Regression in 1.6.10

Introduced by 388b303c .

In particular, 388b303c and 388b303c.

For both lines, data_len is the readable data length in bytes. However, the LHS uses the result data type (XIMStyle and XIMHotKeyTrigger) instead of the read data type (CARD32 and 3x CARD32), i.e.

diff --git a/modules/im/ximcp/imRmAttr.c b/modules/im/ximcp/imRmAttr.c
index 2491908e..10be5619 100644
--- a/modules/im/ximcp/imRmAttr.c
+++ b/modules/im/ximcp/imRmAttr.c
@@ -265,7 +265,7 @@ _XimAttributeToValue(

            if (num > (USHRT_MAX / sizeof(XIMStyle)))
                return False;
-           if ((sizeof(num) + (num * sizeof(XIMStyle))) > data_len)
+           if ((sizeof(num) + (num * sizeof(CARD32))) > data_len)
                return False;
            alloc_len = sizeof(XIMStyles) + sizeof(XIMStyle) * num;
            if (alloc_len < sizeof(XIMStyles))
@@ -379,7 +379,7 @@ _XimAttributeToValue(

            if (num > (UINT_MAX / sizeof(XIMHotKeyTrigger)))
                return False;
-           if ((sizeof(num) + (num * sizeof(XIMHotKeyTrigger))) > data_len)
+           if ((sizeof(num) + (num * 3 * sizeof(CARD32))) > data_len)
                return False;
            alloc_len = sizeof(XIMHotKeyTriggers)
                      + sizeof(XIMHotKeyTrigger) * num;

---

As a side note, I believe the correct version for the sizeof(num) is 2 * sizeof(CARD16) since this is the offset in data the array of data starts.