diff --git a/randr/rrproviderproperty.c b/randr/rrproviderproperty.c
index d6e0d5788..82174fc3a 100644
--- a/randr/rrproviderproperty.c
+++ b/randr/rrproviderproperty.c
@@ -166,7 +166,8 @@ RRChangeProviderProperty(RRProviderPtr provider, Atom property, Atom type,
 
     if (mode == PropModeReplace || len > 0) {
         void *new_data = NULL, *old_data = NULL;
-
+        if (total_len > MAXINT / size_in_bytes)
+            return BadValue;
         total_size = total_len * size_in_bytes;
         new_value.data = calloc(1, total_size);
         if (!new_value.data && total_size) {