diff --git a/glx/single2.c b/glx/single2.c
index 0b734b6712..7d677d9413 100644
--- a/glx/single2.c
+++ b/glx/single2.c
@@ -63,6 +63,10 @@ __glXDisp_FeedbackBuffer(__GLXclientState * cl, GLbyte * pc)
     pc += __GLX_SINGLE_HDR_SIZE;
     size = *(GLsizei *) (pc + 0);
     type = *(GLenum *) (pc + 4);
+    if (size < 0) {
+        cl->client->errorValue = size;
+        return BadValue;
+    }
     if (cx->feedbackBufSize < size) {
         cx->feedbackBuf = reallocarray(cx->feedbackBuf,
                                        (size_t) size, __GLX_SIZE_FLOAT32);
@@ -93,6 +97,10 @@ __glXDisp_SelectBuffer(__GLXclientState * cl, GLbyte * pc)
 
     pc += __GLX_SINGLE_HDR_SIZE;
     size = *(GLsizei *) (pc + 0);
+    if (size < 0) {
+        cl->client->errorValue = size;
+        return BadValue;
+    }
     if (cx->selectBufSize < size) {
         cx->selectBuf = reallocarray(cx->selectBuf,
                                      (size_t) size, __GLX_SIZE_CARD32);
diff --git a/glx/single2swap.c b/glx/single2swap.c
index b672dcc952..516716e62e 100644
--- a/glx/single2swap.c
+++ b/glx/single2swap.c
@@ -61,6 +61,10 @@ __glXDispSwap_FeedbackBuffer(__GLXclientState * cl, GLbyte * pc)
     swapl((CARD32*)(pc + 4));
     size = *(GLsizei *) (pc + 0);
     type = *(GLenum *) (pc + 4);
+    if (size < 0) {
+        cl->client->errorValue = size;
+        return BadValue;
+    }
     if (cx->feedbackBufSize < size) {
         cx->feedbackBuf = reallocarray(cx->feedbackBuf,
                                        (size_t) size, __GLX_SIZE_FLOAT32);
@@ -93,6 +97,10 @@ __glXDispSwap_SelectBuffer(__GLXclientState * cl, GLbyte * pc)
     pc += __GLX_SINGLE_HDR_SIZE;
     swapl((CARD32*)(pc + 0));
     size = *(GLsizei *) (pc + 0);
+    if (size < 0) {
+        cl->client->errorValue = size;
+        return BadValue;
+    }
     if (cx->selectBufSize < size) {
         cx->selectBuf = reallocarray(cx->selectBuf,
                                      (size_t) size, __GLX_SIZE_CARD32);