Convert XKB to new *allocarray functions

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Matt Turner <mattst88@gmail.com>
Acked-by: Daniel Stone <daniels@collabora.com>

8 files changed, 96 insertions, 93 deletions

diff --git a/xkb/XKBAlloc.c b/xkb/XKBAlloc.c
index 78c98371d..18557b804 100644
--- a/xkb/XKBAlloc.c
+++ b/xkb/XKBAlloc.c
@@ -56,8 +56,8 @@ XkbAllocCompatMap(XkbDescPtr xkb, unsigned which, unsigned nSI)
         if (compat->sym_interpret == NULL)
             compat->num_si = 0;
         prev_interpret = compat->sym_interpret;
-        compat->sym_interpret = realloc(compat->sym_interpret,
-                                        nSI * sizeof(XkbSymInterpretRec));
+        compat->sym_interpret = reallocarray(compat->sym_interpret,
+                                             nSI, sizeof(XkbSymInterpretRec));
         if (compat->sym_interpret == NULL) {
             free(prev_interpret);
             compat->size_si = compat->num_si = 0;
@@ -159,9 +159,9 @@ XkbAllocNames(XkbDescPtr xkb, unsigned which, int nTotalRG, int nTotalAliases)
         else if (nTotalAliases > names->num_key_aliases) {
             XkbKeyAliasRec *prev_aliases = names->key_aliases;
 
-            names->key_aliases = realloc(names->key_aliases,
-                                         nTotalAliases *
-                                         sizeof(XkbKeyAliasRec));
+            names->key_aliases = reallocarray(names->key_aliases,
+                                              nTotalAliases,
+                                              sizeof(XkbKeyAliasRec));
             if (names->key_aliases != NULL) {
                 memset(&names->key_aliases[names->num_key_aliases], 0,
                        (nTotalAliases -
@@ -184,8 +184,8 @@ XkbAllocNames(XkbDescPtr xkb, unsigned which, int nTotalRG, int nTotalAliases)
         else if (nTotalRG > names->num_rg) {
             Atom *prev_radio_groups = names->radio_groups;
 
-            names->radio_groups = realloc(names->radio_groups,
-                                          nTotalRG * sizeof(Atom));
+            names->radio_groups = reallocarray(names->radio_groups,
+                                               nTotalRG, sizeof(Atom));
             if (names->radio_groups != NULL) {
                 memset(&names->radio_groups[names->num_rg], 0,
                        (nTotalRG - names->num_rg) * sizeof(Atom));
diff --git a/xkb/XKBGAlloc.c b/xkb/XKBGAlloc.c
index 25917d304..e9f55fa43 100644
--- a/xkb/XKBGAlloc.c
+++ b/xkb/XKBGAlloc.c
@@ -409,7 +409,7 @@ XkbGeomRealloc(void **buffer, int szItems, int nrItems,
         return FALSE;
     /* Check if there is need to resize. */
     if (nrItems != szItems)
-        if (!(items = realloc(items, nrItems * itemSize)))
+        if (!(items = reallocarray(items, nrItems, itemSize)))
             return FALSE;
     /* Clear specified items to zero. */
     switch (clearance) {
diff --git a/xkb/XKBMAlloc.c b/xkb/XKBMAlloc.c
index 37ed1a725..dbc1389e6 100644
--- a/xkb/XKBMAlloc.c
+++ b/xkb/XKBMAlloc.c
@@ -80,7 +80,7 @@ XkbAllocClientMap(XkbDescPtr xkb, unsigned which, unsigned nTotalTypes)
             XkbKeyTypeRec *prev_types = map->types;
 
             map->types =
-                realloc(map->types, nTotalTypes * sizeof(XkbKeyTypeRec));
+                reallocarray(map->types, nTotalTypes, sizeof(XkbKeyTypeRec));
             if (map->types == NULL) {
                 free(prev_types);
                 map->num_types = map->size_types = 0;
@@ -177,7 +177,7 @@ XkbAllocServerMap(XkbDescPtr xkb, unsigned which, unsigned nNewActions)
             XkbAction *prev_acts = map->acts;
 
