diff -Naur x11vnc-0.9.13-ori/x11vnc/win_utils.c x11vnc-0.9.13/x11vnc/win_utils.c --- x11vnc-0.9.13-ori/x11vnc/win_utils.c 2016-10-07 23:26:03.248600761 +0200 +++ x11vnc-0.9.13/x11vnc/win_utils.c 2016-10-07 23:26:51.919256706 +0200 @@ -262,8 +262,8 @@ } last_snap = now; - if (num > stack_list_len + blackouts) { - int n = 2*num; + if (num + blackouts > stack_list_len) { + int n = 2 * (num + blackouts); free(stack_list); stack_list = (winattr_t *) malloc(n*sizeof(winattr_t)); stack_list_len = n; diff -Naur x11vnc-0.9.13-ori/x11vnc/xrecord.c x11vnc-0.9.13/x11vnc/xrecord.c --- x11vnc-0.9.13-ori/x11vnc/xrecord.c 2016-10-07 23:26:03.248600761 +0200 +++ x11vnc-0.9.13/x11vnc/xrecord.c 2016-10-07 23:27:49.566700470 +0200 @@ -964,7 +964,7 @@ data = (char *)req; data += sz_xConfigureWindowReq; - for (i=0; ilength; i++) { + for (i = 0; i < req->length - sz_xConfigureWindowReq / 4 && i < 4; i++) { unsigned int v; /* * We use unsigned int for the values. There were