if (namelen > sizeof (buf) - 1)
if (namelen <= 0 || namelen > sizeof (buf) - 1)
fs_send_open_font(pointer client, FontPathElementPtr fpe, Mask flags, 		  char *name, int namelen, 		  fsBitmapFormat format, fsBitmapFormatMask fmask, 		  XID id, FontPtr *ppfont){    FSFpePtr		    conn = (FSFpePtr) fpe->private;    FontPtr		    font;    FSBlockDataPtr	    blockrec = NULL;    FSBlockedFontPtr	    bfont;    FSFontDataPtr	    fsd;    FSFontPtr		    fsfont;    fsOpenBitmapFontReq	    openreq;    fsQueryXInfoReq	    inforeq;    fsQueryXExtents16Req    extreq;    int			    err;    unsigned char	    buf[1024];    if (conn->blockState & FS_GIVE_UP)	return BadFontName;        if (namelen > sizeof (buf) - 1)	return BadFontName;        /*     * Get the font structure put together, either by reusing     * the existing one or creating a new one     */    if (flags & FontReopen)    {	Atom	nameatom, fn = None;	int	i;	font = *ppfont;	fsd = (FSFontDataPtr)font->fpePrivate;	fsfont = (FSFontPtr)font->fontPrivate;	/* This is an attempt to reopen a font.  Did the font have a	   NAME property? */	if ((nameatom = MakeAtom("FONT", 4, 0)) != None)	{	    for (i = 0; i < font->info.nprops; i++)		if (font->info.props[i].name == nameatom &&		    font->info.isStringProp[i])		{		    fn = font->info.props[i].value;		    break;		}	}	if (fn == None || !(name = NameForAtom(fn)))	{	    name = fsd->name;	    namelen = fsd->namelen;	}	else	    namelen = strlen(name);    }    else    {	font = fs_create_font (fpe, name, namelen, format, fmask);	if (!font)	    return AllocError;		fsd = (FSFontDataPtr)font->fpePrivate;	fsfont = (FSFontPtr)font->fontPrivate;    }        /* make a new block record, and add it to the end of the list */    blockrec = fs_new_block_rec(font->fpe, client, FS_OPEN_FONT);    if (!blockrec)    {	if (!(flags & FontReopen))	    (*font->unload_font) (font);	return AllocError;    }        /*     * Must check this before generating any protocol, otherwise we'll     * mess up a reconnect in progress     */    if (conn->blockState & (FS_BROKEN_CONNECTION | FS_RECONNECTING))    {	_fs_pending_reply (conn);	return Suspended;    }	    fsd->generation = conn->generation;    bfont = (FSBlockedFontPtr) blockrec->data;    bfont->fontid = fsd->fontid;    bfont->pfont = font;    bfont->state = FS_OPEN_REPLY;    bfont->flags = flags;    bfont->format = fsd->format;    bfont->clients_depending = (FSClientsDependingPtr)0;    bfont->freeFont = (flags & FontReopen) == 0;    _fs_client_access (conn, client, (flags & FontOpenSync) != 0);    _fs_client_resolution(conn);    /* do an FS_OpenFont, FS_QueryXInfo and FS_QueryXExtents */    buf[0] = (unsigned char) namelen;    memcpy(&buf[1], name, namelen);    openreq.reqType = FS_OpenBitmapFont;    openreq.fid = fsd->fontid;    openreq.format_hint = fsd->format;    openreq.format_mask = fsd->fmask;    openreq.length = (SIZEOF(fsOpenBitmapFontReq) + namelen + 4) >> 2;    _fs_add_req_log(conn, FS_OpenBitmapFont);    _fs_write(conn, (char *) &openreq, SIZEOF(fsOpenBitmapFontReq));    _fs_write_pad(conn, (char *) buf, namelen + 1);    blockrec->sequenceNumber = conn->current_seq;        inforeq.reqType = FS_QueryXInfo;    inforeq.id = fsd->fontid;    inforeq.length = SIZEOF(fsQueryXInfoReq) >> 2;    bfont->queryInfoSequence = conn->current_seq + 1;        _fs_add_req_log(conn, FS_QueryXInfo);    _fs_write(conn, (char *) &inforeq, SIZEOF(fsQueryXInfoReq));        if (!(bfont->flags & FontReopen))    {	extreq.reqType = FS_QueryXExtents16;	extreq.range = fsTrue;	extreq.fid = fsd->fontid;	extreq.num_ranges = 0;	extreq.length = SIZEOF(fsQueryXExtents16Req) >> 2;		bfont->queryExtentsSequence = conn->current_seq + 1;		_fs_add_req_log(conn, FS_QueryXExtents16);	_fs_write(conn, (char *) &extreq, SIZEOF(fsQueryXExtents16Req));    }    #ifdef NCD    if (configData.ExtendedFontDiags)     {	memcpy(buf, name, MIN(256, namelen));	buf[MIN(256, namelen)] = '\0';	printf("Requesting font \"%s\" from font server \"%s\"\n",	       buf, font->fpe->name);    }#endif    _fs_prepare_for_reply (conn);        err = blockrec->errcode;    if (bfont->flags & FontOpenSync)    {	while (blockrec->errcode == StillWorking)	{	    if (fs_await_reply (conn) != FSIO_READY)	    {		blockrec->errcode = BadFontName;		break;	    }	    fs_read_reply (font->fpe, client);	}	err = blockrec->errcode;	if (err == Successful)	    *ppfont = bfont->pfont;	else	    fs_cleanup_bfont (bfont);	bfont->freeFont = FALSE;	_fs_remove_block_rec (conn, blockrec);    }    return err == StillWorking ? Suspended : err;}