if (reply.num_extents > SIZE_T_MAX/sizeof(FSXCharInfo))
if (reply.num_extents > SIZE_MAX/sizeof(FSXCharInfo))
FSQueryXExtents16(svr, fid, range_type, str, str_len, extents)    FSServer   *svr;    Font        fid;    Bool        range_type;    FSChar2b   *str;    unsigned long str_len;    FSXCharInfo **extents;{    fsQueryXExtents16Req *req;    fsQueryXExtents16Reply reply;    FSXCharInfo *ext;    fsXCharInfo local_exts;    int         i;    GetReq(QueryXExtents16, req);    req->fid = fid;    req->range = range_type;    req->num_ranges = str_len;    req->length += ((str_len * SIZEOF(fsChar2b)) + 3) >> 2;    if (FSProtocolVersion(svr) == 1)    {	fsChar2b_version1 *swapped_str;	swapped_str = (fsChar2b_version1 *)	    FSmalloc(SIZEOF(fsChar2b_version1) * str_len);	if (!swapped_str)	    return FSBadAlloc;	for (i = 0; i < str_len; i++) {	    swapped_str[i].low = str[i].low;	    swapped_str[i].high = str[i].high;	}	_FSSend(svr, (char *)swapped_str, (str_len*SIZEOF(fsChar2b_version1)));	FSfree(swapped_str);    } else	_FSSend(svr, (char *) str, (str_len * SIZEOF(fsChar2b)));    /* get back the info */    if (!_FSReply(svr, (fsReply *) & reply,	      (SIZEOF(fsQueryXExtents16Reply) - SIZEOF(fsGenericReply)) >> 2,		  fsFalse))	return FSBadAlloc;    if (reply.num_extents > SIZE_T_MAX/sizeof(FSXCharInfo)) 	return FSBadAlloc;    ext = (FSXCharInfo *) FSmalloc(sizeof(FSXCharInfo) * reply.num_extents);    *extents = ext;    if (!ext)	return FSBadAlloc;    for (i = 0; i < reply.num_extents; i++) {	_FSReadPad(svr, (char *) &local_exts, SIZEOF(fsXCharInfo));	_FS_convert_char_info(&local_exts, &ext[i]);    }    SyncHandle();    return FSSuccess;}