             need = map->num_acts + nNewActions;
-            map->acts = realloc(map->acts, need * sizeof(XkbAction));
+            map->acts = reallocarray(map->acts, need, sizeof(XkbAction));
             if (map->acts == NULL) {
                 free(prev_acts);
                 map->num_acts = map->size_acts = 0;
@@ -309,7 +309,7 @@ XkbResizeKeyType(XkbDescPtr xkb,
 
         if ((map_count > type->map_count) || (type->map == NULL))
             type->map =
-                realloc(type->map, map_count * sizeof(XkbKTMapEntryRec));
+                reallocarray(type->map, map_count, sizeof(XkbKTMapEntryRec));
         if (!type->map) {
             free(prev_map);
             return BadAlloc;
@@ -318,8 +318,8 @@ XkbResizeKeyType(XkbDescPtr xkb,
             XkbModsRec *prev_preserve = type->preserve;
 
             if ((map_count > type->map_count) || (type->preserve == NULL)) {
-                type->preserve = realloc(type->preserve,
-                                         map_count * sizeof(XkbModsRec));
+                type->preserve = reallocarray(type->preserve,
+                                              map_count, sizeof(XkbModsRec));
             }
             if (!type->preserve) {
                 free(prev_preserve);
@@ -336,8 +336,8 @@ XkbResizeKeyType(XkbDescPtr xkb,
     if ((new_num_lvls > type->num_levels) || (type->level_names == NULL)) {
         Atom *prev_level_names = type->level_names;
 
-        type->level_names = realloc(type->level_names,
-                                    new_num_lvls * sizeof(Atom));
+        type->level_names = reallocarray(type->level_names,
+                                         new_num_lvls, sizeof(Atom));
         if (!type->level_names) {
             free(prev_level_names);
             return BadAlloc;
@@ -659,9 +659,9 @@ XkbChangeKeycodeRange(XkbDescPtr xkb,
             if (xkb->map->key_sym_map) {
                 XkbSymMapRec *prev_key_sym_map = xkb->map->key_sym_map;
 
-                xkb->map->key_sym_map = realloc(xkb->map->key_sym_map,
-                                                (maxKC +
-                                                 1) * sizeof(XkbSymMapRec));
+                xkb->map->key_sym_map = reallocarray(xkb->map->key_sym_map,
+                                                     maxKC + 1,
+                                                     sizeof(XkbSymMapRec));
                 if (!xkb->map->key_sym_map) {
                     free(prev_key_sym_map);
                     return BadAlloc;
@@ -680,8 +680,9 @@ XkbChangeKeycodeRange(XkbDescPtr xkb,
             if (xkb->map->modmap) {
                 unsigned char *prev_modmap = xkb->map->modmap;
 
-                xkb->map->modmap = realloc(xkb->map->modmap,
-                                           (maxKC + 1) * sizeof(unsigned char));
+                xkb->map->modmap = reallocarray(xkb->map->modmap,
+                                                maxKC + 1,
+                                                sizeof(unsigned char));
                 if (!xkb->map->modmap) {
                     free(prev_modmap);
                     return BadAlloc;
@@ -702,9 +703,9 @@ XkbChangeKeycodeRange(XkbDescPtr xkb,
             if (xkb->server->behaviors) {
                 XkbBehavior *prev_behaviors = xkb->server->behaviors;
 
-                xkb->server->behaviors = realloc(xkb->server->behaviors,
-                                                 (maxKC +
-                                                  1) * sizeof(XkbBehavior));
+                xkb->server->behaviors = reallocarray(xkb->server->behaviors,
+                                                      maxKC + 1,
+                                                      sizeof(XkbBehavior));
                 if (!xkb->server->behaviors) {
                     free(prev_behaviors);
                     return BadAlloc;
@@ -724,9 +725,9 @@ XkbChangeKeycodeRange(XkbDescPtr xkb,
             if (xkb->server->key_acts) {
                 unsigned short *prev_key_acts = xkb->server->key_acts;
 
