swapped requests with short length may core dump server

22 files changed, 90 insertions, 25 deletions

diff --git a/xc/programs/Xserver/Xi/allowev.c b/xc/programs/Xserver/Xi/allowev.c
index 41e2e311c..70a2a919a 100644
--- a/xc/programs/Xserver/Xi/allowev.c
+++ b/xc/programs/Xserver/Xi/allowev.c
@@ -1,4 +1,4 @@
-/* $XConsortium: xallowev.c,v 1.5 89/10/10 16:00:59 gms Exp $ */
+/* $XConsortium: xallowev.c,v 1.6 89/12/02 15:20:24 rws Exp $ */
 
 /************************************************************
 Copyright (c) 1989 by Hewlett-Packard Company, Palo Alto, California, and the 
@@ -56,8 +56,9 @@ SProcXAllowDeviceEvents(client)
     register char n;
 
     REQUEST(xAllowDeviceEventsReq);
-    swapl(&stuff->time, n);
     swaps(&stuff->length, n);
+    REQUEST_SIZE_MATCH(xAllowDeviceEventsReq);
+    swapl(&stuff->time, n);
     return(ProcXAllowDeviceEvents(client));
     }
 
diff --git a/xc/programs/Xserver/Xi/chgdctl.c b/xc/programs/Xserver/Xi/chgdctl.c
index 54bacf8f9..298d21fdd 100644
--- a/xc/programs/Xserver/Xi/chgdctl.c
+++ b/xc/programs/Xserver/Xi/chgdctl.c
@@ -1,4 +1,4 @@
-/* $XConsortium: xchgdctl.c,v 1.4 91/01/18 15:28:04 gms Exp $ */
+/* $XConsortium: xchgdctl.c,v 1.1 91/07/24 15:51:26 rws Exp $ */
 
 /************************************************************
 Copyright (c) 1989 by Hewlett-Packard Company, Palo Alto, California, and the 
@@ -58,6 +58,7 @@ SProcXChangeDeviceControl(client)
 
     REQUEST(xChangeDeviceControlReq);
     swaps(&stuff->length, n);
+    REQUEST_AT_LEAST_SIZE(xChangeDeviceControlReq);
     swaps(&stuff->control, n);
     return(ProcXChangeDeviceControl(client));
     }
@@ -98,6 +99,15 @@ ProcXChangeDeviceControl(client)
     switch (stuff->control) 
 	{
 	case DEVICE_RESOLUTION:
+    	    r = (xDeviceResolutionCtl *) &stuff[1];
+	    if ((len < (sizeof(xDeviceResolutionCtl)>>2)) ||
+	        (len != (sizeof(xDeviceResolutionCtl)>>2) +
+		 r->num_valuators))
+		{
+		SendErrorToClient (client, IReqCode, X_ChangeDeviceControl, 
+			0, BadLength);
+		return Success;
+		}
 	    if (!dev->valuator)
 		{
 		SendErrorToClient (client, IReqCode, X_ChangeDeviceControl, 0, 
@@ -111,7 +121,6 @@ ProcXChangeDeviceControl(client)
 		    &rep);
 		return Success;
 		}
-    	    r = (xDeviceResolutionCtl *) &stuff[1];
 	    resolution = (CARD32 *) (r + 1);
 	    if (r->first_valuator + r->num_valuators > dev->valuator->numAxes)
 		{
diff --git a/xc/programs/Xserver/Xi/chgfctl.c b/xc/programs/Xserver/Xi/chgfctl.c
index fc9696921..6c34a4d66 100644
--- a/xc/programs/Xserver/Xi/chgfctl.c
+++ b/xc/programs/Xserver/Xi/chgfctl.c
@@ -1,4 +1,4 @@
-/* $XConsortium: xchgfctl.c,v 1.13 91/05/14 12:21:54 rws Exp $ */
+/* $XConsortium: xchgfctl.c,v 1.14 92/10/20 17:11:18 rws Exp $ */
 
