Merge branch 'uli42-pr/backported_fixes' into arctica-3.6.x

nx-X11/programs/Xserver/Xext/bigreq.c

@@ -94,6 +94,7 @@ ProcBigReqDispatch (client)
 	return BadRequest;
     REQUEST_SIZE_MATCH(xBigReqEnableReq);
     client->big_requests = TRUE;
+    memset(&rep, 0, sizeof(xBigReqEnableReply));
     rep.type = X_Reply;
     rep.length = 0;
     rep.sequenceNumber = client->sequence;

nx-X11/programs/Xserver/Xext/shape.c

@@ -292,6 +292,7 @@ ProcShapeQueryVersion (client)
     register int		n;
 
     REQUEST_SIZE_MATCH (xShapeQueryVersionReq);
+    memset(&rep, 0, sizeof(xShapeQueryVersionReply));
     rep.type = X_Reply;
     rep.length = 0;
     rep.sequenceNumber = client->sequence;
@@ -717,6 +718,7 @@ ProcShapeQueryExtents (client)
     RegionPtr		region;
 
     REQUEST_SIZE_MATCH (xShapeQueryExtentsReq);
+    memset(&rep, 0, sizeof(xShapeQueryExtentsReply));
     pWin = LookupWindow (stuff->window, client);
     if (!pWin)
 	return BadWindow;

nx-X11/programs/Xserver/Xext/shm.c

@@ -346,6 +346,7 @@ ProcShmQueryVersion(client)
     register int n;
 
     REQUEST_SIZE_MATCH(xShmQueryVersionReq);
+    memset(&rep, 0, sizeof(xShmQueryVersionReply));
     rep.type = X_Reply;
     rep.length = 0;
     rep.sequenceNumber = client->sequence;

nx-X11/programs/Xserver/Xext/sync.c

@@ -1346,6 +1346,7 @@ ProcSyncInitialize(client)
 
     REQUEST_SIZE_MATCH(xSyncInitializeReq);
 
+    memset(&rep, 0, sizeof(xSyncInitializeReply));
     rep.type = X_Reply;
     rep.sequenceNumber = client->sequence;
     rep.majorVersion = SYNC_MAJOR_VERSION;

nx-X11/programs/Xserver/Xi/getvers.c

@@ -114,6 +114,7 @@ ProcXGetExtensionVersion (client)
 	return Success;
 	}
 
+    memset(&rep, 0, sizeof(xGetExtensionVersionReply));
     rep.repType = X_Reply;
     rep.RepType = X_GetExtensionVersion;
     rep.length = 0;

nx-X11/programs/Xserver/Xi/listdev.c

@@ -114,6 +114,7 @@ ProcXListInputDevices (client)
 
     REQUEST_SIZE_MATCH(xListInputDevicesReq);
 
+    memset(&rep, 0, sizeof(xListInputDevicesReply));
     rep.repType = X_Reply;
     rep.RepType = X_ListInputDevices;
     rep.length = 0;
@@ -128,7 +129,7 @@ ProcXListInputDevices (client)
 	SizeDeviceInfo (d, &namesize, &size);
 
     total_length = numdevs * sizeof (xDeviceInfo) + size + namesize;
-    devbuf = (char *) xalloc (total_length);
+    devbuf = (char *) xcalloc (1, total_length);
     classbuf = devbuf + (numdevs * sizeof (xDeviceInfo));
     namebuf = classbuf + size;
     savbuf = devbuf;

nx-X11/programs/Xserver/Xi/opendev.c

@@ -141,6 +141,7 @@ ProcXOpenDevice(client)
     if (enableit && dev->inited && dev->startup)
 	(void)EnableDevice(dev);
 
+    memset(&rep, 0, sizeof(xOpenDeviceReply));
     rep.repType = X_Reply;
     rep.RepType = X_OpenDevice;
     rep.sequenceNumber = client->sequence;

nx-X11/programs/Xserver/dix/devices.c

@@ -1037,6 +1037,7 @@ ProcGetModifierMapping(ClientPtr client)
     register KeyClassPtr keyc = inputInfo.keyboard->key;
 
     REQUEST_SIZE_MATCH(xReq);
+    memset(&rep, 0, sizeof(xGetModifierMappingReply));
     rep.type = X_Reply;
     rep.numKeyPerModifier = keyc->maxKeysPerModifier;
     rep.sequenceNumber = client->sequence;
@@ -1157,6 +1158,7 @@ ProcGetKeyboardMapping(ClientPtr client)
         return BadValue;
     }
 
+    memset(&rep, 0, sizeof(xGetKeyboardMappingReply));
     rep.type = X_Reply;
     rep.sequenceNumber = client->sequence;
     rep.keySymsPerKeyCode = curKeySyms->mapWidth;

nx-X11/programs/Xserver/dix/dispatch.c

@@ -579,6 +579,7 @@ ProcGetWindowAttributes(register ClientPtr client)
 					   SecurityReadAccess);
     if (!pWin)
         return(BadWindow);
+    memset(&wa, 0, sizeof(xGetWindowAttributesReply));
     GetWindowAttributes(pWin, client, &wa);
     WriteReplyToClient(client, sizeof(xGetWindowAttributesReply), &wa);
     return(client->noClientException);
@@ -834,6 +835,7 @@ ProcGetGeometry(register ClientPtr client)
     xGetGeometryReply rep;
     int status;
 
+    memset(&rep, 0, sizeof(xGetGeometryReply));
     if ((status = GetGeometry(client, &rep)) != Success)
 	return status;
 
@@ -856,6 +858,7 @@ ProcQueryTree(register ClientPtr client)
 					   SecurityReadAccess);
     if (!pWin)
         return(BadWindow);
+    memset(&reply, 0, sizeof(xQueryTreeReply));
     reply.type = X_Reply;
     reply.root = WindowTable[pWin->drawable.pScreen->myNum]->drawable.id;
     reply.sequenceNumber = client->sequence;
@@ -909,6 +912,7 @@ ProcInternAtom(register ClientPtr client)
     if (atom != BAD_RESOURCE)
     {
 	xInternAtomReply reply;
+	memset(&reply, 0, sizeof(xInternAtomReply));
 	reply.type = X_Reply;
 	reply.length = 0;
 	reply.sequenceNumber = client->sequence;
@@ -932,6 +936,7 @@ ProcGetAtomName(register ClientPtr client)
     if ( (str = NameForAtom(stuff->id)) )
     {
 	len = strlen(str);
+	memset(&reply, 0, sizeof(xGetAtomNameReply));
 	reply.type = X_Reply;
 	reply.length = (len + 3) >> 2;
 	reply.sequenceNumber = client->sequence;
@@ -1061,6 +1066,7 @@ ProcGetSelectionOwner(register ClientPtr client)
 	i = 0;
         while ((i < NumCurrentSelections) && 
 	       CurrentSelections[i].selection != stuff->id) i++;
+	memset(&reply, 0, sizeof(xGetSelectionOwnerReply));
         reply.type = X_Reply;
 	reply.length = 0;
 	reply.sequenceNumber = client->sequence;
@@ -1112,6 +1118,7 @@ ProcConvertSelection(register ClientPtr client)
 #endif
 	    )
 	{        
+	    memset(&event, 0, sizeof(xEvent));
 	    event.u.u.type = SelectionRequest;
 	    event.u.selectionRequest.time = stuff->time;
 	    event.u.selectionRequest.owner = 
@@ -1125,6 +1132,7 @@ ProcConvertSelection(register ClientPtr client)
 		NoEventMask /* CantBeFiltered */, NullGrab))
 		return (client->noClientException);
 	}
+	memset(&event, 0, sizeof(xEvent));
 	event.u.u.type = SelectionNotify;
 	event.u.selectionNotify.time = stuff->time;
 	event.u.selectionNotify.requestor = stuff->requestor;
@@ -1221,6 +1229,7 @@ ProcTranslateCoords(register ClientPtr client)
 					   SecurityReadAccess);
     if (!pDst)
         return(BadWindow);
+    memset(&rep, 0, sizeof(xTranslateCoordsReply));
     rep.type = X_Reply;
     rep.length = 0;
     rep.sequenceNumber = client->sequence;
@@ -1370,6 +1379,7 @@ ProcQueryFont(register ClientPtr client)
 	    return(BadAlloc);
 	}
 
