diff --git a/Xext/panoramiXprocs.c b/Xext/panoramiXprocs.c
index f928660e6..26f03aa0a 100644
--- a/Xext/panoramiXprocs.c
+++ b/Xext/panoramiXprocs.c
@@ -1399,6 +1399,8 @@ PanoramiXPolyPoint(ClientPtr client)
     npoint = bytes_to_int32((client->req_len << 2) - sizeof(xPolyPointReq));
     if (npoint > 0) {
         origPts = xallocarray(npoint, sizeof(xPoint));
+        if (!origPts)
+            return BadAlloc;
         memcpy((char *) origPts, (char *) &stuff[1], npoint * sizeof(xPoint));
         FOR_NSCREENS_FORWARD(j) {
 
@@ -1464,6 +1466,8 @@ PanoramiXPolyLine(ClientPtr client)
     npoint = bytes_to_int32((client->req_len << 2) - sizeof(xPolyLineReq));
     if (npoint > 0) {
         origPts = xallocarray(npoint, sizeof(xPoint));
+        if (!origPts)
+            return BadAlloc;
         memcpy((char *) origPts, (char *) &stuff[1], npoint * sizeof(xPoint));
         FOR_NSCREENS_FORWARD(j) {
 
@@ -1533,6 +1537,8 @@ PanoramiXPolySegment(ClientPtr client)
     nsegs >>= 3;
     if (nsegs > 0) {
         origSegs = xallocarray(nsegs, sizeof(xSegment));
+        if (!origSegs)
+            return BadAlloc;
         memcpy((char *) origSegs, (char *) &stuff[1], nsegs * sizeof(xSegment));
         FOR_NSCREENS_FORWARD(j) {
 
@@ -1601,6 +1607,8 @@ PanoramiXPolyRectangle(ClientPtr client)
     nrects >>= 3;
     if (nrects > 0) {
         origRecs = xallocarray(nrects, sizeof(xRectangle));
+        if (!origRecs)
+            return BadAlloc;
         memcpy((char *) origRecs, (char *) &stuff[1],
                nrects * sizeof(xRectangle));
         FOR_NSCREENS_FORWARD(j) {
@@ -1668,6 +1676,8 @@ PanoramiXPolyArc(ClientPtr client)
     narcs /= sizeof(xArc);
     if (narcs > 0) {
         origArcs = xallocarray(narcs, sizeof(xArc));
+        if (!origArcs)
+            return BadAlloc;
         memcpy((char *) origArcs, (char *) &stuff[1], narcs * sizeof(xArc));
         FOR_NSCREENS_FORWARD(j) {
 
@@ -1730,6 +1740,8 @@ PanoramiXFillPoly(ClientPtr client)
     count = bytes_to_int32((client->req_len << 2) - sizeof(xFillPolyReq));
     if (count > 0) {
         locPts = xallocarray(count, sizeof(DDXPointRec));
+        if (!locPts)
+            return BadAlloc;
         memcpy((char *) locPts, (char *) &stuff[1],
                count * sizeof(DDXPointRec));
         FOR_NSCREENS_FORWARD(j) {
@@ -1799,6 +1811,8 @@ PanoramiXPolyFillRectangle(ClientPtr client)
     things >>= 3;
     if (things > 0) {
         origRects = xallocarray(things, sizeof(xRectangle));
+        if (!origRects)
+            return BadAlloc;
         memcpy((char *) origRects, (char *) &stuff[1],
                things * sizeof(xRectangle));
         FOR_NSCREENS_FORWARD(j) {
@@ -1866,6 +1880,8 @@ PanoramiXPolyFillArc(ClientPtr client)
     narcs /= sizeof(xArc);
     if (narcs > 0) {
         origArcs = xallocarray(narcs, sizeof(xArc));
+        if (!origArcs)
+            return BadAlloc;
         memcpy((char *) origArcs, (char *) &stuff[1], narcs * sizeof(xArc));
         FOR_NSCREENS_FORWARD(j) {
 
diff --git a/Xext/sync.c b/Xext/sync.c
index c13ae0039..8fc4280be 100644
--- a/Xext/sync.c
+++ b/Xext/sync.c
@@ -1012,6 +1012,12 @@ SyncCreateSystemCounter(const char *name,
         pCounter->pSysCounterInfo = psci;
         psci->pCounter = pCounter;
         psci->name = strdup(name);
+        if (!psci->name) {
+            pCounter->pSysCounterInfo = NULL;
+            free(psci);
+            FreeResource(pCounter->sync.id, X11_RESTYPE_NONE);
+            return NULL;
+        }
         psci->resolution = resolution;
         psci->counterType = counterType;
         psci->QueryValue = QueryValue;
@@ -1170,7 +1176,7 @@ FreeCounter(void *env, XID id)
             pnext = ptl->next;
             free(ptl); /* destroy the trigger list as we go */
         }
-        if (IsSystemCounter(pCounter)) {
+        if (IsSystemCounter(pCounter) && pCounter->pSysCounterInfo) {
             xorg_list_del(&pCounter->pSysCounterInfo->entry);
             free(pCounter->pSysCounterInfo->name);
             free(pCounter->pSysCounterInfo->private);
diff --git a/Xext/xres.c b/Xext/xres.c
index a8c9cd01a..9c215aeec 100644
--- a/Xext/xres.c
+++ b/Xext/xres.c
@@ -312,6 +312,8 @@ ProcXResQueryClientResources(ClientPtr client)
     }
 
     counts = calloc(lastResourceType + 1, sizeof(int));
+    if (!counts)
+        return BadAlloc;
 
     FindAllClientResources(clients[clientID], ResFindAllRes, counts);