 /************************************************************
 Copyright (c) 1989 by Hewlett-Packard Company, Palo Alto, California, and the 
@@ -59,6 +59,7 @@ SProcXChangeFeedbackControl(client)
 
     REQUEST(xChangeFeedbackControlReq);
     swaps(&stuff->length, n);
+    REQUEST_AT_LEAST_SIZE(xChangeFeedbackControlReq);
     swapl(&stuff->mask, n);
     return(ProcXChangeFeedbackControl(client));
     }
diff --git a/xc/programs/Xserver/Xi/chgkbd.c b/xc/programs/Xserver/Xi/chgkbd.c
index edb1792d2..4b99d3c03 100644
--- a/xc/programs/Xserver/Xi/chgkbd.c
+++ b/xc/programs/Xserver/Xi/chgkbd.c
@@ -1,4 +1,4 @@
-/* $XConsortium: xchgkbd.c,v 1.13 91/05/05 17:37:27 rws Exp $ */
+/* $XConsortium: xchgkbd.c,v 1.14 92/10/20 17:11:26 rws Exp $ */
 
 /************************************************************
 Copyright (c) 1989 by Hewlett-Packard Company, Palo Alto, California, and the 
@@ -60,6 +60,7 @@ SProcXChangeKeyboardDevice(client)
 
     REQUEST(xChangeKeyboardDeviceReq);
     swaps(&stuff->length, n);
+    REQUEST_SIZE_MATCH(xChangeKeyboardDeviceReq);
     return(ProcXChangeKeyboardDevice(client));
     }
 
diff --git a/xc/programs/Xserver/Xi/chgkmap.c b/xc/programs/Xserver/Xi/chgkmap.c
index e70c3545a..3b99d02f8 100644
--- a/xc/programs/Xserver/Xi/chgkmap.c
+++ b/xc/programs/Xserver/Xi/chgkmap.c
@@ -1,4 +1,4 @@
-/* $XConsortium: xchgkmap.c,v 1.4 89/09/25 16:23:18 gms Exp $ */
+/* $XConsortium: xchgkmap.c,v 1.5 89/12/02 15:20:34 rws Exp $ */
 
 /************************************************************
 Copyright (c) 1989 by Hewlett-Packard Company, Palo Alto, California, and the 
@@ -60,6 +60,7 @@ SProcXChangeDeviceKeyMapping(client)
 
     REQUEST(xChangeDeviceKeyMappingReq);
     swaps(&stuff->length, n);
+    REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq);
     p = (long *) &stuff[1];
     count = stuff->keyCodes * stuff->keySymsPerKeyCode;
     for (i = 0; i < count; i++)
diff --git a/xc/programs/Xserver/Xi/chgprop.c b/xc/programs/Xserver/Xi/chgprop.c
index ecbb203d9..598cb04ce 100644
--- a/xc/programs/Xserver/Xi/chgprop.c
+++ b/xc/programs/Xserver/Xi/chgprop.c
@@ -1,4 +1,4 @@
-/* $XConsortium: xchgprop.c,v 1.9 91/01/24 16:22:19 rws Exp $ */
+/* $XConsortium: xchgprop.c,v 1.10 92/10/20 17:11:29 rws Exp $ */
 
 /************************************************************
 Copyright (c) 1989 by Hewlett-Packard Company, Palo Alto, California, and the 
@@ -60,6 +60,7 @@ SProcXChangeDeviceDontPropagateList(client)
 
     REQUEST(xChangeDeviceDontPropagateListReq);
     swaps(&stuff->length, n);
+    REQUEST_AT_LEAST_SIZE(xChangeDeviceDontPropagateListReq);
     swapl(&stuff->window, n);
     swaps(&stuff->count, n);
     p = (long *) &stuff[1];
diff --git a/xc/programs/Xserver/Xi/chgptr.c b/xc/programs/Xserver/Xi/chgptr.c
index 2c323fb51..3dfeba97c 100644
--- a/xc/programs/Xserver/Xi/chgptr.c
+++ b/xc/programs/Xserver/Xi/chgptr.c
@@ -1,4 +1,4 @@
-/* $XConsortium: xchgptr.c,v 1.14 91/05/05 17:36:57 rws Exp $ */
+/* $XConsortium: xchgptr.c,v 1.15 92/10/20 17:11:33 rws Exp $ */
 
