if (reply.num_chars > SIZE_T_MAX / sizeof(FSOffset))
if (reply.num_chars > SIZE_MAX / sizeof(FSOffset))
FSQueryXBitmaps8(svr, fid, format, range_type, str, str_len, offsets, glyphdata)    FSServer   *svr;    Font        fid;    FSBitmapFormat format;    Bool        range_type;    unsigned char *str;    unsigned long str_len;    FSOffset  **offsets;    unsigned char **glyphdata;{    fsQueryXBitmaps8Req *req;    fsQueryXBitmaps8Reply reply;    FSOffset   *offs;    fsOffset32 local_offs;    unsigned char *gd;    int         left;    int		i;    GetReq(QueryXBitmaps8, req);    req->fid = fid;    req->range = range_type;    req->format = format;    req->num_ranges = str_len;    req->length += (str_len + 3) >> 2;    _FSSend(svr, (char *) str, str_len);    /* get back the info */    if (!_FSReply(svr, (fsReply *) & reply,     (SIZEOF(fsQueryXBitmaps8Reply) - SIZEOF(fsGenericReply)) >> 2, fsFalse))	return FSBadAlloc;    if (reply.num_chars > SIZE_T_MAX / sizeof(FSOffset)) 	return FSBadAlloc;    offs = (FSOffset *) FSmalloc(sizeof(FSOffset) * reply.num_chars);    *offsets = offs;    if (!offs)	return FSBadAlloc;    left = (reply.length << 2) - SIZEOF(fsQueryXBitmaps8Reply)	- (SIZEOF(fsOffset32) * reply.num_chars);    /* XXX This thest is incomplete */    if (reply.length > (SIZE_T_MAX >> 2)) {	FSfree((char *) offs);	return FSBadAlloc;    }    gd = (unsigned char *) FSmalloc(left);    *glyphdata = gd;    if (!gd) {	FSfree((char *) offs);	return FSBadAlloc;    }    for (i=0; i<reply.num_chars; i++)    {	_FSReadPad(svr, (char *) &local_offs, (SIZEOF(fsOffset32)));	offs->position = local_offs.position;	offs->length = local_offs.length;	offs++;    }    _FSReadPad(svr, (char *) gd, left);    SyncHandle();    return FSSuccess;}