-                xkb->server->key_acts = realloc(xkb->server->key_acts,
-                                                (maxKC +
-                                                 1) * sizeof(unsigned short));
+                xkb->server->key_acts = reallocarray(xkb->server->key_acts,
+                                                     maxKC + 1,
+                                                     sizeof(unsigned short));
                 if (!xkb->server->key_acts) {
                     free(prev_key_acts);
                     return BadAlloc;
@@ -746,9 +747,9 @@ XkbChangeKeycodeRange(XkbDescPtr xkb,
             if (xkb->server->vmodmap) {
                 unsigned short *prev_vmodmap = xkb->server->vmodmap;
 
-                xkb->server->vmodmap = realloc(xkb->server->vmodmap,
-                                               (maxKC +
-                                                1) * sizeof(unsigned short));
+                xkb->server->vmodmap = reallocarray(xkb->server->vmodmap,
+                                                    maxKC + 1,
+                                                    sizeof(unsigned short));
                 if (!xkb->server->vmodmap) {
                     free(prev_vmodmap);
                     return BadAlloc;
@@ -769,8 +770,8 @@ XkbChangeKeycodeRange(XkbDescPtr xkb,
         if ((xkb->names) && (xkb->names->keys)) {
             XkbKeyNameRec *prev_keys = xkb->names->keys;
 
-            xkb->names->keys = realloc(xkb->names->keys,
-                                       (maxKC + 1) * sizeof(XkbKeyNameRec));
+            xkb->names->keys = reallocarray(xkb->names->keys,
+                                            maxKC + 1, sizeof(XkbKeyNameRec));
             if (!xkb->names->keys) {
                 free(prev_keys);
                 return BadAlloc;
diff --git a/xkb/maprules.c b/xkb/maprules.c
index 28148d9a5..8e2277969 100644
--- a/xkb/maprules.c
+++ b/xkb/maprules.c
@@ -89,11 +89,11 @@ InputLineAddChar(InputLine * line, int ch)
 {
     if (line->num_line >= line->sz_line) {
         if (line->line == line->buf) {
-            line->line = malloc(line->sz_line * 2);
+            line->line = xallocarray(line->sz_line, 2);
             memcpy(line->line, line->buf, line->sz_line);
         }
         else {
-            line->line = realloc((char *) line->line, line->sz_line * 2);
+            line->line = reallocarray(line->line, line->sz_line, 2);
         }
         line->sz_line *= 2;
     }
@@ -897,8 +897,8 @@ XkbRF_AddRule(XkbRF_RulesPtr rules)
     }
     else if (rules->num_rules >= rules->sz_rules) {
         rules->sz_rules *= 2;
-        rules->rules = realloc(rules->rules,
-                               rules->sz_rules * sizeof(XkbRF_RuleRec));
+        rules->rules = reallocarray(rules->rules,
+                                    rules->sz_rules, sizeof(XkbRF_RuleRec));
     }
     if (!rules->rules) {
         rules->sz_rules = rules->num_rules = 0;
@@ -919,8 +919,8 @@ XkbRF_AddGroup(XkbRF_RulesPtr rules)
     }
     else if (rules->num_groups >= rules->sz_groups) {
         rules->sz_groups *= 2;
-        rules->groups = realloc(rules->groups,
-                                rules->sz_groups * sizeof(XkbRF_GroupRec));
+        rules->groups = reallocarray(rules->groups,
+                                     rules->sz_groups, sizeof(XkbRF_GroupRec));
     }
     if (!rules->groups) {
         rules->sz_groups = rules->num_groups = 0;
diff --git a/xkb/xkb.c b/xkb/xkb.c
index f3988f9a7..294cdf8a3 100644
--- a/xkb/xkb.c
+++ b/xkb/xkb.c
@@ -2216,12 +2216,11 @@ SetKeyBehaviors(XkbSrvInfoPtr xkbi,
     }
 