 /************************************************************
 Copyright (c) 1989 by Hewlett-Packard Company, Palo Alto, California, and the 
@@ -65,6 +65,7 @@ SProcXChangePointerDevice(client)
 
     REQUEST(xChangePointerDeviceReq);
     swaps(&stuff->length, n);
+    REQUEST_SIZE_MATCH(xChangePointerDeviceReq);
     return(ProcXChangePointerDevice(client));
     }
 
diff --git a/xc/programs/Xserver/Xi/closedev.c b/xc/programs/Xserver/Xi/closedev.c
index 636c8aab6..e74454821 100644
--- a/xc/programs/Xserver/Xi/closedev.c
+++ b/xc/programs/Xserver/Xi/closedev.c
@@ -1,4 +1,4 @@
-/* $XConsortium: xclosedev.c,v 1.9 91/01/24 16:24:01 rws Exp $ */
+/* $XConsortium: xclosedev.c,v 1.10 92/10/20 17:11:36 rws Exp $ */
 
 /************************************************************
 Copyright (c) 1989 by Hewlett-Packard Company, Palo Alto, California, and the 
@@ -61,6 +61,7 @@ SProcXCloseDevice(client)
 
     REQUEST(xCloseDeviceReq);
     swaps(&stuff->length, n);
+    REQUEST_SIZE_MATCH(xCloseDeviceReq);
     return(ProcXCloseDevice(client));
     }
 
diff --git a/xc/programs/Xserver/Xi/getdctl.c b/xc/programs/Xserver/Xi/getdctl.c
index cc06b296b..857c5bcec 100644
--- a/xc/programs/Xserver/Xi/getdctl.c
+++ b/xc/programs/Xserver/Xi/getdctl.c
@@ -1,4 +1,4 @@
-/* $XConsortium: xgetdctl.c,v 1.3 91/01/18 15:34:49 gms Exp $ */
+/* $XConsortium: xgetdctl.c,v 1.1 91/07/24 15:50:52 rws Exp $ */
 
 /************************************************************
 Copyright (c) 1989 by Hewlett-Packard Company, Palo Alto, California, and the 
@@ -59,6 +59,7 @@ SProcXGetDeviceControl(client)
 
     REQUEST(xGetDeviceControlReq);
     swaps(&stuff->length, n);
+    REQUEST_SIZE_MATCH(xGetDeviceControlReq);
     swaps(&stuff->control, n);
     return(ProcXGetDeviceControl(client));
     }
diff --git a/xc/programs/Xserver/Xi/getprop.c b/xc/programs/Xserver/Xi/getprop.c
index 46e78ecad..b18d36834 100644
--- a/xc/programs/Xserver/Xi/getprop.c
+++ b/xc/programs/Xserver/Xi/getprop.c
@@ -1,4 +1,4 @@
-/* $XConsortium: xgetprop.c,v 1.7 91/01/24 17:03:42 rws Exp $ */
+/* $XConsortium: xgetprop.c,v 1.8 92/10/20 17:11:46 rws Exp $ */
 
 /************************************************************
 Copyright (c) 1989 by Hewlett-Packard Company, Palo Alto, California, and the 
@@ -58,6 +58,7 @@ SProcXGetDeviceDontPropagateList(client)
 
     REQUEST(xGetDeviceDontPropagateListReq);
     swaps(&stuff->length, n);
+    REQUEST_SIZE_MATCH(xGetDeviceDontPropagateListReq);
     swapl(&stuff->window, n);
     return(ProcXGetDeviceDontPropagateList(client));
     }
diff --git a/xc/programs/Xserver/Xi/getselev.c b/xc/programs/Xserver/Xi/getselev.c
index ab5988e89..7128639b3 100644
--- a/xc/programs/Xserver/Xi/getselev.c
+++ b/xc/programs/Xserver/Xi/getselev.c
@@ -22,7 +22,7 @@ SOFTWARE.
 
