procyberian/emacs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix stack overflow in string creation (Bug#6214).

Browse source 
* character.c (Fstring, Funibyte_string): Use SAFE_ALLOCA to
prevent stack overflow if number of arguments is too large
(Bug#6214).
This commit is contained in:
Chong Yidong 2010-05-18 14:05:43 -04:00
commit 60dd06a082
2 changed files with 26 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
src/ChangeLog
View file

@ -1,3 +1,9 @@
2010-05-18 Chong Yidong <cyd@stupidchicken.com>
* character.c (Fstring, Funibyte_string): Use SAFE_ALLOCA to
prevent stack overflow if number of arguments is too large
(Bug#6214).
2010-05-18 Juanma Barranquero <lekktu@gmail.com>
* charset.c (load_charset_map_from_file): Don't call close after fclose.

30
src/character.c
View file

@ -961,10 +961,13 @@ usage: (string &rest CHARACTERS) */)
int n;
Lisp_Object *args;
{
int i;
unsigned char *buf = (unsigned char *) alloca (MAX_MULTIBYTE_LENGTH * n);
unsigned char *p = buf;
int c;
int i, c;
unsigned char *buf, *p;
Lisp_Object str;
USE_SAFE_ALLOCA;
SAFE_ALLOCA (buf, unsigned char *, MAX_MULTIBYTE_LENGTH * n);
p = buf;
for (i = 0; i < n; i++)
{
@ -973,7 +976,9 @@ usage: (string &rest CHARACTERS) */)
p += CHAR_STRING (c, p);
}
return make_string_from_bytes ((char *) buf, n, p - buf);
str = make_string_from_bytes ((char *) buf, n, p - buf);
SAFE_FREE ();
return str;
}
DEFUN ("unibyte-string", Funibyte_string, Sunibyte_string, 0, MANY, 0,
@ -983,10 +988,13 @@ usage: (unibyte-string &rest BYTES) */)
int n;
Lisp_Object *args;
{
int i;
unsigned char *buf = (unsigned char *) alloca (n);
unsigned char *p = buf;
unsigned c;
int i, c;
unsigned char *buf, *p;
Lisp_Object str;
USE_SAFE_ALLOCA;
SAFE_ALLOCA (buf, unsigned char *, n);
p = buf;
for (i = 0; i < n; i++)
{
@ -997,7 +1005,9 @@ usage: (unibyte-string &rest BYTES) */)
*p++ = c;
}
return make_string_from_bytes ((char *) buf, n, p - buf);
str = make_string_from_bytes ((char *) buf, n, p - buf);
SAFE_FREE ();
return str;
}
DEFUN ("char-resolve-modifiers", Fchar_resolve_modifiers,