--- Canna35b2/server/wconvert.c.orig	2002-11-01 17:21:49.000000000 +0900
+++ Canna35b2/server/wconvert.c	2002-11-01 17:23:25.000000000 +0900
@@ -2096,12 +2096,12 @@
   char *buf = (char *)0;
 
   if (validcontext(cxnum, client, wThrough)) {
-    buf = malloc((int)Request.type20.bufsize);
+    content_size = Request.type20.datalen - (SIZEOFINT * 2 + SIZEOFSHORT);
+    buf = malloc(content_size);
     if (buf) {
-      content_size = Request.type20.datalen - (SIZEOFINT * 2 + SIZEOFSHORT);
       bcopy(Request.type20.buf, buf, content_size);
       stat = size = RkThrough(cxnum, Request.type20.command,
-			      buf, content_size, (int)Request.type20.bufsize);
+			      buf, content_size, content_size);
     }
   }
   retval = SendType6Reply(client, wThrough, EXTPROTO, stat, buf, size);