 ********************************************************/
 
-/* $XConsortium: xgetselev.c,v 1.8 90/05/18 11:37:37 rws Exp $ */
+/* $XConsortium: xgetselev.c,v 1.9 90/05/18 15:35:21 rws Exp $ */
 
 /***********************************************************************
  *
@@ -57,6 +57,7 @@ SProcXGetSelectedExtensionEvents(client)
 
     REQUEST(xGetSelectedExtensionEventsReq);
     swaps(&stuff->length, n);
+    REQUEST_SIZE_MATCH(xGetSelectedExtensionEventsReq);
     swapl(&stuff->window, n);
     return(ProcXGetSelectedExtensionEvents(client));
     }
diff --git a/xc/programs/Xserver/Xi/getvers.c b/xc/programs/Xserver/Xi/getvers.c
index 1c0bff632..f1f366348 100644
--- a/xc/programs/Xserver/Xi/getvers.c
+++ b/xc/programs/Xserver/Xi/getvers.c
@@ -1,4 +1,4 @@
-/* $XConsortium: xgetvers.c,v 1.4 89/12/02 15:21:09 rws Exp $ */
+/* $XConsortium: xgetvers.c,v 1.5 90/05/18 15:35:29 rws Exp $ */
 
 /************************************************************
 Copyright (c) 1989 by Hewlett-Packard Company, Palo Alto, California, and the 
@@ -57,6 +57,7 @@ SProcXGetExtensionVersion(client)
 
     REQUEST(xGetExtensionVersionReq);
     swaps(&stuff->length, n);
+    REQUEST_AT_LEAST_SIZE(xGetExtensionVersionReq);
     swaps(&stuff->nbytes, n);
     return(ProcXGetExtensionVersion(client));
     }
@@ -75,6 +76,13 @@ ProcXGetExtensionVersion (client)
     REQUEST(xGetExtensionVersionReq);
     REQUEST_AT_LEAST_SIZE(xGetExtensionVersionReq);
 
+    if (stuff->length != (sizeof(xGetExtensionVersionReq) + 
+	stuff->nbytes + 3)>>2)
+	{
+	SendErrorToClient(client, IReqCode, X_GetExtensionVersion, 0, 
+		BadLength);
+	return Success;
+	}
 
     rep.repType = X_Reply;
     rep.RepType = X_GetExtensionVersion;
diff --git a/xc/programs/Xserver/Xi/grabdev.c b/xc/programs/Xserver/Xi/grabdev.c
index 4efa9cfab..de6f61012 100644
--- a/xc/programs/Xserver/Xi/grabdev.c
+++ b/xc/programs/Xserver/Xi/grabdev.c
@@ -1,4 +1,4 @@
-/* $XConsortium: xgrabdev.c,v 1.9 90/05/18 11:02:36 rws Exp $ */
+/* $XConsortium: xgrabdev.c,v 1.10 90/05/18 15:32:29 rws Exp $ */
 
 /************************************************************
 Copyright (c) 1989 by Hewlett-Packard Company, Palo Alto, California, and the 
@@ -43,7 +43,6 @@ SOFTWARE.
 extern	int 		IReqCode;
 extern	int		BadDevice;
 extern	int		BadClass;
-extern	InputInfo	inputInfo;
 extern	XExtEventInfo	EventInfo[];
 extern	void		(* ReplySwapVector[256]) ();
 DeviceIntPtr		LookupDeviceIntRec();
@@ -64,6 +63,7 @@ SProcXGrabDevice(client)
 