+	memset(reply, 0, rlength);
 	reply->type = X_Reply;
 	reply->length = (rlength - sizeof(xGenericReply)) >> 2;
 	reply->sequenceNumber = client->sequence;
@@ -2112,6 +2122,8 @@ DoGetImage(register ClientPtr client, int format, Drawable drawable,
         return(BadValue);
     }
     SECURITY_VERIFY_DRAWABLE(pDraw, drawable, client, SecurityReadAccess);
+
+    memset(&xgi, 0, sizeof(xGetImageReply));
     if(pDraw->type == DRAWABLE_WINDOW)
     {
       if( /* check for being viewable */
@@ -2165,7 +2177,7 @@ DoGetImage(register ClientPtr client, int format, Drawable drawable,
     xgi.length = length;
 
     if (im_return) {
-	pBuf = (char *)xalloc(sz_xGetImageReply + length);
+	pBuf = (char *)xcalloc(1, sz_xGetImageReply + length);
 	if (!pBuf)
 	    return (BadAlloc);
 	if (widthBytesLine == 0)
@@ -2205,6 +2217,7 @@ DoGetImage(register ClientPtr client, int format, Drawable drawable,
 	}
 	if(!(pBuf = (char *) ALLOCATE_LOCAL(length)))
 	    return (BadAlloc);
+	memset(pBuf, 0, length);
 	WriteReplyToClient(client, sizeof (xGetImageReply), &xgi);
     }
 
@@ -2973,6 +2986,7 @@ ProcQueryColors(register ClientPtr client)
 	prgbs = (xrgb *)ALLOCATE_LOCAL(count * sizeof(xrgb));
 	if(!prgbs && count)
             return(BadAlloc);
+	memset(prgbs, 0, count * sizeof(xrgb));
 	if( (retval = QueryColors(pcmp, count, (Pixel *)&stuff[1], prgbs)) )
 	{
    	    if (prgbs) DEALLOCATE_LOCAL(prgbs);
@@ -2984,6 +2998,8 @@ ProcQueryColors(register ClientPtr client)
 	        return (retval);
 	    }
 	}
+
+	memset(&qcr, 0, sizeof(xQueryColorsReply));
 	qcr.type = X_Reply;
 	qcr.length = (count * sizeof(xrgb)) >> 2;
 	qcr.sequenceNumber = client->sequence;
@@ -3201,6 +3217,7 @@ ProcQueryBestSize (register ClientPtr client)
     pScreen = pDraw->pScreen;
     (* pScreen->QueryBestSize)(stuff->class, &stuff->width,
 			       &stuff->height, pScreen);
+    memset(&reply, 0, sizeof(xQueryBestSizeReply));
     reply.type = X_Reply;
     reply.length = 0;
     reply.sequenceNumber = client->sequence;
@@ -3976,6 +3993,7 @@ SendErrorToClient(ClientPtr client, unsigned majorCode, unsigned minorCode,
 {
     xError rep;
 
+    memset(&rep, 0, sizeof(xError));
     rep.type = X_Error;
     rep.sequenceNumber = client->sequence;
     rep.errorCode = errorCode;

nx-X11/programs/Xserver/dix/dixfonts.c

@@ -850,6 +850,7 @@ finish:
     for (i = 0; i < nnames; i++)
 	stringLens += (names->length[i] <= 255) ? names->length[i] : 0;
 
+    memset(&reply, 0, sizeof(xListFontsReply));
     reply.type = X_Reply;
     reply.length = (stringLens + nnames + 3) >> 2;
     reply.nFonts = nnames;
@@ -1102,6 +1103,7 @@ doListFontsWithInfo(ClientPtr client, LFWIclosurePtr c)
 		    err = AllocError;
 		    break;
 		}
+		memset(reply + c->length, 0, length - c->length);
 		c->reply = reply;
 		c->length = length;
 	    }

nx-X11/programs/Xserver/dix/events.c

@@ -3733,6 +3733,7 @@ ProcGetInputFocus(ClientPtr client)
     FocusClassPtr focus = inputInfo.keyboard->focus;
 
     REQUEST_SIZE_MATCH(xReq);
+    memset(&rep, 0, sizeof(xGetInputFocusReply));
     rep.type = X_Reply;
     rep.length = 0;
     rep.sequenceNumber = client->sequence;
@@ -3807,6 +3808,7 @@ ProcGrabPointer(ClientPtr client)
     }
 	/* at this point, some sort of reply is guaranteed. */
     time = ClientTimeToServerTime(stuff->time);
+    memset(&rep, 0, sizeof(xGrabPointerReply));
     rep.type = X_Reply;
     rep.sequenceNumber = client->sequence;
     rep.length = 0;
@@ -3982,6 +3984,7 @@ ProcGrabKeyboard(ClientPtr client)
     int result;
 
     REQUEST_SIZE_MATCH(xGrabKeyboardReq);
+    memset(&rep, 0, sizeof(xGrabKeyboardReply));
 #ifdef XCSECURITY
     if (!SecurityCheckDeviceAccess(client, inputInfo.keyboard, TRUE))
     {
@@ -4036,6 +4039,7 @@ ProcQueryPointer(ClientPtr client)
 	return BadWindow;
     if (mouse->valuator->motionHintWindow)
 	MaybeStopHint(mouse, client);
+    memset(&rep, 0, sizeof(xQueryPointerReply));
     rep.type = X_Reply;
     rep.sequenceNumber = client->sequence;
     rep.mask = mouse->button->state | inputInfo.keyboard->key->state;

nx-X11/programs/Xserver/dix/extension.c

@@ -313,6 +313,7 @@ ProcQueryExtension(ClientPtr client)
 
     REQUEST_FIXED_SIZE(xQueryExtensionReq, stuff->nbytes);
     
+    memset(&reply, 0, sizeof(xQueryExtensionReply));
     reply.type = X_Reply;
     reply.length = 0;
     reply.major_opcode = 0;
@@ -352,6 +353,7 @@ ProcListExtensions(ClientPtr client)
 
     REQUEST_SIZE_MATCH(xReq);
 
+    memset(&reply, 0, sizeof(xListExtensionsReply));
     reply.type = X_Reply;
     reply.nExtensions = 0;
     reply.length = 0;

nx-X11/programs/Xserver/dix/main.c

@@ -534,6 +534,7 @@ CreateConnectionBlock()
     char *pBuf;
 
     
+    memset(&setup, 0, sizeof(xConnSetup));
     /* Leave off the ridBase and ridMask, these must be sent with 
        connection */
 
