Use calloc to zero fill buffers being allocated for replies & events

Ensures padding bytes are zero-filled

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
Tested-by: Daniel Stone <daniel@fooishbar.org>

2 files changed, 6 insertions, 4 deletions

diff --git a/xfixes/cursor.c b/xfixes/cursor.c
index 79530f902..402456db0 100644
--- a/xfixes/cursor.c
+++ b/xfixes/cursor.c
@@ -380,7 +380,8 @@ ProcXFixesGetCursorImage(ClientPtr client)
     width = pCursor->bits->width;
     height = pCursor->bits->height;
     npixels = width * height;
-    rep = malloc(sizeof(xXFixesGetCursorImageReply) + npixels * sizeof(CARD32));
+    rep = calloc(sizeof(xXFixesGetCursorImageReply) + npixels * sizeof(CARD32),
+                 1);
     if (!rep)
         return BadAlloc;
 
@@ -529,8 +530,8 @@ ProcXFixesGetCursorImageAndName(ClientPtr client)
     name = pCursor->name ? NameForAtom(pCursor->name) : "";
     nbytes = strlen(name);
     nbytesRound = pad_to_int32(nbytes);
-    rep = malloc(sizeof(xXFixesGetCursorImageAndNameReply) +
-                 npixels * sizeof(CARD32) + nbytesRound);
+    rep = calloc(sizeof(xXFixesGetCursorImageAndNameReply) +
+                 npixels * sizeof(CARD32) + nbytesRound, 1);
     if (!rep)
         return BadAlloc;
 
diff --git a/xfixes/region.c b/xfixes/region.c
index 89675e52d..0e9ca443f 100644
--- a/xfixes/region.c
+++ b/xfixes/region.c
@@ -557,7 +557,8 @@ ProcXFixesFetchRegion(ClientPtr client)
     pBox = RegionRects(pRegion);
     nBox = RegionNumRects(pRegion);
 
-    reply = malloc(sizeof(xXFixesFetchRegionReply) + nBox * sizeof(xRectangle));
+    reply = calloc(sizeof(xXFixesFetchRegionReply) + nBox * sizeof(xRectangle),
+                   1);
     if (!reply)
         return BadAlloc;
     reply->type = X_Reply;