     REQUEST(xGrabDeviceReq);
     swaps(&stuff->length, n);
+    REQUEST_AT_LEAST_SIZE(xGrabDeviceReq);
     swapl(&stuff->grabWindow, n);
     swapl(&stuff->time, n);
     swaps(&stuff->event_count, n);
diff --git a/xc/programs/Xserver/Xi/grabdevb.c b/xc/programs/Xserver/Xi/grabdevb.c
index e9c1d7952..2b665d99d 100644
--- a/xc/programs/Xserver/Xi/grabdevb.c
+++ b/xc/programs/Xserver/Xi/grabdevb.c
@@ -1,4 +1,4 @@
-/* $XConsortium: xgrabdevb.c,v 1.9 91/05/05 18:29:38 rws Exp $ */
+/* $XConsortium: xgrabdevb.c,v 1.10 92/10/20 17:11:49 rws Exp $ */
 
 /************************************************************
 Copyright (c) 1989 by Hewlett-Packard Company, Palo Alto, California, and the 
@@ -60,6 +60,7 @@ SProcXGrabDeviceButton(client)
 
     REQUEST(xGrabDeviceButtonReq);
     swaps(&stuff->length, n);
+    REQUEST_AT_LEAST_SIZE(xGrabDeviceButtonReq);
     swapl(&stuff->grabWindow, n);
     swaps(&stuff->modifiers, n);
     swaps(&stuff->event_count, n);
diff --git a/xc/programs/Xserver/Xi/grabdevk.c b/xc/programs/Xserver/Xi/grabdevk.c
index 9562832c7..fad357ee1 100644
--- a/xc/programs/Xserver/Xi/grabdevk.c
+++ b/xc/programs/Xserver/Xi/grabdevk.c
@@ -1,4 +1,4 @@
-/* $XConsortium: xgrabdevk.c,v 1.8 91/05/05 18:29:28 rws Exp $ */
+/* $XConsortium: xgrabdevk.c,v 1.9 92/10/20 17:11:52 rws Exp $ */
 
 /************************************************************
 Copyright (c) 1989 by Hewlett-Packard Company, Palo Alto, California, and the 
@@ -62,6 +62,7 @@ SProcXGrabDeviceKey(client)
 
     REQUEST(xGrabDeviceKeyReq);
     swaps(&stuff->length, n);
+    REQUEST_AT_LEAST_SIZE(xGrabDeviceKeyReq);
     swapl(&stuff->grabWindow, n);
     swaps(&stuff->modifiers, n);
     swaps(&stuff->event_count, n);
diff --git a/xc/programs/Xserver/Xi/gtmotion.c b/xc/programs/Xserver/Xi/gtmotion.c
index a839bdafe..95df8cf57 100644
--- a/xc/programs/Xserver/Xi/gtmotion.c
+++ b/xc/programs/Xserver/Xi/gtmotion.c
@@ -1,4 +1,4 @@
-/* $XConsortium: xgtmotion.c,v 1.10 91/07/17 16:38:25 rws Exp $ */
+/* $XConsortium: xgtmotion.c,v 1.11 92/10/20 17:11:55 rws Exp $ */
 
 /************************************************************
 Copyright (c) 1989 by Hewlett-Packard Company, Palo Alto, California, and the 
@@ -57,6 +57,7 @@ register ClientPtr client;
 
     REQUEST(xGetDeviceMotionEventsReq);
     swaps(&stuff->length, n);
+    REQUEST_SIZE_MATCH(xGetDeviceMotionEventsReq);
     swapl(&stuff->start, n);
     swapl(&stuff->stop, n);
     return(ProcXGetDeviceMotionEvents(client));
diff --git a/xc/programs/Xserver/Xi/selectev.c b/xc/programs/Xserver/Xi/selectev.c
index 91afe95e4..6bb9aa015 100644
--- a/xc/programs/Xserver/Xi/selectev.c
+++ b/xc/programs/Xserver/Xi/selectev.c
@@ -1,4 +1,4 @@
-/* $XConsortium: xselectev.c,v 1.8 90/05/18 11:03:13 rws Exp $ */
+/* $XConsortium: xselectev.c,v 1.9 90/05/18 15:35:37 rws Exp $ */
 
 /************************************************************
 Copyright (c) 1989 by Hewlett-Packard Company, Palo Alto, California, and the 
@@ -62,6 +62,7 @@ register ClientPtr client;
 