     if (maxRG > (int) xkbi->nRadioGroups) {
-        int sz = maxRG * sizeof(XkbRadioGroupRec);
-
         if (xkbi->radioGroups)
-            xkbi->radioGroups = realloc(xkbi->radioGroups, sz);
+            xkbi->radioGroups = reallocarray(xkbi->radioGroups, maxRG,
+                                             sizeof(XkbRadioGroupRec));
         else
-            xkbi->radioGroups = calloc(1, sz);
+            xkbi->radioGroups = calloc(maxRG, sizeof(XkbRadioGroupRec));
         if (xkbi->radioGroups) {
             if (xkbi->nRadioGroups)
                 memset(&xkbi->radioGroups[xkbi->nRadioGroups], 0,
@@ -2700,15 +2699,16 @@ XkbSendCompatMap(ClientPtr client,
     char *data;
     int size;
 
-    size = rep->length * 4;
-    if (size > 0) {
-        data = malloc(size);
+    if (rep->length > 0) {
+        data = xallocarray(rep->length, 4);
         if (data) {
             register unsigned i, bit;
             xkbModsWireDesc *grp;
             XkbSymInterpretPtr sym = &compat->sym_interpret[rep->firstSI];
             xkbSymInterpretWireDesc *wire = (xkbSymInterpretWireDesc *) data;
 
+            size = rep->length * 4;
+
             for (i = 0; i < rep->nSI; i++, sym++, wire++) {
                 wire->sym = sym->sym;
                 wire->mods = sym->mods;
@@ -2856,9 +2856,9 @@ _XkbSetCompatMap(ClientPtr client, DeviceIntPtr dev,
 
         if ((unsigned) (req->firstSI + req->nSI) > compat->num_si) {
             compat->num_si = req->firstSI + req->nSI;
-            compat->sym_interpret = realloc(compat->sym_interpret,
-                                            compat->num_si *
-                                            sizeof(XkbSymInterpretRec));
+            compat->sym_interpret = reallocarray(compat->sym_interpret,
+                                                 compat->num_si,
+                                                 sizeof(XkbSymInterpretRec));
             if (!compat->sym_interpret) {
                 compat->num_si = 0;
                 return BadAlloc;
@@ -3086,14 +3086,15 @@ XkbSendIndicatorMap(ClientPtr client,
     register int i;
     register unsigned bit;
 
-    length = rep->length * 4;
-    if (length > 0) {
+    if (rep->length > 0) {
         CARD8 *to;
 
-        to = map = malloc(length);
+        to = map = xallocarray(rep->length, 4);
         if (map) {
             xkbIndicatorMapWireDesc *wire = (xkbIndicatorMapWireDesc *) to;
 
+            length = rep->length * 4;
+
             for (i = 0, bit = 1; i < XkbNumIndicators; i++, bit <<= 1) {
                 if (rep->which & bit) {
                     wire->flags = indicators->maps[i].flags;
@@ -4863,7 +4864,6 @@ XkbComputeGetGeometryReplySize(XkbGeometryPtr geom,
     }
     return Success;
 }
-
 static int
 XkbSendGeometry(ClientPtr client,
                 XkbGeometryPtr geom, xkbGetGeometryReply * rep, Bool freeGeom)
@@ -4872,10 +4872,10 @@ XkbSendGeometry(ClientPtr client,
     int len;
 
     if (geom != NULL) {
-        len = rep->length * 4;
-        start = desc = malloc(len);
+        start = desc = xallocarray(rep->length, 4);
         if (!start)
             return BadAlloc;
+        len = rep->length * 4;
         desc = XkbWriteCountedString(desc, geom->label_font, client->swapped);
         if (rep->nProperties > 0)
             desc = XkbWriteGeomProperties(desc, geom, client->swapped);
diff --git a/xkb/xkbActions.c b/xkb/xkbActions.c
index 2a196f151..9dd1cbd3b 100644
--- a/xkb/xkbActions.c
+++ b/xkb/xkbActions.c
@@ -1103,8 +1103,8 @@ _XkbNextFreeFilter(XkbSrvInfoPtr xkbi)
         }
     }
     xkbi->szFilters *= 2;
-    xkbi->filters = realloc(xkbi->filters,
-                            xkbi->szFilters * sizeof(XkbFilterRec));
+    xkbi->filters = reallocarray(xkbi->filters,
+                                 xkbi->szFilters, sizeof(XkbFilterRec));
     /* 6/21/93 (ef) -- XXX! deal with allocation failure */
     memset(&xkbi->filters[xkbi->szFilters / 2], 0,
            (xkbi->szFilters / 2) * sizeof(XkbFilterRec));
diff --git a/xkb/xkbUtils.c b/xkb/xkbUtils.c
index 6019f0f31..25b5a364e 100644
--- a/xkb/xkbUtils.c
+++ b/xkb/xkbUtils.c
@@ -946,8 +946,8 @@ _XkbCopyClientMap(XkbDescPtr src, XkbDescPtr dst)
 
         if (src->map->syms) {
             if (src->map->size_syms != dst->map->size_syms) {
-                tmp = realloc(dst->map->syms,
-                              src->map->size_syms * sizeof(KeySym));
+                tmp = reallocarray(dst->map->syms,
+                                   src->map->size_syms, sizeof(KeySym));
                 if (!tmp)
                     return FALSE;
                 dst->map->syms = tmp;
@@ -965,8 +965,8 @@ _XkbCopyClientMap(XkbDescPtr src, XkbDescPtr dst)
 
         if (src->map->key_sym_map) {
             if (src->max_key_code != dst->max_key_code) {
-                tmp = realloc(dst->map->key_sym_map,
-                              (src->max_key_code + 1) * sizeof(XkbSymMapRec));
+                tmp = reallocarray(dst->map->key_sym_map,
+                                   src->max_key_code + 1, sizeof(XkbSymMapRec));
                 if (!tmp)
                     return FALSE;
                 dst->map->key_sym_map = tmp;
@@ -983,8 +983,8 @@ _XkbCopyClientMap(XkbDescPtr src, XkbDescPtr dst)
             if (src->map->num_types > dst->map->size_types ||
                 !dst->map->types || !dst->map->size_types) {
                 if (dst->map->types && dst->map->size_types) {
-                    tmp = realloc(dst->map->types,
-                                  src->map->num_types * sizeof(XkbKeyTypeRec));
+                    tmp = reallocarray(dst->map->types, src->map->num_types,
+                                       sizeof(XkbKeyTypeRec));
                     if (!tmp)
                         return FALSE;
                     dst->map->types = tmp;
@@ -1020,8 +1020,8 @@ _XkbCopyClientMap(XkbDescPtr src, XkbDescPtr dst)
                     if (stype->num_levels != dtype->num_levels &&
                         dtype->num_levels && dtype->level_names &&
                         i < dst->map->num_types) {
-                        tmp = realloc(dtype->level_names,
-                                      stype->num_levels * sizeof(Atom));
+                        tmp = reallocarray(dtype->level_names,
+                                           stype->num_levels, sizeof(Atom));
                         if (!tmp)
                             continue;
                         dtype->level_names = tmp;
@@ -1053,17 +1053,17 @@ _XkbCopyClientMap(XkbDescPtr src, XkbDescPtr dst)
                         if (stype->map_count != dtype->map_count &&
                             dtype->map_count && dtype->map &&
                             i < dst->map->num_types) {
-                            tmp = realloc(dtype->map,
-                                          stype->map_count *
-                                          sizeof(XkbKTMapEntryRec));
+                            tmp = reallocarray(dtype->map,
+                                               stype->map_count,
+                                               sizeof(XkbKTMapEntryRec));
                             if (!tmp)
                                 return FALSE;
                             dtype->map = tmp;
                         }
                         else if (!dtype->map_count || !dtype->map ||
                                  i >= dst->map->num_types) {
-                            tmp = malloc(stype->map_count *
-                                         sizeof(XkbKTMapEntryRec));
+                            tmp = xallocarray(stype->map_count,
+                                              sizeof(XkbKTMapEntryRec));
                             if (!tmp)
                                 return FALSE;
                             dtype->map = tmp;
@@ -1082,16 +1082,17 @@ _XkbCopyClientMap(XkbDescPtr src, XkbDescPtr dst)
                         if (stype->map_count != dtype->map_count &&
                             dtype->map_count && dtype->preserve &&
                             i < dst->map->num_types) {
-                            tmp = realloc(dtype->preserve,
-                                          stype->map_count *
-                                          sizeof(XkbModsRec));
+                            tmp = reallocarray(dtype->preserve,
+                                               stype->map_count,
+                                               sizeof(XkbModsRec));
                             if (!tmp)
                                 return FALSE;
                             dtype->preserve = tmp;
                         }
                         else if (!dtype->preserve || !dtype->map_count ||
                                  i >= dst->map->num_types) {
-                            tmp = malloc(stype->map_count * sizeof(XkbModsRec));
+                            tmp = xallocarray(stype->map_count,
+                                              sizeof(XkbModsRec));
                             if (!tmp)
                                 return FALSE;
                             dtype->preserve = tmp;
@@ -1192,8 +1193,8 @@ _XkbCopyServerMap(XkbDescPtr src, XkbDescPtr dst)
 
         if (src->server->acts) {
             if (src->server->size_acts != dst->server->size_acts) {
-                tmp = realloc(dst->server->acts,
-                              src->server->size_acts * sizeof(XkbAction));
+                tmp = reallocarray(dst->server->acts,
+                                   src->server->size_acts, sizeof(XkbAction));
                 if (!tmp)
                     return FALSE;
                 dst->server->acts = tmp;
@@ -1210,8 +1211,8 @@ _XkbCopyServerMap(XkbDescPtr src, XkbDescPtr dst)
 
         if (src->server->key_acts) {
             if (src->max_key_code != dst->max_key_code) {
-                tmp = realloc(dst->server->key_acts,
-                              (src->max_key_code + 1) * sizeof(unsigned short));
+                tmp = reallocarray(dst->server->key_acts,
+                                   src->max_key_code + 1, sizeof(unsigned short));
                 if (!tmp)
                     return FALSE;
                 dst->server->key_acts = tmp;
@@ -1226,8 +1227,8 @@ _XkbCopyServerMap(XkbDescPtr src, XkbDescPtr dst)
 
         if (src->server->behaviors) {
             if (src->max_key_code != dst->max_key_code) {
-                tmp = realloc(dst->server->behaviors,
-                              (src->max_key_code + 1) * sizeof(XkbBehavior));
+                tmp = reallocarray(dst->server->behaviors,
+                                   src->max_key_code + 1, sizeof(XkbBehavior));
                 if (!tmp)
                     return FALSE;
                 dst->server->behaviors = tmp;
@@ -1244,8 +1245,8 @@ _XkbCopyServerMap(XkbDescPtr src, XkbDescPtr dst)
 
         if (src->server->vmodmap) {
             if (src->max_key_code != dst->max_key_code) {
-                tmp = realloc(dst->server->vmodmap,
-                              (src->max_key_code + 1) * sizeof(unsigned short));
+                tmp = reallocarray(dst->server->vmodmap,
+                                   src->max_key_code + 1, sizeof(unsigned short));
                 if (!tmp)
                     return FALSE;
                 dst->server->vmodmap = tmp;
@@ -1281,8 +1282,8 @@ _XkbCopyNames(XkbDescPtr src, XkbDescPtr dst)
 
         if (src->names->keys) {
             if (src->max_key_code != dst->max_key_code) {
-                tmp = realloc(dst->names->keys,
-                              (src->max_key_code + 1) * sizeof(XkbKeyNameRec));
+                tmp = reallocarray(dst->names->keys, src->max_key_code + 1,
+                                   sizeof(XkbKeyNameRec));
                 if (!tmp)
                     return FALSE;
                 dst->names->keys = tmp;
@@ -1297,9 +1298,9 @@ _XkbCopyNames(XkbDescPtr src, XkbDescPtr dst)
 
         if (src->names->num_key_aliases) {
             if (src->names->num_key_aliases != dst->names->num_key_aliases) {
-                tmp = realloc(dst->names->key_aliases,
-                              src->names->num_key_aliases *
-                              sizeof(XkbKeyAliasRec));
+                tmp = reallocarray(dst->names->key_aliases,
+                                   src->names->num_key_aliases,
+                                   sizeof(XkbKeyAliasRec));
                 if (!tmp)
                     return FALSE;
                 dst->names->key_aliases = tmp;
@@ -1315,8 +1316,8 @@ _XkbCopyNames(XkbDescPtr src, XkbDescPtr dst)
 
         if (src->names->num_rg) {
             if (src->names->num_rg != dst->names->num_rg) {
-                tmp = realloc(dst->names->radio_groups,
-                              src->names->num_rg * sizeof(Atom));
+                tmp = reallocarray(dst->names->radio_groups,
+                                   src->names->num_rg, sizeof(Atom));
                 if (!tmp)
                     return FALSE;
                 dst->names->radio_groups = tmp;
@@ -1366,8 +1367,9 @@ _XkbCopyCompat(XkbDescPtr src, XkbDescPtr dst)
 
         if (src->compat->sym_interpret && src->compat->num_si) {
             if (src->compat->num_si != dst->compat->size_si) {
-                tmp = realloc(dst->compat->sym_interpret,
-                              src->compat->num_si * sizeof(XkbSymInterpretRec));
+                tmp = reallocarray(dst->compat->sym_interpret,
+                                   src->compat->num_si,
+                                   sizeof(XkbSymInterpretRec));
                 if (!tmp)
                     return FALSE;
                 dst->compat->sym_interpret = tmp;
@@ -1582,8 +1584,8 @@ _XkbCopyGeom(XkbDescPtr src, XkbDescPtr dst)
                          j < sshape->num_outlines;
                          j++, soutline++, doutline++) {
                         if (soutline->num_points) {
-                            tmp = malloc(soutline->num_points *
-                                         sizeof(XkbPointRec));
+                            tmp = xallocarray(soutline->num_points,
+                                              sizeof(XkbPointRec));
                             if (!tmp)
                                 return FALSE;
                             doutline->points = tmp;
@@ -1710,7 +1712,7 @@ _XkbCopyGeom(XkbDescPtr src, XkbDescPtr dst)
                 for (j = 0, srow = ssection->rows, drow = dsection->rows;
                      j < ssection->num_rows; j++, srow++, drow++) {
                     if (srow->num_keys) {
-                        tmp = malloc(srow->num_keys * sizeof(XkbKeyRec));
+                        tmp = xallocarray(srow->num_keys, sizeof(XkbKeyRec));
                         if (!tmp)
                             return FALSE;
                         drow->keys = tmp;
diff --git a/xkb/xkmread.c b/xkb/xkmread.c
index 0b9f0ef6d..1666e3216 100644
--- a/xkb/xkmread.c
+++ b/xkb/xkmread.c
@@ -64,7 +64,7 @@ XkmInsureSize(void *oldPtr, int oldCount, int *newCountRtrn, int elemSize)
         oldPtr = calloc(newCount, elemSize);
     }
     else if (oldCount < newCount) {
-        oldPtr = realloc(oldPtr, newCount * elemSize);
+        oldPtr = reallocarray(oldPtr, newCount, elemSize);
         if (oldPtr != NULL) {
             char *tmp = (char *) oldPtr;