@@ -574,6 +575,7 @@ CreateConnectionBlock()
     while (--i >= 0)
 	*pBuf++ = 0;
     
+    memset(&format, 0, sizeof(xPixmapFormat));
     for (i=0; i<screenInfo.numPixmapFormats; i++)
     {
 	format.depth = screenInfo.formats[i].depth;
@@ -585,6 +587,8 @@ CreateConnectionBlock()
     }
 
     connBlockScreenStart = sizesofar;
+    memset(&depth, 0, sizeof(xDepth));
+    memset(&visual, 0, sizeof(xVisualType));
     for (i=0; i<screenInfo.numScreens; i++) 
     {
 	ScreenPtr	pScreen;

nx-X11/programs/Xserver/dix/property.c

@@ -531,6 +531,7 @@ ProcGetProperty(ClientPtr client)
 	pProp = pProp->next;
     }
 
+    memset(&reply, 0, sizeof(xGetPropertyReply));
     reply.type = X_Reply;
     reply.sequenceNumber = client->sequence;
     if (!pProp) 

nx-X11/programs/Xserver/dix/window.c

@@ -774,6 +774,7 @@ CreateWindow(Window wid, register WindowPtr pParent, int x, int y, unsigned w,
 
     if (SubSend(pParent))
     {
+	memset(&event, 0, sizeof(xEvent));
 	event.u.u.type = CreateNotify;
 	event.u.createNotify.window = wid;
 	event.u.createNotify.parent = pParent->drawable.id;
@@ -841,6 +842,7 @@ CrushTree(WindowPtr pWin)
 	    pParent = pChild->parent;
 	    if (SubStrSend(pChild, pParent))
 	    {
+		memset(&event, 0, sizeof(xEvent));
 		event.u.u.type = DestroyNotify;
 		event.u.destroyNotify.window = pChild->drawable.id;
 		DeliverEvents(pChild, &event, 1, NullWindow);		
@@ -890,6 +892,7 @@ DeleteWindow(pointer value, XID wid)
     pParent = pWin->parent;
     if (wid && pParent && SubStrSend(pWin, pParent))
     {
+	memset(&event, 0, sizeof(xEvent));
 	event.u.u.type = DestroyNotify;
 	event.u.destroyNotify.window = pWin->drawable.id;
 	DeliverEvents(pWin, &event, 1, NullWindow);		
@@ -2306,6 +2309,7 @@ ConfigureWindow(register WindowPtr pWin, register Mask mask, XID *vlist, ClientP
 #endif
 	))
     {
+	memset(&event, 0, sizeof(xEvent));
 	event.u.u.type = ConfigureRequest;
 	event.u.configureRequest.window = pWin->drawable.id;
 	if (mask & CWSibling)
@@ -2350,6 +2354,7 @@ ConfigureWindow(register WindowPtr pWin, register Mask mask, XID *vlist, ClientP
 	if (size_change && ((pWin->eventMask|wOtherEventMasks(pWin)) & ResizeRedirectMask))
 	{
 	    xEvent eventT;
+	    memset(&eventT, 0, sizeof(xEvent));
 	    eventT.u.u.type = ResizeRequest;
 	    eventT.u.resizeRequest.window = pWin->drawable.id;
 	    eventT.u.resizeRequest.width = w;
@@ -2396,6 +2401,7 @@ ConfigureWindow(register WindowPtr pWin, register Mask mask, XID *vlist, ClientP
 ActuallyDoSomething:
     if (SubStrSend(pWin, pParent))
     {
+	memset(&event, 0, sizeof(xEvent));
 	event.u.u.type = ConfigureNotify;
 	event.u.configureNotify.window = pWin->drawable.id;
 	if (pSib)
@@ -2552,6 +2558,7 @@ ReparentWindow(register WindowPtr pWin, register WindowPtr pParent,
     if (WasMapped)
        UnmapWindow(pWin, FALSE);
 
+    memset(&event, 0, sizeof(xEvent));
     event.u.u.type = ReparentNotify;
     event.u.reparent.window = pWin->drawable.id;
     event.u.reparent.parent = pParent->drawable.id;
@@ -2708,6 +2715,7 @@ MapWindow(register WindowPtr pWin, ClientPtr client)
 #endif
 	))
 	{
+	    memset(&event, 0, sizeof(xEvent));
 	    event.u.u.type = MapRequest;
 	    event.u.mapRequest.window = pWin->drawable.id;
 #ifdef XAPPGROUP
@@ -2730,6 +2738,7 @@ MapWindow(register WindowPtr pWin, ClientPtr client)
 	pWin->mapped = TRUE;
 	if (SubStrSend(pWin, pParent))
 	{
+	    memset(&event, 0, sizeof(xEvent));
 	    event.u.u.type = MapNotify;
 	    event.u.mapNotify.window = pWin->drawable.id;
 	    event.u.mapNotify.override = pWin->overrideRedirect;
@@ -2820,6 +2829,7 @@ MapSubwindows(register WindowPtr pParent, ClientPtr client)
 	{
 	    if (parentRedirect && !pWin->overrideRedirect)
 	    {
+		memset(&event, 0, sizeof(xEvent));
 		event.u.u.type = MapRequest;
 		event.u.mapRequest.window = pWin->drawable.id;
 		event.u.mapRequest.parent = pParent->drawable.id;
@@ -2832,6 +2842,7 @@ MapSubwindows(register WindowPtr pParent, ClientPtr client)
 	    pWin->mapped = TRUE;
 	    if (parentNotify || StrSend(pWin))
 	    {
+		memset(&event, 0, sizeof(xEvent));
 		event.u.u.type = MapNotify;
 		event.u.mapNotify.window = pWin->drawable.id;
 		event.u.mapNotify.override = pWin->overrideRedirect;
@@ -2985,6 +2996,7 @@ UnmapWindow(register WindowPtr pWin, Bool fromConfigure)
 	return(Success);
     if (SubStrSend(pWin, pParent))
     {
+	memset(&event, 0, sizeof(xEvent));
 	event.u.u.type = UnmapNotify;
 	event.u.unmapNotify.window = pWin->drawable.id;
 	event.u.unmapNotify.fromConfigure = fromConfigure;
@@ -3279,6 +3291,7 @@ SendVisibilityNotify(WindowPtr pWin)
     }
 #endif
 
+    memset(&event, 0, sizeof(xEvent));
     event.u.u.type = VisibilityNotify;
     event.u.visibility.window = pWin->drawable.id;
     event.u.visibility.state = visibility;

nx-X11/programs/Xserver/hw/nxagent/Keyboard.c

@@ -1214,6 +1214,7 @@ void nxagentNotifyKeyboardChanges(int oldMinKeycode, int oldMaxKeycode)
     dev = inputInfo.keyboard;
     xkb = dev -> key -> xkbInfo -> desc;
 
+    memset(&nkn, 0, sizeof(xkbNewKeyboardNotify));
     nkn.deviceID = nkn.oldDeviceID = dev -> id;
     nkn.minKeyCode = 8;
     nkn.maxKeyCode = 255;
@@ -1233,6 +1234,7 @@ void nxagentNotifyKeyboardChanges(int oldMinKeycode, int oldMaxKeycode)
     int i;
     xEvent event;
 
