) Xfree (lhs);
 	return;
     }
diff --git a/lib/libX11/src/locking.c b/lib/libX11/src/locking.c
index b3dfb3b01..7c09c44d2 100644
--- a/lib/libX11/src/locking.c
+++ b/lib/libX11/src/locking.c
@@ -82,7 +82,7 @@ _Xthread_waiter(void)
     struct _xthread_waiter *me;
 
     if (!(me = TlsGetValue(_X_TlsIndex))) {
-	me = (struct _xthread_waiter *)xmalloc(sizeof(struct _xthread_waiter));
+	me = xmalloc(sizeof(struct _xthread_waiter));
 	me->sem = CreateSemaphore(NULL, 0, 1, NULL);
 	me->next = NULL;
 	TlsSetValue(_X_TlsIndex, me);
@@ -249,7 +249,7 @@ static struct _XCVList *_XCreateCVL(
 	dpy->lock->free_cvls = cvl->next;
 	dpy->lock->num_free_cvls--;
     } else {
-	cvl = (struct _XCVList *)Xmalloc(sizeof(struct _XCVList));
+	cvl = Xmalloc(sizeof(struct _XCVList));
 	if (!cvl)
 	    return NULL;
 	cvl->cv = xcondition_malloc();
@@ -512,10 +512,10 @@ void _XUserUnlockDisplay(
 static int _XInitDisplayLock(
     Display *dpy)
 {
-    dpy->lock_fns = (struct _XLockPtrs*)Xmalloc(sizeof(struct _XLockPtrs));
+    dpy->lock_fns = Xmalloc(sizeof(struct _XLockPtrs));
     if (dpy->lock_fns == NULL)
 	return -1;
-    dpy->lock = (struct _XLockInfo *)Xmalloc(sizeof(struct _XLockInfo));
+    dpy->lock = Xmalloc(sizeof(struct _XLockInfo));
     if (dpy->lock == NULL) {
 	_XFreeDisplayLock(dpy);
 	return -1;
diff --git a/lib/libX11/src/locking.h b/lib/libX11/src/locking.h
index 96019fc91..5251a60c1 100644
--- a/lib/libX11/src/locking.h
+++ b/lib/libX11/src/locking.h
@@ -36,6 +36,8 @@ in this Software without prior written authorization from The Open Group.
 
 #define xmalloc(s) Xmalloc(s)
 #define xfree(s) Xfree(s)
+#include <X11/Xlib.h>
+#include <X11/Xlibint.h>
 #include <X11/Xthreads.h>
 
 struct _XCVList {
diff --git a/lib/libX11/src/udcInf.c b/lib/libX11/src/udcInf.c
index b7577ac96..9ecf1566e 100644
--- a/lib/libX11/src/udcInf.c
+++ b/lib/libX11/src/udcInf.c
@@ -145,12 +145,11 @@ int  *num_codeset;
             if(!_XlcCompareISOLatin1(charset_str,buf)){
                 num_ret += 1;
                 if(num_ret == 1){
-                    ret = (int *)Xmalloc(sizeof(int));
+		    ret = Xmalloc(sizeof(int));
                 } else {
 		    int *prev_ret = ret;
 
-		    ret =
-                        (int *)Xrealloc(ret,num_ret*sizeof(int));
+		    ret = Xrealloc(ret, num_ret * sizeof(int));
 		    if (ret == NULL){
 			Xfree(prev_ret);
 		    }
@@ -272,7 +271,7 @@ int  *num_gr;
         sprintf(buf, "fs%d.charset.udc_area", codeset-1);
         _XlcGetLocaleDataBase(lcd, "XLC_FONTSET", buf, &value, &count);
         if(count > 0){
-            udc = (_XUDCGlyphRegion *)Xmalloc(count * sizeof(_XUDCGlyphRegion));
+            udc = Xmalloc(count * sizeof(_XUDCGlyphRegion));
             if(udc == NULL){
 		_xudc_utyerrno = 0x03 ;
 		_xudc_utyerrno |= (0x0b<<8) ;
@@ -524,7 +523,7 @@ int  *num_cr;
 	return(ret);
     }
 
-    crr = (_XUDCCodeRegion *)Xmalloc(num_gr*sizeof(_XUDCCodeRegion));
+    crr = Xmalloc(num_gr * sizeof(_XUDCCodeRegion));
     if(crr == NULL){
 	Xfree(gr);
 	_xudc_utyerrno = 0x03 ;
diff --git a/lib/libX11/src/xkb/XKBGetMap.c b/lib/libX11/src/xkb/XKBGetMap.c
index b9c2644f9..c73e655ae 100644
--- a/lib/libX11/src/xkb/XKBGetMap.c
+++ b/lib/libX11/src/xkb/XKBGetMap.c
@@ -484,6 +484,8 @@ unsigned	mask;
 
     if ( xkb->device_spec == XkbUseCoreKbd )
 	xkb->device_spec= rep->deviceID;
+    if ( rep->maxKeyCode < rep->minKeyCode )
+	return BadImplementation;
     xkb->min_key_code = rep->minKeyCode;
     xkb->max_key_code = rep->maxKeyCode;