untrusted comment: verify with openbsd-66-base.pub RWSvK/c+cFe24L8PyzHyOPGzodcQ7LWEvAVuD7Yfix8B1G1BGfnyf1R/rwmyxAqAF3AZBIIwmI/Ig+rKqJJyis2EHW/Pm3F0dAY= OpenBSD 6.6 errata 039, August 07, 2020: The recent security errata 037 broke X11 input methods. Apply by doing: signify -Vep /etc/signify/openbsd-66-base.pub -x 039_ximcp.patch.sig \ -m - | (cd /usr/xenocara && patch -p0) And then compile and rebuild the X11 library cd /usr/xenocara/lib/libX11 make -f Makefile.bsd-wrapper obj make -f Makefile.bsd-wrapper build Index: lib/libX11/modules/im/ximcp/imRmAttr.c =================================================================== RCS file: /cvs/xenocara/lib/libX11/modules/im/ximcp/imRmAttr.c,v retrieving revision 1.9.18.1 diff -u -p -r1.9.18.1 imRmAttr.c --- lib/libX11/modules/im/ximcp/imRmAttr.c 31 Jul 2020 18:43:52 -0000 1.9.18.1 +++ lib/libX11/modules/im/ximcp/imRmAttr.c 4 Aug 2020 19:40:17 -0000 @@ -265,7 +265,7 @@ _XimAttributeToValue( if (num > (USHRT_MAX / sizeof(XIMStyle))) return False; - if ((sizeof(num) + (num * sizeof(XIMStyle))) > data_len) + if ((2 * sizeof(CARD16) + (num * sizeof(CARD32))) > data_len) return False; alloc_len = sizeof(XIMStyles) + sizeof(XIMStyle) * num; if (alloc_len < sizeof(XIMStyles)) @@ -379,7 +379,7 @@ _XimAttributeToValue( if (num > (UINT_MAX / sizeof(XIMHotKeyTrigger))) return False; - if ((sizeof(num) + (num * sizeof(XIMHotKeyTrigger))) > data_len) + if ((2 * sizeof(CARD16) + (num * 3 * sizeof(CARD32))) > data_len) return False; alloc_len = sizeof(XIMHotKeyTriggers) + sizeof(XIMHotKeyTrigger) * num;