if (reply.length > (SIZE_T_MAX>>2)) { FSfree((char *) offs); return FSBadAlloc; }
FSQueryXBitmaps16(svr, fid, format, range_type, str, str_len,		  offsets, glyphdata)    FSServer   *svr;    Font        fid;    FSBitmapFormat format;    Bool        range_type;    FSChar2b   *str;    unsigned long str_len;    FSOffset  **offsets;    unsigned char **glyphdata;{    fsQueryXBitmaps16Req *req;    fsQueryXBitmaps16Reply reply;    FSOffset   *offs;    fsOffset32 local_offs;    unsigned char *gd;    int         left;    int		i;    GetReq(QueryXBitmaps16, req);    req->fid = fid;    req->range = range_type;    req->format = format;    req->num_ranges = str_len;    req->length += ((str_len * SIZEOF(fsChar2b)) + 3) >> 2;    if (FSProtocolVersion(svr) == 1)    {	int i;	fsChar2b_version1 *swapped_str;	swapped_str = (fsChar2b_version1 *)	    FSmalloc(SIZEOF(fsChar2b_version1) * str_len);	if (!swapped_str)	    return FSBadAlloc;	for (i = 0; i < str_len; i++) {	    swapped_str[i].low = str[i].low;	    swapped_str[i].high = str[i].high;	}	_FSSend(svr, (char *)swapped_str, (str_len*SIZEOF(fsChar2b_version1)));	FSfree(swapped_str);    } else	_FSSend(svr, (char *) str, (str_len * SIZEOF(fsChar2b)));    /* get back the info */    if (!_FSReply(svr, (fsReply *) & reply,	      (SIZEOF(fsQueryXBitmaps16Reply) - SIZEOF(fsGenericReply)) >> 2,		  fsFalse))	return FSBadAlloc;    offs = (FSOffset *) FSmalloc(sizeof(FSOffset) * reply.num_chars);    *offsets = offs;    if (!offs)	return FSBadAlloc;    left = (reply.length << 2) - SIZEOF(fsQueryXBitmaps16Reply)	- (SIZEOF(fsOffset32) * reply.num_chars);    gd = (unsigned char *) FSmalloc(left);    *glyphdata = gd;    if (!gd) {	FSfree((char *) offs);	return FSBadAlloc;    }    for (i=0; i<reply.num_chars; i++)    {	_FSReadPad(svr, (char *) &local_offs, (SIZEOF(fsOffset32)));	offs->position = local_offs.position;	offs->length = local_offs.length;	offs++;    }    _FSReadPad(svr, (char *) gd, left);    SyncHandle();    return FSSuccess;}