+    memset(&event, 0, sizeof(xEvent));
     event.u.u.type = MappingNotify;
     event.u.mappingNotify.request = MappingKeyboard;
     event.u.mappingNotify.firstKeyCode = inputInfo.keyboard -> key -> curKeySyms.minKeyCode;

nx-X11/programs/Xserver/hw/nxagent/NXdispatch.c

@@ -931,6 +931,7 @@ ProcGetWindowAttributes(register ClientPtr client)
 					   SecurityReadAccess);
     if (!pWin)
         return(BadWindow);
+    memset(&wa, 0, sizeof(xGetWindowAttributesReply));
     GetWindowAttributes(pWin, client, &wa);
     WriteReplyToClient(client, sizeof(xGetWindowAttributesReply), &wa);
     return(client->noClientException);
@@ -1155,6 +1156,7 @@ GetGeometry(register ClientPtr client, xGetGeometryReply *rep)
 
     REQUEST_SIZE_MATCH(xResourceReq);
     SECURITY_VERIFY_GEOMETRABLE (pDraw, stuff->id, client, SecurityReadAccess);
+    memset(rep, 0, sizeof(xGetGeometryReply));
     rep->type = X_Reply;
     rep->length = 0;
     rep->sequenceNumber = client->sequence;
@@ -1216,6 +1218,7 @@ ProcQueryTree(register ClientPtr client)
 					   SecurityReadAccess);
     if (!pWin)
         return(BadWindow);
+    memset(&reply, 0, sizeof(xQueryTreeReply));
     reply.type = X_Reply;
     reply.root = WindowTable[pWin->drawable.pScreen->myNum]->drawable.id;
     reply.sequenceNumber = client->sequence;
@@ -1279,6 +1282,7 @@ ProcInternAtom(register ClientPtr client)
     if (atom != BAD_RESOURCE)
     {
 	xInternAtomReply reply;
+	memset(&reply, 0, sizeof(xInternAtomReply));
 	reply.type = X_Reply;
 	reply.length = 0;
 	reply.sequenceNumber = client->sequence;
@@ -1302,6 +1306,7 @@ ProcGetAtomName(register ClientPtr client)
     if ( (str = NameForAtom(stuff->id)) )
     {
 	len = strlen(str);
+	memset(&reply, 0, sizeof(xGetAtomNameReply));
 	reply.type = X_Reply;
 	reply.length = (len + 3) >> 2;
 	reply.sequenceNumber = client->sequence;
@@ -1441,6 +1446,7 @@ ProcGetSelectionOwner(register ClientPtr client)
 	i = 0;
         while ((i < NumCurrentSelections) && 
 	       CurrentSelections[i].selection != stuff->id) i++;
+	memset(&reply, 0, sizeof(xGetSelectionOwnerReply));
         reply.type = X_Reply;
 	reply.length = 0;
 	reply.sequenceNumber = client->sequence;
@@ -1512,7 +1518,9 @@ ProcConvertSelection(register ClientPtr client)
 					CurrentSelections[i].pWin))
 #endif
 	    )
+
 	{        
+	    memset(&event, 0, sizeof(xEvent));
 	    event.u.u.type = SelectionRequest;
 	    event.u.selectionRequest.time = stuff->time;
 	    event.u.selectionRequest.owner = 
@@ -1526,6 +1534,7 @@ ProcConvertSelection(register ClientPtr client)
 		NoEventMask /* CantBeFiltered */, NullGrab))
 		return (client->noClientException);
 	}
+	memset(&event, 0, sizeof(xEvent));
 	event.u.u.type = SelectionNotify;
 	event.u.selectionNotify.time = stuff->time;
 	event.u.selectionNotify.requestor = stuff->requestor;
@@ -1622,6 +1631,7 @@ ProcTranslateCoords(register ClientPtr client)
 					   SecurityReadAccess);
     if (!pDst)
         return(BadWindow);
+    memset(&rep, 0, sizeof(xTranslateCoordsReply));
     rep.type = X_Reply;
     rep.length = 0;
     rep.sequenceNumber = client->sequence;
@@ -1850,6 +1860,7 @@ ProcQueryFont(register ClientPtr client)
 	{
 	    return(BadAlloc);
 	}
+	memset(reply, 0, rlength);
 
 	reply->type = X_Reply;
 	reply->length = (rlength - sizeof(xGenericReply)) >> 2;
@@ -2659,6 +2670,7 @@ DoGetImage(register ClientPtr client, int format, Drawable drawable,
         return(BadValue);
     }
     SECURITY_VERIFY_DRAWABLE(pDraw, drawable, client, SecurityReadAccess);
+    memset(&xgi, 0, sizeof(xGetImageReply));
     if(pDraw->type == DRAWABLE_WINDOW)
     {
       if( /* check for being viewable */
@@ -2712,9 +2724,10 @@ DoGetImage(register ClientPtr client, int format, Drawable drawable,
     xgi.length = length;
 
     if (im_return) {
-	pBuf = (char *)xalloc(sz_xGetImageReply + length);
+	pBuf = (char *)xcalloc(1, sz_xGetImageReply + length);
 	if (!pBuf)
 	    return (BadAlloc);
+
 	if (widthBytesLine == 0)
 	    linesPerBuf = 0;
 	else
@@ -2752,6 +2765,7 @@ DoGetImage(register ClientPtr client, int format, Drawable drawable,
 	}
 	if(!(pBuf = (char *) ALLOCATE_LOCAL(length)))
 	    return (BadAlloc);
+	memset(pBuf, 0, length);
 	WriteReplyToClient(client, sizeof (xGetImageReply), &xgi);
     }
 
@@ -3520,6 +3534,7 @@ ProcQueryColors(register ClientPtr client)
 	prgbs = (xrgb *)ALLOCATE_LOCAL(count * sizeof(xrgb));
 	if(!prgbs && count)
             return(BadAlloc);
+	memset(prgbs, 0, count * sizeof(xrgb));
 	if( (retval = QueryColors(pcmp, count, (Pixel *)&stuff[1], prgbs)) )
 	{
    	    if (prgbs) DEALLOCATE_LOCAL(prgbs);
@@ -3531,6 +3546,7 @@ ProcQueryColors(register ClientPtr client)
 	        return (retval);
 	    }
 	}
+	memset(&qcr, 0, sizeof(xQueryColorsReply));
 	qcr.type = X_Reply;
 	qcr.length = (count * sizeof(xrgb)) >> 2;
 	qcr.sequenceNumber = client->sequence;
@@ -3755,6 +3771,7 @@ ProcQueryBestSize (register ClientPtr client)
     pScreen = pDraw->pScreen;
     (* pScreen->QueryBestSize)(stuff->class, &stuff->width,
 			       &stuff->height, pScreen);
+    memset(&reply, 0, sizeof(xQueryBestSizeReply));
     reply.type = X_Reply;
     reply.length = 0;
     reply.sequenceNumber = client->sequence;
@@ -4623,6 +4640,7 @@ SendErrorToClient(ClientPtr client, unsigned majorCode, unsigned minorCode,
 {
     xError rep;
 
+    memset(&rep, 0, sizeof(xError));
     rep.type = X_Error;
     rep.sequenceNumber = client->sequence;
     rep.errorCode = errorCode;

nx-X11/programs/Xserver/hw/nxagent/NXdixfonts.c

@@ -929,6 +929,7 @@ finish:
     for (i = 0; i < nnames; i++)
 	stringLens += (names->length[i] <= 255) ? names->length[i] : 0;
 
