diff --git a/dlls/gdi32/driver.c b/dlls/gdi32/driver.c
index 6b684992e37..82706c36fe4 100644
--- a/dlls/gdi32/driver.c
+++ b/dlls/gdi32/driver.c
@@ -1101,9 +1101,11 @@ INT WINAPI Escape( HDC hdc, INT escape, INT in_count, LPCSTR in_data, LPVOID out
 
     case QUERYESCSUPPORT:
         {
-            const INT *ptr = (const INT *)in_data;
-            if (in_count < sizeof(INT)) return 0;
-            switch(*ptr)
+            DWORD code;
+
+            if (in_count < sizeof(SHORT)) return 0;
+            code = (in_count < sizeof(DWORD)) ? *(const USHORT *)in_data : *(const DWORD *)in_data;
+            switch (code)
             {
             case ABORTDOC:
             case ENDDOC:
diff --git a/dlls/wineps.drv/escape.c b/dlls/wineps.drv/escape.c
index d2a8d2a6eaa..6e898377721 100644
--- a/dlls/wineps.drv/escape.c
+++ b/dlls/wineps.drv/escape.c
@@ -66,15 +66,18 @@ INT PSDRV_ExtEscape( PHYSDEV dev, INT nEscape, INT cbInput, LPCVOID in_data,
 {
     PSDRV_PDEVICE *physDev = get_psdrv_dev( dev );
 
+    TRACE("%p,%d,%d,%p,%d,%p\n",
+          dev->hdc, nEscape, cbInput, in_data, cbOutput, out_data);
+
     switch(nEscape)
     {
     case QUERYESCSUPPORT:
-        if(cbInput < sizeof(INT))
+        if(cbInput < sizeof(SHORT))
         {
-	    WARN("cbInput < sizeof(INT) (=%d) for QUERYESCSUPPORT\n", cbInput);
+	    WARN("cbInput < sizeof(SHORT) (=%d) for QUERYESCSUPPORT\n", cbInput);
 	    return 0;
 	} else {
-	    UINT num = *(const UINT *)in_data;
+	    DWORD num = (cbInput < sizeof(DWORD)) ? *(const USHORT *)in_data : *(const DWORD *)in_data;
 	    TRACE("QUERYESCSUPPORT for %d\n", num);
 
 	    switch(num) {
diff --git a/dlls/winex11.drv/init.c b/dlls/winex11.drv/init.c
index 7cf318f5ded..8f8ff09510a 100644
--- a/dlls/winex11.drv/init.c
+++ b/dlls/winex11.drv/init.c
@@ -316,7 +316,7 @@ static INT X11DRV_ExtEscape( PHYSDEV dev, INT escape, INT in_count, LPCVOID in_d
     switch(escape)
     {
     case QUERYESCSUPPORT:
-        if (in_data)
+        if (in_data && in_count >= sizeof(DWORD))
         {
             switch (*(const INT *)in_data)
             {