     REQUEST(xSelectExtensionEventReq);
     swaps(&stuff->length, n);
+    REQUEST_AT_LEAST_SIZE(xSelectExtensionEventReq);
     swapl(&stuff->window, n);
     swaps(&stuff->count, n);
     p = (long *) &stuff[1];
diff --git a/xc/programs/Xserver/Xi/sendexev.c b/xc/programs/Xserver/Xi/sendexev.c
index bce015b00..d9ee4b84b 100644
--- a/xc/programs/Xserver/Xi/sendexev.c
+++ b/xc/programs/Xserver/Xi/sendexev.c
@@ -1,4 +1,4 @@
-/* $XConsortium: xsendexev.c,v 1.6 90/05/18 10:55:24 rws Exp $ */
+/* $XConsortium: xsendexev.c,v 1.7 90/05/18 11:32:30 rws Exp $ */
 
 /************************************************************
 Copyright (c) 1989 by Hewlett-Packard Company, Palo Alto, California, and the 
@@ -65,6 +65,7 @@ SProcXSendExtensionEvent(client)
 
     REQUEST(xSendExtensionEventReq);
     swaps(&stuff->length, n);
+    REQUEST_AT_LEAST_SIZE(xSendExtensionEventReq);
     swapl(&stuff->destination, n);
     swaps(&stuff->count, n);
     eventP = (xEvent *) &stuff[1];
diff --git a/xc/programs/Xserver/Xi/setfocus.c b/xc/programs/Xserver/Xi/setfocus.c
index 47c9769a7..905b23444 100644
--- a/xc/programs/Xserver/Xi/setfocus.c
+++ b/xc/programs/Xserver/Xi/setfocus.c
@@ -1,4 +1,4 @@
-/* $XConsortium: xsetfocus.c,v 1.4 89/12/02 15:21:36 rws Exp $ */
+/* $XConsortium: xsetfocus.c,v 1.5 90/05/18 14:15:11 rws Exp $ */
 
 /************************************************************
 Copyright (c) 1989 by Hewlett-Packard Company, Palo Alto, California, and the 
@@ -59,6 +59,7 @@ SProcXSetDeviceFocus(client)
 
     REQUEST(xSetDeviceFocusReq);
     swaps(&stuff->length, n);
+    REQUEST_SIZE_MATCH(xSetDeviceFocusReq);
     swapl(&stuff->focus, n);
     swapl(&stuff->time, n);
     return(ProcXSetDeviceFocus(client));
diff --git a/xc/programs/Xserver/Xi/ungrdev.c b/xc/programs/Xserver/Xi/ungrdev.c
index 89df0ed90..3addb698a 100644
--- a/xc/programs/Xserver/Xi/ungrdev.c
+++ b/xc/programs/Xserver/Xi/ungrdev.c
@@ -1,4 +1,4 @@
-/* $XConsortium: xungrdev.c,v 1.5 89/10/10 16:11:25 gms Exp $ */
+/* $XConsortium: xungrdev.c,v 1.6 89/12/02 15:21:45 rws Exp $ */
 
 /************************************************************
 Copyright (c) 1989 by Hewlett-Packard Company, Palo Alto, California, and the 
@@ -57,6 +57,7 @@ register ClientPtr client;
 
     REQUEST(xUngrabDeviceReq);
     swaps(&stuff->length, n);
+    REQUEST_SIZE_MATCH(xUngrabDeviceReq);
     swapl(&stuff->time, n);
     return(ProcXUngrabDevice(client));
     }
diff --git a/xc/programs/Xserver/Xi/ungrdevb.c b/xc/programs/Xserver/Xi/ungrdevb.c
index ce9592361..9fa1c8918 100644
--- a/xc/programs/Xserver/Xi/ungrdevb.c
+++ b/xc/programs/Xserver/Xi/ungrdevb.c
@@ -1,4 +1,4 @@
-/* $XConsortium: xungrdevb.c,v 1.7 91/05/05 18:29:43 rws Exp $ */
+/* $XConsortium: xungrdevb.c,v 1.8 92/10/20 17:12:06 rws Exp $ */
 
