diff --git a/ChangeLog b/ChangeLog
index e38cfe1..b5bb6b7 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2003-04-27 Richard Frith-Macdonald <rfm@gnu.org>
+
+	* Tools/xpbs.m: ([xSendData:format:items:type:to:]) Fix bug
+	calculating offset into data buffer.  Prevent crashing and
+	provision of garbage data.
+
 2003-04-10 12:12  Alexander Malmberg <alexander@malmberg.org>
 
 	* Source/x11/XWindowBuffer.m (-dealloc): Don't explicitly set the
diff --git a/Tools/xpbs.m b/Tools/xpbs.m
index b287e58..76e1256 100644
--- a/Tools/xpbs.m
+++ b/Tools/xpbs.m
@@ -996,18 +996,19 @@ xErrorHandler(Display *d, XErrorEvent *e)
       int	(*oldHandler)(Display*, XErrorEvent*);
       int	mode = PropModeReplace;
       int	pos = 0;
+      int	maxItems = 4096 * 8 / format;
 
       appendFailure = NO;
       oldHandler = XSetErrorHandler(xErrorHandler);
 
       while (appendFailure == NO && pos < numItems)
 	{
-	  int	maxItems = 4096 * 8 / format;
-
 	  if (pos + maxItems > numItems)
-	    maxItems = numItems - pos;
+	    {
+	      maxItems = numItems - pos;
+	    }
 	  XChangeProperty(xDisplay, window, property,
-	    xType, format, mode, &data[pos*format], maxItems);
+	    xType, format, mode, &data[pos*format/8], maxItems);
 	  mode = PropModeAppend;
 	  pos += maxItems;
 	  XSync(xDisplay, False);
@@ -1015,7 +1016,9 @@ xErrorHandler(Display *d, XErrorEvent *e)
       XFree(data);
       XSetErrorHandler(oldHandler);
       if (appendFailure == NO)
-	status = YES;
+	{
+	  status = YES;
+	}
     }
   return status;
 }