Use calloc to zero fill buffers being allocated for replies & events

nx-X11/programs/Xserver/GL/glx/glxcmds.c

@@ -2084,7 +2084,7 @@ int __glXQueryExtensionsString(__GLXclientState *cl, GLbyte *pc)
     reply.n = n;
 
     /* Allocate buffer to make sure it's a multiple of 4 bytes big.*/
-    buf = (char *) malloc(length << 2);
+    buf = calloc(length, 4);
     if (buf == NULL)
         return BadAlloc;
     memcpy(buf, ptr, n);
@@ -2141,7 +2141,7 @@ int __glXQueryServerString(__GLXclientState *cl, GLbyte *pc)
     reply.length = length;
     reply.n = n;
 
-    if ((buf = (char *) malloc(length << 2)) == NULL) {
+    if ((buf = calloc(length, 4)) == NULL) {
         return BadAlloc;
     }
     memcpy(buf, ptr, n);

nx-X11/programs/Xserver/Xext/sync.c

@@ -590,7 +590,7 @@ SyncSendCounterNotifyEvents(client, ppAwait, num_events)
     if (client->clientGone)
 	return;
     pev = pEvents = (xSyncCounterNotifyEvent *)
-		 malloc(num_events * sizeof(xSyncCounterNotifyEvent));
+		 calloc(num_events, sizeof(xSyncCounterNotifyEvent));
     if (!pEvents) 
 	return;
     UpdateCurrentTime();

nx-X11/programs/Xserver/render/render.c

@@ -580,7 +580,7 @@ ProcRenderQueryPictIndexValues (ClientPtr client)
     num = pFormat->index.nvalues;
     rlength = (sizeof (xRenderQueryPictIndexValuesReply) + 
 	       num * sizeof(xIndexValue));
-    reply = (xRenderQueryPictIndexValuesReply *) malloc (rlength);
+    reply = (xRenderQueryPictIndexValuesReply *) calloc (1, rlength);
     if (!reply)
 	return BadAlloc;
 
@@ -1746,7 +1746,7 @@ ProcRenderQueryFilters (ClientPtr client)
     }
     len = ((nnames + 1) >> 1) + ((nbytesName + 3) >> 2);
     total_bytes = sizeof (xRenderQueryFiltersReply) + (len << 2);
-    reply = (xRenderQueryFiltersReply *) malloc (total_bytes);
+    reply = (xRenderQueryFiltersReply *) calloc (1, total_bytes);
     if (!reply)
 	return BadAlloc;
     aliases = (INT16 *) (reply + 1);

nx-X11/programs/Xserver/xfixes/cursor.c

@@ -364,8 +364,8 @@ ProcXFixesGetCursorImage (ClientPtr client)
     width = pCursor->bits->width;
     height = pCursor->bits->height;
     npixels = width * height;
-    rep = malloc (sizeof (xXFixesGetCursorImageReply) +
-		  npixels * sizeof (CARD32));
+    rep = calloc (sizeof (xXFixesGetCursorImageReply) +
+		  npixels * sizeof (CARD32), 1);
     if (!rep)
 	return BadAlloc;
 
@@ -508,8 +508,8 @@ ProcXFixesGetCursorImageAndName (ClientPtr client)
     name = pCursor->name ? NameForAtom (pCursor->name) : "";
     nbytes = strlen (name);
     nbytesRound = (nbytes + 3) & ~3;
-    rep = malloc (sizeof (xXFixesGetCursorImageAndNameReply) +
-		  npixels * sizeof (CARD32) + nbytesRound);
+    rep = calloc (sizeof (xXFixesGetCursorImageAndNameReply) +
+		  npixels * sizeof (CARD32) + nbytesRound, 1);
     if (!rep)
 	return BadAlloc;
 

nx-X11/programs/Xserver/xfixes/region.c

@@ -570,8 +570,8 @@ ProcXFixesFetchRegion (ClientPtr client)
     pBox = RegionRects (pRegion);
     nBox = RegionNumRects (pRegion);
     
-    reply = malloc (sizeof (xXFixesFetchRegionReply) +
-		    nBox * sizeof (xRectangle));
+    reply = calloc (sizeof (xXFixesFetchRegionReply) +
+		    nBox * sizeof (xRectangle), 1);
     if (!reply)
 	return BadAlloc;
     reply->type = X_Reply;