+    memset(&reply, 0, sizeof(xListFontsReply));
     reply.type = X_Reply;
     reply.length = (stringLens + nnames + 3) >> 2;
     reply.nFonts = nnames;
@@ -1227,6 +1228,7 @@ doListFontsWithInfo(ClientPtr client, LFWIclosurePtr c)
 		    err = AllocError;
 		    break;
 		}
+		memset(reply + c->length, 0, length - c->length);
 		c->reply = reply;
 		c->length = length;
 	    }

nx-X11/programs/Xserver/hw/nxagent/NXevents.c

@@ -3606,6 +3606,7 @@ EnterLeaveEvent(
     }
     if (mask & filters[type])
     {
+	memset(&event, 0, sizeof(xEvent));
 	event.u.u.type = type;
 	event.u.u.detail = detail;
 	event.u.enterLeave.time = currentTime.milliseconds;
@@ -4024,6 +4025,7 @@ ProcGetInputFocus(ClientPtr client)
     FocusClassPtr focus = inputInfo.keyboard->focus;
 
     REQUEST_SIZE_MATCH(xReq);
+    memset(&rep, 0, sizeof(xGetInputFocusReply));
     rep.type = X_Reply;
     rep.length = 0;
     rep.sequenceNumber = client->sequence;
@@ -4104,6 +4106,7 @@ ProcGrabPointer(ClientPtr client)
     }
 	/* at this point, some sort of reply is guaranteed. */
     time = ClientTimeToServerTime(stuff->time);
+    memset(&rep, 0, sizeof(xGrabPointerReply));
     rep.type = X_Reply;
     rep.sequenceNumber = client->sequence;
     rep.length = 0;
@@ -4321,6 +4324,8 @@ ProcGrabKeyboard(ClientPtr client)
     }
     #endif
     REQUEST_SIZE_MATCH(xGrabKeyboardReq);
+    memset(&rep, 0, sizeof(xGrabKeyboardReply));
+
 #ifdef XCSECURITY
     if (!SecurityCheckDeviceAccess(client, inputInfo.keyboard, TRUE))
     {
@@ -4399,6 +4404,7 @@ ProcQueryPointer(ClientPtr client)
 	return BadWindow;
     if (mouse->valuator->motionHintWindow)
 	MaybeStopHint(mouse, client);
+    memset(&rep, 0, sizeof(xQueryPointerReply));
     rep.type = X_Reply;
     rep.sequenceNumber = client->sequence;
     rep.mask = mouse->button->state | inputInfo.keyboard->key->state;

nx-X11/programs/Xserver/hw/nxagent/NXextension.c

@@ -332,6 +332,7 @@ ProcQueryExtension(ClientPtr client)
 
     REQUEST_FIXED_SIZE(xQueryExtensionReq, stuff->nbytes);
     
+    memset(&reply, 0, sizeof(xQueryExtensionReply));
     reply.type = X_Reply;
     reply.length = 0;
     reply.major_opcode = 0;
@@ -378,6 +379,7 @@ ProcListExtensions(ClientPtr client)
 
     REQUEST_SIZE_MATCH(xReq);
 
+    memset(&reply, 0, sizeof(xListExtensionsReply));
     reply.type = X_Reply;
     reply.nExtensions = 0;
     reply.length = 0;

nx-X11/programs/Xserver/hw/nxagent/NXmiexpose.c

@@ -457,6 +457,7 @@ miSendGraphicsExpose (client, pRgn, drawable, major, minor)
     else
     {
         xEvent event;
+	memset(&event, 0, sizeof(xEvent));
 	event.u.u.type = NoExpose;
 	event.u.noExposure.drawable = drawable;
 	event.u.noExposure.majorEvent = major;
@@ -482,7 +483,7 @@ miSendExposures(pWin, pRgn, dx, dy)
     numRects = REGION_NUM_RECTS(pRgn);
     if(!(pEvent = (xEvent *) ALLOCATE_LOCAL(numRects * sizeof(xEvent))))
 	return;
-
+    memset(pEvent, 0, numRects * sizeof(xEvent));
     for (i=numRects, pe = pEvent; --i >= 0; pe++, pBox++)
     {
 	pe->u.u.type = Expose;

nx-X11/programs/Xserver/hw/nxagent/NXproperty.c

@@ -620,6 +620,7 @@ ProcGetProperty(ClientPtr client)
 	pProp = pProp->next;
     }
 
+    memset(&reply, 0, sizeof(xGetPropertyReply));
     reply.type = X_Reply;
     reply.sequenceNumber = client->sequence;
 

nx-X11/programs/Xserver/hw/nxagent/NXrender.c

@@ -392,6 +392,7 @@ ProcRenderQueryVersion (ClientPtr client)
     pRenderClient->major_version = stuff->majorVersion;
     pRenderClient->minor_version = stuff->minorVersion;
 
+    memset(&rep, 0, sizeof(xRenderQueryVersionReply));
     rep.type = X_Reply;
     rep.length = 0;
     rep.sequenceNumber = client->sequence;
@@ -516,6 +517,7 @@ ProcRenderQueryPictFormats (ClientPtr client)
     reply = (xRenderQueryPictFormatsReply *) xalloc (rlength);
     if (!reply)
 	return BadAlloc;
+    memset(reply, 0, rlength);
     reply->type = X_Reply;
     reply->sequenceNumber = client->sequence;
     reply->length = (rlength - sizeof(xGenericReply)) >> 2;

nx-X11/programs/Xserver/hw/nxagent/NXshm.c

@@ -401,6 +401,7 @@ ProcShmQueryVersion(client)
     register int n;
 
     REQUEST_SIZE_MATCH(xShmQueryVersionReq);
+    memset(&rep, 0, sizeof(xShmQueryVersionReply));
     rep.type = X_Reply;
     rep.length = 0;
     rep.sequenceNumber = client->sequence;

nx-X11/programs/Xserver/hw/nxagent/NXwindow.c

@@ -960,6 +960,7 @@ CreateWindow(Window wid, register WindowPtr pParent, int x, int y, unsigned w,
 
     if (SubSend(pParent))
     {
+	memset(&event, 0, sizeof(xEvent));
 	event.u.u.type = CreateNotify;
 	event.u.createNotify.window = wid;
 	event.u.createNotify.parent = pParent->drawable.id;
@@ -1027,6 +1028,7 @@ CrushTree(WindowPtr pWin)
 	    pParent = pChild->parent;
 	    if (SubStrSend(pChild, pParent))
 	    {
+		memset(&event, 0, sizeof(xEvent));
 		event.u.u.type = DestroyNotify;
 		event.u.destroyNotify.window = pChild->drawable.id;
 		DeliverEvents(pChild, &event, 1, NullWindow);		
@@ -1076,6 +1078,7 @@ DeleteWindow(pointer value, XID wid)
     pParent = pWin->parent;
     if (wid && pParent && SubStrSend(pWin, pParent))
     {
+	memset(&event, 0, sizeof(xEvent));
 	event.u.u.type = DestroyNotify;
 	event.u.destroyNotify.window = pWin->drawable.id;
 	DeliverEvents(pWin, &event, 1, NullWindow);		
@@ -2562,6 +2565,7 @@ ConfigureWindow(register WindowPtr pWin, register Mask mask, XID *vlist, ClientP
 #endif
 	))
     {
+	memset(&event, 0, sizeof(xEvent));
 	event.u.u.type = ConfigureRequest;
 	event.u.configureRequest.window = pWin->drawable.id;
 	if (mask & CWSibling)
@@ -2606,6 +2610,7 @@ ConfigureWindow(register WindowPtr pWin, register Mask mask, XID *vlist, ClientP
 	if (size_change && ((pWin->eventMask|wOtherEventMasks(pWin)) & ResizeRedirectMask))
 	{
 	    xEvent eventT;
+	    memset(&eventT, 0, sizeof(xEvent));
 	    eventT.u.u.type = ResizeRequest;
 	    eventT.u.resizeRequest.window = pWin->drawable.id;
 	    eventT.u.resizeRequest.width = w;
@@ -2652,6 +2657,7 @@ ConfigureWindow(register WindowPtr pWin, register Mask mask, XID *vlist, ClientP
 ActuallyDoSomething:
     if (SubStrSend(pWin, pParent))
     {
+	memset(&event, 0, sizeof(xEvent));
 	event.u.u.type = ConfigureNotify;
 	event.u.configureNotify.window = pWin->drawable.id;
 	if (pSib)
@@ -2825,6 +2831,7 @@ ReparentWindow(register WindowPtr pWin, register WindowPtr pParent,
     if (WasMapped)
        UnmapWindow(pWin, FALSE);
 
