--- sourceforge.net/trunk/rdesktop/rdpdr.c	2004/02/07 17:32:21	602
+++ sourceforge.net/trunk/rdesktop/rdpdr.c	2004/02/23 10:34:18	613
@@ -1,5 +1,6 @@
 #include <unistd.h>
 #include <sys/types.h>
+#include <sys/time.h>
 #include <time.h>
 #include "rdesktop.h"
 
@@ -81,13 +82,16 @@
 /* Add a new io request to the table containing pending io requests so it won't block rdesktop */
 BOOL
 add_async_iorequest(uint32 device, uint32 file, uint32 id, uint32 major, uint32 length,
-		    DEVICE_FNS * fns, long total_timeout, long interval_timeout, uint8 * buffer)
+		    DEVICE_FNS * fns, uint32 total_timeout, uint32 interval_timeout, uint8 * buffer,
+		    uint32 offset)
 {
 	struct async_iorequest *iorq;
 
 	if (g_iorequest == NULL)
 	{
 		g_iorequest = (struct async_iorequest *) xmalloc(sizeof(struct async_iorequest));
+		if (!g_iorequest)
+			return False;
 		g_iorequest->fd = 0;
 		g_iorequest->next = NULL;
 	}
@@ -101,6 +105,8 @@
 		{
 			iorq->next =
 				(struct async_iorequest *) xmalloc(sizeof(struct async_iorequest));
+			if (!iorq->next)
+				return False;
 			iorq->next->fd = 0;
 			iorq->next->next = NULL;
 		}
@@ -116,6 +122,7 @@
 	iorq->timeout = total_timeout;
 	iorq->itv_timeout = interval_timeout;
 	iorq->buffer = buffer;
+	iorq->offset = offset;
 	return True;
 }
 
@@ -387,6 +394,11 @@
 			if (rw_blocking)	// Complete read immediately
 			{
 				buffer = (uint8 *) xrealloc((void *) buffer, length);
+				if (!buffer)
+				{
+					status = STATUS_CANCELLED;
+					break;
+				}
 				status = fns->read(file, buffer, length, offset, &result);
 				buffer_len = result;
 				break;
@@ -394,10 +406,15 @@
 
 			// Add request to table
 			pst_buf = (uint8 *) xmalloc(length);
+			if (!pst_buf)
+			{
+				status = STATUS_CANCELLED;
+				break;
+			}
 			serial_get_timeout(file, length, &total_timeout, &interval_timeout);
 			if (add_async_iorequest
 			    (device, file, id, major, length, fns, total_timeout, interval_timeout,
-			     pst_buf))
+			     pst_buf, offset))
 			{
 				status = STATUS_PENDING;
 				break;
@@ -429,10 +446,16 @@
 
 			// Add to table
 			pst_buf = (uint8 *) xmalloc(length);
+			if (!pst_buf)
+			{
+				status = STATUS_CANCELLED;
+				break;
+			}
+
 			in_uint8a(s, pst_buf, length);
 
 			if (add_async_iorequest
-			    (device, file, id, major, length, fns, 0, 0, pst_buf))
+			    (device, file, id, major, length, fns, 0, 0, pst_buf, offset))
 			{
 				status = STATUS_PENDING;
 				break;
@@ -552,6 +575,12 @@
 			in_uint8s(s, 0x14);
 
 			buffer = (uint8 *) xrealloc((void *) buffer, bytes_out + 0x14);
+			if (!buffer)
+			{
+				status = STATUS_CANCELLED;
+				break;
+			}
+
 			out.data = out.p = buffer;
 			out.size = sizeof(buffer);
 			status = fns->device_control(file, request, s, &out);
@@ -567,8 +596,9 @@
 	{
 		rdpdr_send_completion(device, id, status, result, buffer, buffer_len);
 	}
-	xfree(buffer);
-
+	if (buffer)
+		xfree(buffer);
+	buffer = NULL;
 }
 
 void
@@ -687,7 +717,7 @@
 void
 rdpdr_add_fds(int *n, fd_set * rfds, fd_set * wfds, struct timeval *tv, BOOL * timeout)
 {
-	long select_timeout = 0;	// Timeout value to be used for select() (in millisecons).
+	uint32 select_timeout = 0;	// Timeout value to be used for select() (in millisecons).
 	struct async_iorequest *iorq;
 
 	iorq = g_iorequest;
@@ -766,8 +796,9 @@
 						/* never read larger chunks than 8k - chances are that it will block */
 						status = fns->read(iorq->fd,
 								   iorq->buffer + iorq->partial_len,
-								   req_size, 0, &result);
+								   req_size, iorq->offset, &result);
 						iorq->partial_len += result;
+						iorq->offset += result;
 
 #if WITH_DEBUG_RDP5
 						DEBUG(("RDPDR: %d bytes of data read\n", result));
@@ -817,9 +848,10 @@
 						/* never write larger chunks than 8k - chances are that it will block */
 						status = fns->write(iorq->fd,
 								    iorq->buffer +
-								    iorq->partial_len, req_size, 0,
-								    &result);
+								    iorq->partial_len, req_size,
+								    iorq->offset, &result);
 						iorq->partial_len += result;
+						iorq->offset += result;
 #if WITH_DEBUG_RDP5
 						DEBUG(("RDPDR: %d bytes of data written\n",
 						       result));
@@ -836,8 +868,8 @@
 							status = STATUS_SUCCESS;
 							rdpdr_send_completion(iorq->device,
 									      iorq->id, status,
-									      iorq->partial_len, (uint8*)"",
-									      1);
+									      iorq->partial_len,
+									      (uint8 *) "", 1);
 
 							xfree(iorq->buffer);
 							iorq->fd = 0;
@@ -881,7 +913,8 @@
 		if ((iorq->fd == fd) && (major == 0 || iorq->major == major))
 		{
 			result = 0;
-			rdpdr_send_completion(iorq->device, iorq->id, status, result, (uint8*)"", 1);
+			rdpdr_send_completion(iorq->device, iorq->id, status, result, (uint8 *) "",
+					      1);
 			xfree(iorq->buffer);
 			iorq->fd = 0;
 			if (prev != NULL)