gcc compiles `p + length < p' into 'length < 0' since pointer overflow is undefined behavior in C. This breaks the check against a large `length'. Use `length > pend - p' instead. There's no need to check `length < 0' since `length' is from length_decode() and should be non-negative. === Try the simplified code. void bar(void); void foo(unsigned char *p, int length) { if (p + length < p) bar(); } $ gcc -S -o - t.c -O2 ... foo: .LFB0: .cfi_startproc testl %esi, %esi js .L4 rep ret .L4: jmp bar .cfi_endproc Clearly `p' is not used at all. R=rsc CC=plan9port.codebot https://codereview.appspot.com/7231069

R=rsc https://codereview.appspot.com/7565045

For single-button mouse users. R=rsc https://codereview.appspot.com/7620043

R=rsc https://codereview.appspot.com/7304064

Ubuntu Precise seems to have a buggy X server that sometimes fails at XCopyArea. Let devdraw do it itself. This will slow down remote X a little bit, but slow and correct is better than fast and broken. R=rsc https://codereview.appspot.com/7310069

R=rsc CC=plan9port.codebot https://codereview.appspot.com/7228044

R=rsc CC=plan9port.codebot https://codereview.appspot.com/7225059

R=rsc https://codereview.appspot.com/7095050

R=rsc https://codereview.appspot.com/7225073

R=rsc https://codereview.appspot.com/7070070

R=rsc https://codereview.appspot.com/7029054

R=rsc https://codereview.appspot.com/7027044

R=rsc CC=plan9port.codebot https://codereview.appspot.com/6850108

R=rsc http://codereview.appspot.com/6906057