+    memset(&event, 0, sizeof(xEvent));
     event.u.u.type = ReparentNotify;
     event.u.reparent.window = pWin->drawable.id;
     event.u.reparent.parent = pParent->drawable.id;
@@ -2996,6 +3003,7 @@ MapWindow(register WindowPtr pWin, ClientPtr client)
 #endif
 	))
 	{
+	    memset(&event, 0, sizeof(xEvent));
 	    event.u.u.type = MapRequest;
 	    event.u.mapRequest.window = pWin->drawable.id;
 #ifdef XAPPGROUP
@@ -3018,6 +3026,7 @@ MapWindow(register WindowPtr pWin, ClientPtr client)
 	pWin->mapped = TRUE;
 	if (SubStrSend(pWin, pParent))
 	{
+	    memset(&event, 0, sizeof(xEvent));
 	    event.u.u.type = MapNotify;
 	    event.u.mapNotify.window = pWin->drawable.id;
 	    event.u.mapNotify.override = pWin->overrideRedirect;
@@ -3110,6 +3119,7 @@ MapSubwindows(register WindowPtr pParent, ClientPtr client)
 	{
 	    if (parentRedirect && !pWin->overrideRedirect)
 	    {
+		memset(&event, 0, sizeof(xEvent));
 		event.u.u.type = MapRequest;
 		event.u.mapRequest.window = pWin->drawable.id;
 		event.u.mapRequest.parent = pParent->drawable.id;
@@ -3122,6 +3132,7 @@ MapSubwindows(register WindowPtr pParent, ClientPtr client)
 	    pWin->mapped = TRUE;
 	    if (parentNotify || StrSend(pWin))
 	    {
+		memset(&event, 0, sizeof(xEvent));
 		event.u.u.type = MapNotify;
 		event.u.mapNotify.window = pWin->drawable.id;
 		event.u.mapNotify.override = pWin->overrideRedirect;
@@ -3283,6 +3294,7 @@ UnmapWindow(register WindowPtr pWin, Bool fromConfigure)
 	return(Success);
     if (SubStrSend(pWin, pParent))
     {
+	memset(&event, 0, sizeof(xEvent));
 	event.u.u.type = UnmapNotify;
 	event.u.unmapNotify.window = pWin->drawable.id;
 	event.u.unmapNotify.fromConfigure = fromConfigure;
@@ -3577,6 +3589,7 @@ SendVisibilityNotify(WindowPtr pWin)
     }
 #endif
 
+    memset(&event, 0, sizeof(xEvent));
     event.u.u.type = VisibilityNotify;
     event.u.visibility.window = pWin->drawable.id;
     event.u.visibility.state = visibility;

nx-X11/programs/Xserver/mi/miexpose.c

@@ -420,6 +420,7 @@ miSendGraphicsExpose (client, pRgn, drawable, major, minor)
     else
     {
         xEvent event;
+	memset(&event, 0, sizeof(xEvent));
 	event.u.u.type = NoExpose;
 	event.u.noExposure.drawable = drawable;
 	event.u.noExposure.majorEvent = major;
@@ -445,6 +446,7 @@ miSendExposures(pWin, pRgn, dx, dy)
     numRects = REGION_NUM_RECTS(pRgn);
     if(!(pEvent = (xEvent *) ALLOCATE_LOCAL(numRects * sizeof(xEvent))))
 	return;
+    memset(pEvent, 0, numRects * sizeof(xEvent));
 
     for (i=numRects, pe = pEvent; --i >= 0; pe++, pBox++)
     {

nx-X11/programs/Xserver/randr/randr.c

@@ -125,6 +125,8 @@ RRCloseScreen (int i, ScreenPtr pScreen)
     for (j = pScrPriv->numOutputs - 1; j >= 0; j--)
 	RROutputDestroy (pScrPriv->outputs[j]);
     
+    xfree (pScrPriv->crtcs);
+    xfree (pScrPriv->outputs);
     xfree (pScrPriv);
     RRNScreens -= 1;	/* ok, one fewer screen with RandR running */
     return (*pScreen->CloseScreen) (i, pScreen);    

nx-X11/programs/Xserver/randr/rrcrtc.c

@@ -642,7 +642,6 @@ ProcRRSetCrtcConfig (ClientPtr client)
     int			    numOutputs;
     RROutputPtr		    *outputs = NULL;
     RROutput		    *outputIds;
-    TimeStamp		    configTime;
     TimeStamp		    time;
     Rotation		    rotation;
     int			    i, j;
@@ -745,7 +744,6 @@ ProcRRSetCrtcConfig (ClientPtr client)
     pScrPriv = rrGetScrPriv(pScreen);
     
     time = ClientTimeToServerTime(stuff->timestamp);
-    configTime = ClientTimeToServerTime(stuff->configTimestamp);
     
     if (!pScrPriv)
     {
@@ -754,19 +752,6 @@ ProcRRSetCrtcConfig (ClientPtr client)
 	goto sendReply;
     }
     
-#if 0
-    /*
-     * if the client's config timestamp is not the same as the last config
-     * timestamp, then the config information isn't up-to-date and
-     * can't even be validated
-     */
-    if (CompareTimeStamps (configTime, pScrPriv->lastConfigTime) != 0)
-    {
-	rep.status = RRSetConfigInvalidConfigTime;
-	goto sendReply;
-    }
-#endif
-    
     /*
      * Validate requested rotation
      */
@@ -853,10 +838,8 @@ ProcRRSetCrtcConfig (ClientPtr client)
 	rep.status = RRSetConfigFailed;
 	goto sendReply;
     }
-    #ifdef NXAGENT_SERVER /* Bug 21987 */
-    pScrPriv->lastSetTime = time;
-    #endif
     rep.status = RRSetConfigSuccess;
+    pScrPriv->lastSetTime = time;
     
 sendReply:
     if (outputs)
@@ -866,11 +849,7 @@ sendReply:
     /* rep.status has already been filled in */
     rep.length = 0;
     rep.sequenceNumber = client->sequence;
-    #ifndef NXAGENT_SERVER /* Bug 21987 */
-    rep.newTimestamp = pScrPriv->lastConfigTime.milliseconds;
-    #else
     rep.newTimestamp = pScrPriv->lastSetTime.milliseconds;
-    #endif
 
     if (client->swapped) 
     {

nx-X11/programs/Xserver/randr/rrinfo.c

@@ -83,6 +83,7 @@ RRScanOldConfig (ScreenPtr pScreen, Rotation rotations)
     int		i;
     CARD16	minWidth = MAXSHORT, minHeight = MAXSHORT;
     CARD16	maxWidth = 0, maxHeight = 0;
+    CARD16	width, height;
     
