libXrender: Multiple integer overflows leading to heap-based bufer overflows

Multiple integer overflows in X.org libXrender 0.9.7 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the 1 XRenderQueryFilters, 2 XRenderQueryFormats, and 3 XRenderQueryPictIndexValues functions...