diff --git a/dbe/dbe.c b/dbe/dbe.c
index 5b43dd1..8fef5bd 100644
--- a/dbe/dbe.c
+++ b/dbe/dbe.c
@@ -39,6 +39,11 @@ #include <dix-config.h>
 #endif
 
 #include <string.h>
+#if HAVE_STDINT_T
+#include <stdint.h>
+#else
+#define UINT32_MAX 0xffffffffU
+#endif
 
 #include <X11/X.h>
 #include <X11/Xproto.h>
@@ -713,6 +718,9 @@ ProcDbeSwapBuffers(ClientPtr client)
         return(Success);
     }
 
+    if (nStuff > UINT32_MAX / sizeof(DbeSwapInfoRec))
+	    return BadAlloc;
+
     /* Get to the swap info appended to the end of the request. */
     dbeSwapInfo = (xDbeSwapInfo *)&stuff[1];
 
@@ -876,6 +884,8 @@ ProcDbeGetVisualInfo(ClientPtr client)
 
     REQUEST_AT_LEAST_SIZE(xDbeGetVisualInfoReq);
 
+    if (stuff->n > UINT32_MAX / sizeof(DrawablePtr))
+	    return BadAlloc;
     /* Make sure any specified drawables are valid. */
     if (stuff->n != 0)
     {
diff --git a/render/render.c b/render/render.c
index e4d8d6b..b539b6e 100644
--- a/render/render.c
+++ b/render/render.c
@@ -47,6 +47,12 @@ #include "glyphstr.h"
 #include <X11/Xfuncproto.h>
 #include "cursorstr.h"
 
+#if HAVE_STDINT_H
+#include <stdint.h>
+#else 
+#define UINT32_MAX 0xffffffffU
+#endif
+
 static int ProcRenderQueryVersion (ClientPtr pClient);
 static int ProcRenderQueryPictFormats (ClientPtr pClient);
 static int ProcRenderQueryPictIndexValues (ClientPtr pClient);
@@ -1103,6 +1109,9 @@ ProcRenderAddGlyphs (ClientPtr client)
     }
 
     nglyphs = stuff->nglyphs;
+    if (nglyphs > UINT32_MAX / sizeof(GlyphNewRec))
+	    return BadAlloc;
+
     if (nglyphs <= NLOCALGLYPH)
 	glyphsBase = glyphsLocal;
     else