Fix potential corruption in mask_len handling

First: check for allocation failure on the mask.
XI2 requires that the mask is zeroed, so we can't just Data() the mask
provided by the client (it will pad) - we need a tmp buffer. Make sure that
doesn't fail.

Second:
req->mask_len is a uint16_t, so check against malicious mask_lens that would
cause us to corrupt memory on copy, as the code always allocates
req->mask_len * 4, but copies mask->mask_len bytes.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Change size += to size = in XGetDeviceControl

size += blah is technically correct but it implies that we're looping or
otherwise incrementing the size. Which we don't, it's only ever set once.

Change this to avoid reviewer confusion.

Reported-by: Dave "color-me-confused" Airlie <airlied@redhat.com>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
If the XGetDeviceDontPropagateList reply has an invalid length, return 0

If we skip over the reply data, return 0 as number of event classes.

Follow-up to 6dd6dc51a2935c72774be81e5cc2ba2c30e9feff.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Include limits.h to prevent build error: missing INT_MAX

Introduced in 4c8e9bcab459ea5f870d3e56eff15f931807f9b7.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
libXi 1.7.1.901

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>