Avoid crashing with key-chord (Bug#20223)

src/keyboard.c (read_key_sequence): Don't let
 this_single_command_key_start become negative.
This commit is contained in:
Eli Zaretskii 2015-03-31 17:18:17 +03:00
parent 5a7380aa27
commit f20a2cd9dc
2 changed files with 17 additions and 0 deletions

View file

@ -1,3 +1,8 @@
2015-03-31 Eli Zaretskii <eliz@gnu.org>
* keyboard.c (read_key_sequence): Don't let
this_single_command_key_start become negative. (Bug#20223)
2015-03-29 Jan Djärv <jan.h.d@swipnet.se>
* gtkutil.c (xg_display_open):

View file

@ -9591,6 +9591,18 @@ read_key_sequence (Lisp_Object *keybuf, int bufsize, Lisp_Object prompt,
/* Record what part of this_command_keys is the current key sequence. */
this_single_command_key_start = this_command_key_count - t;
/* When 'input-method-function' called above causes events to be
put on 'unread-post-input-method-events', and as result
'reread' is set to 'true', the value of 't' can become larger
than 'this_command_key_count', because 'add_command_key' is
not called to update 'this_command_key_count'. If this
happens, 'this_single_command_key_start' will become negative
above, and any call to 'this-single-command-keys' will return
a garbled vector. See bug #20223 for one such situation.
Here we force 'this_single_command_key_start' to never become
negative, to avoid that. */
if (this_single_command_key_start < 0)
this_single_command_key_start = 0;
/* Look for this sequence in input-decode-map.
Scan from indec.end until we find a bound suffix. */