diff --git a/ChangeLog b/ChangeLog
index 53f837a4d..721617503 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -3,6 +3,9 @@
 	* Xi/exevents.c:
 	Coverity #323, #445, #446, #447: Fix potential NULL dereferences.
 
+	* xkb/ddxList.c:
+	Coverity #169: Fix potential fgets() into NULL (?!?).
+
 2006-04-07  Aaron Plattner  <aplattner@nvidia.com>
 
 	* hw/xfree86/common/xf86Module.h:
diff --git a/xkb/ddxList.c b/xkb/ddxList.c
index 9c961e934..5d8366eba 100644
--- a/xkb/ddxList.c
+++ b/xkb/ddxList.c
@@ -169,8 +169,6 @@ char	tmpname[PATH_MAX];
 	if ((list->pattern[what][0]=='*')&&(list->pattern[what][1]=='\0')) {
 	    buf = Xprintf("%s/%s.dir",XkbBaseDirectory,componentDirs[what]);
 	    in= fopen(buf,"r");
-	    xfree (buf);
-	    buf = NULL;
 	}
 	if (!in) {
 	    haveDir= False;
@@ -186,8 +184,6 @@ char	tmpname[PATH_MAX];
 	if ((list->pattern[what][0]=='*')&&(list->pattern[what][1]=='\0')) {
 	    buf = Xprintf("%s.dir",componentDirs[what]);
 	    in= fopen(buf,"r");
-	    xfree (buf);
-	    buf = NULL;
 	}
 	if (!in) {
 	    haveDir= False;
@@ -224,6 +220,13 @@ char	tmpname[PATH_MAX];
 	return BadImplementation;
     }
     list->nFound[what]= 0;
+    if (buf) {
+        xfree(buf);
+        buf = NULL;
+    }
+    buf = xalloc(PATH_MAX * sizeof(char));
+    if (!buf)
+        return BadAlloc;
     while ((status==Success)&&((tmp=fgets(buf,PATH_MAX,in))!=NULL)) {
 	unsigned flags;
 	register unsigned int i;