 /************************************************************
 Copyright (c) 1989 by Hewlett-Packard Company, Palo Alto, California, and the 
@@ -39,6 +39,9 @@ SOFTWARE.
 #include "XI.h"
 #include "XIproto.h"
 
+#define AllModifiersMask ( \
+	ShiftMask | LockMask | ControlMask | Mod1Mask | Mod2Mask | \
+	Mod3Mask | Mod4Mask | Mod5Mask )
 extern	int 	IReqCode;
 extern	int	BadDevice;
 extern	int	DeviceButtonPress;
@@ -59,6 +62,7 @@ SProcXUngrabDeviceButton(client)
 
     REQUEST(xUngrabDeviceButtonReq);
     swaps(&stuff->length, n);
+    REQUEST_SIZE_MATCH(xUngrabDeviceButtonReq);
     swapl(&stuff->grabWindow, n);
     swaps(&stuff->modifiers, n);
     return(ProcXUngrabDeviceButton(client));
@@ -123,6 +127,14 @@ ProcXUngrabDeviceButton(client)
 	return Success;
 	}
 
+    if ((stuff->modifiers != AnyModifier) &&
+	(stuff->modifiers & ~AllModifiersMask))
+	{
+	SendErrorToClient(client, IReqCode, X_UngrabDeviceButton, 0, 
+	    BadValue);
+	return Success;
+	}
+
     temporaryGrab.resource = client->clientAsMask;
     temporaryGrab.device = dev;
     temporaryGrab.window = pWin;
diff --git a/xc/programs/Xserver/Xi/ungrdevk.c b/xc/programs/Xserver/Xi/ungrdevk.c
index bd9b9ce83..407c54313 100644
--- a/xc/programs/Xserver/Xi/ungrdevk.c
+++ b/xc/programs/Xserver/Xi/ungrdevk.c
@@ -1,4 +1,4 @@
-/* $XConsortium: xungrdevk.c,v 1.7 91/05/05 18:29:40 rws Exp $ */
+/* $XConsortium: xungrdevk.c,v 1.8 92/10/20 17:12:09 rws Exp $ */
 
 /************************************************************
 Copyright (c) 1989 by Hewlett-Packard Company, Palo Alto, California, and the 
@@ -39,6 +39,9 @@ SOFTWARE.
 #include "XI.h"
 #include "XIproto.h"
 
+#define AllModifiersMask ( \
+	ShiftMask | LockMask | ControlMask | Mod1Mask | Mod2Mask | \
+	Mod3Mask | Mod4Mask | Mod5Mask )
 extern	int 	IReqCode;
 extern	int	BadDevice;
 extern	void	(* ReplySwapVector[256]) ();
@@ -59,6 +62,7 @@ SProcXUngrabDeviceKey(client)
 
     REQUEST(xUngrabDeviceKeyReq);
     swaps(&stuff->length, n);
+    REQUEST_SIZE_MATCH(xUngrabDeviceKeyReq);
     swapl(&stuff->grabWindow, n);
     swaps(&stuff->modifiers, n);
     return(ProcXUngrabDeviceKey(client));
@@ -121,6 +125,21 @@ ProcXUngrabDeviceKey(client)
 	    BadWindow);
 	return Success;
 	}
+    if (((stuff->key > dev->key->curKeySyms.maxKeyCode) ||
+	 (stuff->key < dev->key->curKeySyms.minKeyCode))
+	&& (stuff->key != AnyKey))
+	{
+	SendErrorToClient(client, IReqCode, X_UngrabDeviceKey, 0, 
+	    BadValue);
+	return Success;
+	}
+    if ((stuff->modifiers != AnyModifier) &&
+	(stuff->modifiers & ~AllModifiersMask))
+	{
+	SendErrorToClient(client, IReqCode, X_UngrabDeviceKey, 0, 
+	    BadValue);
+	return Success;
+	}
 
     temporaryGrab.resource = client->clientAsMask;
     temporaryGrab.device = dev;