     /*
      * First time through, create a crtc and output and hook
@@ -153,11 +154,11 @@ RRScanOldConfig (ScreenPtr pScreen, Rotation rotations)
     /* find size bounds */
     for (i = 0; i < output->numModes + output->numUserModes; i++) 
     {
-	RRModePtr   mode = (i < output->numModes ? 
+	mode = (i < output->numModes ? 
 			    output->modes[i] : 
 			    output->userModes[i-output->numModes]);
-        CARD16	    width = mode->mode.width;
-        CARD16	    height = mode->mode.height;
+        width = mode->mode.width;
+        height = mode->mode.height;
 	
 	if (width < minWidth) minWidth = width;
 	if (width > maxWidth) maxWidth = width;

nx-X11/programs/Xserver/randr/rrmode.c

@@ -98,8 +98,10 @@ RRModeCreate (xRRModeInfo   *modeInfo,
     }
 
     mode->mode.id = FakeClientID(0);
-    if (!AddResource (mode->mode.id, RRModeType, (pointer) mode))
-	return NULL;
+    if (!AddResource(mode->mode.id, RRModeType, (pointer) mode)) {
+        free(newModes);
+        return NULL;
+    }
     modes = newModes;
     modes[num_modes++] = mode;
     
@@ -192,7 +194,7 @@ RRModesForScreen (ScreenPtr pScreen, int *num_ret)
     for (o = 0; o < pScrPriv->numOutputs; o++)
     {
 	RROutputPtr	output = pScrPriv->outputs[o];
-	int		m, n;
+	int		n;
 
 	for (m = 0; m < output->numModes + output->numUserModes; m++)
 	{
@@ -297,7 +299,6 @@ ProcRRCreateMode (ClientPtr client)
     xRRCreateModeReply	rep;
     WindowPtr		pWin;
     ScreenPtr		pScreen;
-    rrScrPrivPtr	pScrPriv;
     xRRModeInfo		*modeInfo;
     long		units_after;
     char		*name;
@@ -315,7 +316,6 @@ ProcRRCreateMode (ClientPtr client)
 	return rc;
 
     pScreen = pWin->drawable.pScreen;
-    pScrPriv = rrGetScrPriv(pScreen);
     
     modeInfo = &stuff->modeInfo;
     name = (char *) (stuff + 1);
@@ -342,7 +342,8 @@ ProcRRCreateMode (ClientPtr client)
 	swapl(&rep.mode, n);
     }
     WriteToClient(client, sizeof(xRRCreateModeReply), (char *)&rep);
-    
+    /* Drop out reference to this mode */
+    RRModeDestroy (mode);
     return client->noClientException;
 }
 

nx-X11/programs/Xserver/randr/rroutput.c

@@ -456,6 +456,7 @@ ProcRRGetOutputInfo (ClientPtr client)
     pScrPriv = rrGetScrPriv(pScreen);
 
     rep.type = X_Reply;
+    rep.status = RRSetConfigSuccess;
     rep.sequenceNumber = client->sequence;
     rep.length = OutputInfoExtra >> 2;
     rep.timestamp = pScrPriv->lastSetTime.milliseconds;

nx-X11/programs/Xserver/randr/rrscreen.c

@@ -228,7 +228,7 @@ ProcRRGetScreenSizeRange (ClientPtr client)
     rrScrPrivPtr		pScrPriv;
     int				rc;
     
-    REQUEST_SIZE_MATCH(xRRGetScreenInfoReq);
+    REQUEST_SIZE_MATCH(xRRGetScreenSizeRangeReq);
     #ifndef NXAGENT_SERVER
     rc = dixLookupWindow(&pWin, stuff->window, client, DixReadAccess);
     #else
@@ -677,8 +677,9 @@ ProcRRGetScreenInfo (ClientPtr client)
 	rep.sizeID = pData->size;
 	rep.rate = pData->refresh;
 
-	extraLen = (rep.nSizes * sizeof (xScreenSizes) +
-		    rep.nrateEnts * sizeof (CARD16));
+	extraLen = rep.nSizes * sizeof (xScreenSizes);
+	if (has_rate)
+		extraLen += rep.nrateEnts * sizeof (CARD16);
 
 	if (extraLen)
 	{
@@ -744,6 +745,7 @@ ProcRRGetScreenInfo (ClientPtr client)
 	swaps(&rep.sequenceNumber, n);
 	swapl(&rep.length, n);
 	swapl(&rep.timestamp, n);
+        swapl(&rep.configTimestamp, n);
 	swaps(&rep.rotation, n);
 	swaps(&rep.nSizes, n);
 	swaps(&rep.sizeID, n);
@@ -938,6 +940,18 @@ ProcRRSetScreenConfig (ClientPtr client)
 	width = mode->mode.height;
 	height = mode->mode.width;
     }
+
+    if (width < pScrPriv->minWidth || pScrPriv->maxWidth < width) {
+	client->errorValue = width;
+	free(pData);
+	return BadValue;
+    }
+    if (height < pScrPriv->minHeight || pScrPriv->maxHeight < height) {
+	client->errorValue = height;
+	free(pData);
+	return BadValue;
+    }
+
     if (width != pScreen->width || height != pScreen->height)
     {
 	int	c;
@@ -963,15 +977,10 @@ ProcRRSetScreenConfig (ClientPtr client)
 
     if (!RRCrtcSet (crtc, mode, 0, 0, stuff->rotation, 1, &output))
 	rep.status = RRSetConfigFailed;
-    #ifndef NXAGENT_SERVER /* Bug 21987 */
-    else
-	rep.status = RRSetConfigSuccess;
-    #else
     else {
-	rep.status = RRSetConfigSuccess;
 	pScrPriv->lastSetTime = time;
+	rep.status = RRSetConfigSuccess;
     }
-    #endif
 
     /*
      * XXX Configure other crtcs to mirror as much as possible

nx-X11/programs/Xserver/randr/rrxinerama.c

@@ -281,7 +281,8 @@ ProcRRXineramaIsActive(ClientPtr client)
     xXineramaIsActiveReply	rep;
 
     REQUEST_SIZE_MATCH(xXineramaIsActiveReq);
-	
+
+    memset(&rep, 0, sizeof(xXineramaIsActiveReply));
     rep.type = X_Reply;
     rep.length = 0;
     rep.sequenceNumber = client->sequence;

nx-X11/programs/Xserver/render/render.c

@@ -288,6 +288,7 @@ ProcRenderQueryVersion (ClientPtr client)
     pRenderClient->major_version = stuff->majorVersion;
     pRenderClient->minor_version = stuff->minorVersion;
 
