Commit a65c0929 authored by Paul Eggert's avatar Paul Eggert

Fix integer overflow in oversize vectors

* src/alloc.c (allocate_vector): Fix integer overflow when
allocating very large vectors, by taking large_vector_offset
into account.  Assume C99.
parent 9b099ce5
Pipeline #227 failed with stage
in 5 minutes and 25 seconds
......@@ -3388,12 +3388,11 @@ allocate_vectorlike (ptrdiff_t len)
struct Lisp_Vector *
allocate_vector (EMACS_INT len)
{
struct Lisp_Vector *v;
ptrdiff_t nbytes_max = min (PTRDIFF_MAX, SIZE_MAX);
if (min ((nbytes_max - header_size) / word_size, MOST_POSITIVE_FIXNUM) < len)
ptrdiff_t wordbytes_max = (min (PTRDIFF_MAX, SIZE_MAX)
- header_size - large_vector_offset);
if (min (wordbytes_max / word_size, MOST_POSITIVE_FIXNUM) < len)
memory_full (SIZE_MAX);
v = allocate_vectorlike (len);
struct Lisp_Vector *v = allocate_vectorlike (len);
if (len)
v->header.size = len;
return v;
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment