if (props->num_offsets > SIZE_T_MAX / sizeof(FSPropOffset)) return FSBadAlloc;
FSQueryXInfo(svr, fid, info, props, offsets, prop_data)    FSServer   *svr;    Font        fid;    FSXFontInfoHeader *info;    FSPropInfo *props;    FSPropOffset **offsets;    unsigned char **prop_data;{    fsQueryXInfoReq *req;    fsQueryXInfoReply reply;    FSPropOffset *offset_data;    unsigned char *pdata;    fsPropInfo local_pi;    fsPropOffset local_po;    int j;    GetReq(QueryXInfo, req);    req->id = fid;    /* get back the info */    if (!_FSReply(svr, (fsReply *) & reply, ((SIZEOF(fsQueryXInfoReply) -			    SIZEOF(fsGenericReply)) >> 2), fsFalse)) {	return FSBadAlloc;    }    FSUnpack_XFontInfoHeader(&reply, info, FSProtocolVersion(svr));    /* get the prop header */    _FSReadPad(svr, (char *) &local_pi, SIZEOF(fsPropInfo));    props->num_offsets = local_pi.num_offsets;    props->data_len = local_pi.data_len;    /* prepare for prop data */    offset_data = (FSPropOffset *)	FSmalloc(props->num_offsets * sizeof(FSPropOffset));    if (!offset_data)	return FSBadAlloc;    pdata = (unsigned char *) FSmalloc(props->data_len);    if (!pdata) {	FSfree((char *) offset_data);	return FSBadAlloc;    }    /* get offsets */    for (j=0; j<props->num_offsets; j++)    {	_FSReadPad(svr, (char *) &local_po, SIZEOF(fsPropOffset));	offset_data[j].name.position = local_po.name.position;	offset_data[j].name.length = local_po.name.length;	offset_data[j].value.position = local_po.value.position;	offset_data[j].value.length = local_po.value.length;	offset_data[j].type = local_po.type;    }    /* get data */    _FSReadPad(svr, (char *) pdata, props->data_len);    *offsets = offset_data;    *prop_data = pdata;    SyncHandle();    return FSSuccess;}