+    memset(&rep, 0, sizeof(xRenderQueryVersionReply));
     rep.type = X_Reply;
     rep.length = 0;
     rep.sequenceNumber = client->sequence;
@@ -410,6 +411,8 @@ ProcRenderQueryPictFormats (ClientPtr client)
     reply = (xRenderQueryPictFormatsReply *) xalloc (rlength);
     if (!reply)
 	return BadAlloc;
+    memset(reply, 0, rlength);
+
     reply->type = X_Reply;
     reply->sequenceNumber = client->sequence;
     reply->length = (rlength - sizeof(xGenericReply)) >> 2;

nx-X11/programs/Xserver/xfixes/select.c

@@ -84,6 +84,8 @@ XFixesSelectionCallback (CallbackListPtr *callbacks, pointer data, pointer args)
 	{
 	    xXFixesSelectionNotifyEvent	ev;
 
+	    memset(&ev, 0, sizeof(xXFixesSelectionNotifyEvent));
+
 	    ev.type = XFixesEventBase + XFixesSelectionNotify;
 	    ev.subtype = subtype;
 	    ev.sequenceNumber = e->pClient->sequence;

nx-X11/programs/Xserver/xfixes/xfixes.c

@@ -42,6 +42,7 @@ ProcXFixesQueryVersion(ClientPtr client)
     REQUEST(xXFixesQueryVersionReq);
 
     REQUEST_SIZE_MATCH(xXFixesQueryVersionReq);
+    memset(&rep, 0, sizeof(xXFixesQueryVersionReply));
     rep.type = X_Reply;
     rep.length = 0;
     rep.sequenceNumber = client->sequence;

nx-X11/programs/Xserver/xkb/xkb.c

@@ -192,6 +192,7 @@ ProcXkbUseExtension(ClientPtr client)
 					stuff->wantedMajor,stuff->wantedMinor,
 					XkbMajorVersion,XkbMinorVersion);
     }
+    memset(&rep, 0, sizeof(xkbUseExtensionReply));
     rep.type = X_Reply;
     rep.supported = supported;
     rep.length = 0;
@@ -1313,6 +1314,8 @@ char		*desc,*start;
     start= desc= (char *)ALLOCATE_LOCAL(len);
     if (!start)
 	return BadAlloc;
+    memset(start, 0, len);
+
     if ( rep->nTypes>0 )
 	desc = XkbWriteKeyTypes(xkb,rep,desc,client);
     if ( rep->nKeySyms>0 )
@@ -2381,6 +2384,8 @@ ProcXkbSetMap(ClientPtr client)
     				(xkb->max_key_code!=stuff->maxKeyCode)) {
 	Status			status;
 	xkbNewKeyboardNotify	nkn;
+
+	memset(&nkn, 0, sizeof(xkbNewKeyboardNotify));
 	nkn.deviceID= nkn.oldDeviceID= dev->id;
 	nkn.oldMinKeyCode= xkb->min_key_code;
 	nkn.oldMaxKeyCode= xkb->max_key_code;
@@ -3480,6 +3485,7 @@ ProcXkbGetNames(ClientPtr client)
     CHK_MASK_LEGAL(0x01,stuff->which,XkbAllNamesMask);
 
     xkb = dev->key->xkbInfo->desc;
+    memset(&rep, 0, sizeof(xkbGetNamesReply));
     rep.type= X_Reply;
     rep.sequenceNumber= client->sequence;
     rep.length = 0;
@@ -4939,6 +4945,7 @@ ProcXkbSetGeometry(ClientPtr client)
 	nn.changed= XkbGeometryNameMask;
 	XkbSendNamesNotify(dev,&nn);
     }
+    memset(&nkn, 0, sizeof(xkbNewKeyboardNotify));
     nkn.deviceID= nkn.oldDeviceID= dev->id;
     nkn.minKeyCode= nkn.oldMinKeyCode= xkb->min_key_code;
     nkn.maxKeyCode= nkn.oldMaxKeyCode= xkb->max_key_code;
@@ -4969,6 +4976,7 @@ ProcXkbPerClientFlags(ClientPtr client)
     CHK_MASK_MATCH(0x02,stuff->change,stuff->value);
 
     interest = XkbFindClientResource((DevicePtr)dev,client);
+    memset(&rep, 0, sizeof(xkbPerClientFlagsReply));
     rep.type= X_Reply;
     rep.length = 0;
     rep.sequenceNumber = client->sequence;
@@ -5463,6 +5471,7 @@ ProcXkbGetKbdByName(ClientPtr client)
 	    XkbFreeSrvLedInfo(old_sli);
 	}
 
+	memset(&nkn, 0, sizeof(xkbNewKeyboardNotify));
 	nkn.deviceID= nkn.oldDeviceID= dev->id;
 	nkn.minKeyCode= finfo.xkb->min_key_code;
 	nkn.maxKeyCode= finfo.xkb->max_key_code;

nx-X11/programs/Xserver/xkb/xkbEvents.c

@@ -730,6 +730,7 @@ XkbSrvLedInfoPtr	sli;
     }
     if (pChanges->map.changed) {
 	xkbMapNotify mn;
+	memset(&mn, 0, sizeof(xkbMapNotify));
 	mn.changed= pChanges->map.changed;
 	mn.firstType= pChanges->map.first_type;
 	mn.nTypes= pChanges->map.num_types;
@@ -751,6 +752,7 @@ XkbSrvLedInfoPtr	sli;
     if ((pChanges->ctrls.changed_ctrls)||
 	(pChanges->ctrls.enabled_ctrls_changes)) {
 	xkbControlsNotify cn;
+	memset(&cn, 0, sizeof(xkbControlsNotify));
 	cn.changedControls= pChanges->ctrls.changed_ctrls;
 	cn.enabledControlChanges= pChanges->ctrls.enabled_ctrls_changes;
 	cn.keycode= cause->kc;
@@ -763,6 +765,7 @@ XkbSrvLedInfoPtr	sli;
 	xkbIndicatorNotify in;
 	if (sli==NULL)
 	    sli= XkbFindSrvLedInfo(kbd,XkbDfltXIClass,XkbDfltXIId,0);
+	memset(&in, 0, sizeof(xkbIndicatorNotify));
 	in.state= sli->effectiveState;
 	in.changed= pChanges->indicators.map_changes;
 	XkbSendIndicatorNotify(kbd,XkbIndicatorMapNotify,&in);
@@ -771,12 +774,14 @@ XkbSrvLedInfoPtr	sli;
 	xkbIndicatorNotify in;
 	if (sli==NULL)
 	    sli= XkbFindSrvLedInfo(kbd,XkbDfltXIClass,XkbDfltXIId,0);
+	memset(&in, 0, sizeof(xkbIndicatorNotify));
 	in.state= sli->effectiveState;
 	in.changed= pChanges->indicators.state_changes;
 	XkbSendIndicatorNotify(kbd,XkbIndicatorStateNotify,&in);
     }
     if (pChanges->names.changed) {
 	xkbNamesNotify nn;
+	memset(&nn, 0, sizeof(xkbNamesNotify));
 	nn.changed= pChanges->names.changed;
 	nn.firstType= pChanges->names.first_type;
 	nn.nTypes= pChanges->names.num_types;
@@ -789,6 +794,7 @@ XkbSrvLedInfoPtr	sli;
     }
     if ((pChanges->compat.changed_groups)||(pChanges->compat.num_si>0)) {
 	xkbCompatMapNotify cmn;
+	memset(&cmn, 0, sizeof(xkbCompatMapNotify));
 	cmn.changedGroups= pChanges->compat.changed_groups;
 	cmn.firstSI= pChanges->compat.first_si;
 	cmn.nSI= pChanges->compat.num_si;