procyberian/emacs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

* insdel.c (replace_range): Fix buf overflow when insbytes < outgoing.

Browse source
This commit is contained in:
Paul Eggert 2011-06-15 23:57:02 -07:00
parent 9956144405
commit 599a9e4f7c
2 changed files with 6 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/ChangeLog
View file

@ -1,5 +1,7 @@
2011-06-16 Paul Eggert <eggert@cs.ucla.edu>
* insdel.c (replace_range): Fix buf overflow when insbytes < outgoing.
* insdel.c, lisp.h (buffer_overflow): New function.
(insert_from_buffer_1, replace_range, replace_range_2):
* insdel.c (make_gap_larger):

8
src/insdel.c
View file

@ -1354,8 +1354,8 @@ replace_range (EMACS_INT from, EMACS_INT to, Lisp_Object new,
= count_size_as_multibyte (SDATA (new), insbytes);
/* Make sure point-max won't overflow after this insertion. */
XSETINT (temp, Z_BYTE - nbytes_del + insbytes);
if (Z_BYTE - nbytes_del + insbytes != XINT (temp))
XSETINT (temp, Z_BYTE - nbytes_del + outgoing_insbytes);
if (Z_BYTE - nbytes_del + outgoing_insbytes != XINT (temp))
buffer_overflow ();
GCPRO1 (new);
@ -1389,8 +1389,8 @@ replace_range (EMACS_INT from, EMACS_INT to, Lisp_Object new,
if (Z - GPT < END_UNCHANGED)
END_UNCHANGED = Z - GPT;
if (GAP_SIZE < insbytes)
make_gap (insbytes - GAP_SIZE);
if (GAP_SIZE < outgoing_insbytes)
make_gap (outgoing_insbytes - GAP_SIZE);
/* Copy the string text into the buffer, perhaps converting
between single-byte and multibyte. */