Use calloc to zero fill buffers being allocated for replies & events

Ensures padding bytes are zero-filled

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
Tested-by: Daniel Stone <daniel@fooishbar.org>

Xext/sync.c

@@ -475,7 +475,7 @@ SyncSendCounterNotifyEvents(ClientPtr client, SyncAwait ** ppAwait,
 
     if (client->clientGone)
         return;
-    pev = pEvents = malloc(num_events * sizeof(xSyncCounterNotifyEvent));
+    pev = pEvents = calloc(num_events, sizeof(xSyncCounterNotifyEvent));
     if (!pEvents)
         return;
     UpdateCurrentTime();

Xext/xf86bigfont.c

@@ -554,7 +554,7 @@ ProcXF86BigfontQueryFont(ClientPtr client)
                ? nUniqCharInfos * sizeof(xCharInfo)
                + (nCharInfos + 1) / 2 * 2 * sizeof(CARD16)
                : 0);
-        xXF86BigfontQueryFontReply *reply = malloc(rlength);
+        xXF86BigfontQueryFontReply *reply = calloc(1, rlength);
         char *p;
 
         if (!reply) {

glx/glxcmds.c

@@ -2315,7 +2315,7 @@ __glXDisp_QueryExtensionsString(__GLXclientState * cl, GLbyte * pc)
     reply.n = n;
 
     /* Allocate buffer to make sure it's a multiple of 4 bytes big. */
-    buf = (char *) malloc(length << 2);
+    buf = calloc(length, 4);
     if (buf == NULL)
         return BadAlloc;
     memcpy(buf, pGlxScreen->GLXextensions, n);
@@ -2375,7 +2375,7 @@ __glXDisp_QueryServerString(__GLXclientState * cl, GLbyte * pc)
     reply.length = length;
     reply.n = n;
 
-    buf = (char *) malloc(length << 2);
+    buf = calloc(length, 4);
     if (buf == NULL) {
         return BadAlloc;
     }

hw/xfree86/dixmods/extmod/xf86vmode.c

@@ -1354,7 +1354,7 @@ ProcXF86VidModeGetDotClocks(ClientPtr client)
     rep.flags = 0;
 
     if (!ClockProg) {
-        Clocks = malloc(numClocks * sizeof(int));
+        Clocks = calloc(numClocks, sizeof(int));
         if (!Clocks)
             return BadValue;
         if (!VidModeGetClocks(stuff->screen, Clocks)) {

mi/miexpose.c

@@ -327,7 +327,7 @@ miSendGraphicsExpose(ClientPtr client, RegionPtr pRgn, XID drawable,
 
         numRects = RegionNumRects(pRgn);
         pBox = RegionRects(pRgn);
-        if (!(pEvent = malloc(numRects * sizeof(xEvent))))
+        if (!(pEvent = calloc(numRects, sizeof(xEvent))))
             return;
         pe = pEvent;
 

randr/rrcrtc.c

@@ -1526,7 +1526,7 @@ ProcRRGetCrtcTransform(ClientPtr client)
     nextra = (transform_filter_length(pending) +
               transform_filter_length(current));
 
-    reply = malloc(sizeof(xRRGetCrtcTransformReply) + nextra);
+    reply = calloc(1, sizeof(xRRGetCrtcTransformReply) + nextra);
     if (!reply)
         return BadAlloc;
 

render/render.c

@@ -531,7 +531,7 @@ ProcRenderQueryPictIndexValues(ClientPtr client)
     num = pFormat->index.nvalues;
     rlength = (sizeof(xRenderQueryPictIndexValuesReply) +
                num * sizeof(xIndexValue));
-    reply = (xRenderQueryPictIndexValuesReply *) malloc(rlength);
+    reply = (xRenderQueryPictIndexValuesReply *) calloc(1, rlength);
     if (!reply)
         return BadAlloc;
 
@@ -1688,7 +1688,7 @@ ProcRenderQueryFilters(ClientPtr client)
     }
     len = ((nnames + 1) >> 1) + bytes_to_int32(nbytesName);
     total_bytes = sizeof(xRenderQueryFiltersReply) + (len << 2);
-    reply = (xRenderQueryFiltersReply *) malloc(total_bytes);
+    reply = (xRenderQueryFiltersReply *) calloc(1, total_bytes);
     if (!reply)
         return BadAlloc;
     aliases = (INT16 *) (reply + 1);

xfixes/cursor.c

@@ -380,7 +380,8 @@ ProcXFixesGetCursorImage(ClientPtr client)
     width = pCursor->bits->width;
     height = pCursor->bits->height;
     npixels = width * height;
-    rep = malloc(sizeof(xXFixesGetCursorImageReply) + npixels * sizeof(CARD32));
+    rep = calloc(sizeof(xXFixesGetCursorImageReply) + npixels * sizeof(CARD32),
+                 1);
     if (!rep)
         return BadAlloc;
 
@@ -529,8 +530,8 @@ ProcXFixesGetCursorImageAndName(ClientPtr client)
     name = pCursor->name ? NameForAtom(pCursor->name) : "";
     nbytes = strlen(name);
     nbytesRound = pad_to_int32(nbytes);
-    rep = malloc(sizeof(xXFixesGetCursorImageAndNameReply) +
-                 npixels * sizeof(CARD32) + nbytesRound);
+    rep = calloc(sizeof(xXFixesGetCursorImageAndNameReply) +
+                 npixels * sizeof(CARD32) + nbytesRound, 1);
     if (!rep)
         return BadAlloc;
 

xfixes/region.c

@@ -557,7 +557,8 @@ ProcXFixesFetchRegion(ClientPtr client)
     pBox = RegionRects(pRegion);
     nBox = RegionNumRects(pRegion);
 
-    reply = malloc(sizeof(xXFixesFetchRegionReply) + nBox * sizeof(xRectangle));
+    reply = calloc(sizeof(xXFixesFetchRegionReply) + nBox * sizeof(xRectangle),
+                   1);
     if (!reply)
         return BadAlloc;
     reply->type = X_Reply;