Commit c9f8d652 authored by Paul Eggert's avatar Paul Eggert
Browse files

* editfns.c: Integer and memory overflow fixes.

(set_time_zone_rule): Don't assume environment length fits in int.
(message_length): Now ptrdiff_t, not int.
(Fmessage_box): Don't update size until allocation succeeds.
Don't assume message length fits in int.
(Fformat): Use ptrdiff_t, not EMACS_INT, where ptrdiff_t will do.
parent 3d0c92a2
2011-07-28 Paul Eggert <eggert@cs.ucla.edu>
* editfns.c: Integer and memory overflow fixes.
(set_time_zone_rule): Don't assume environment length fits in int.
(message_length): Now ptrdiff_t, not int.
(Fmessage_box): Don't update size until allocation succeeds.
Don't assume message length fits in int.
(Fformat): Use ptrdiff_t, not EMACS_INT, where ptrdiff_t will do.
* doc.c: Integer and memory overflow fixes.
(get_doc_string_buffer_size): Now ptrdiff_t, not int.
(get_doc_string): Check for size calculation overflow.
......
......@@ -2105,7 +2105,7 @@ static char set_time_zone_rule_tz2[] = "TZ=GMT+1";
void
set_time_zone_rule (const char *tzstring)
{
int envptrs;
ptrdiff_t envptrs;
char **from, **to, **newenv;
/* Make the ENVIRON vector longer with room for TZSTRING. */
......@@ -3355,7 +3355,7 @@ usage: (save-restriction &rest BODY) */)
static char *message_text;
/* Allocated length of that buffer. */
static int message_length;
static ptrdiff_t message_length;
DEFUN ("message", Fmessage, Smessage, 1, MANY, 0,
doc: /* Display a message at the bottom of the screen.
......@@ -3437,8 +3437,8 @@ usage: (message-box FORMAT-STRING &rest ARGS) */)
}
if (SBYTES (val) > message_length)
{
message_text = (char *) xrealloc (message_text, SBYTES (val));
message_length = SBYTES (val);
message_text = (char *)xrealloc (message_text, message_length);
}
memcpy (message_text, SDATA (val), SBYTES (val));
message2 (message_text, SBYTES (val),
......@@ -4163,7 +4163,7 @@ usage: (format STRING &rest OBJECTS) */)
character. CONVBYTES says how much room is needed. Allocate
enough room (and then some) and do it again. */
{
EMACS_INT used = p - buf;
ptrdiff_t used = p - buf;
if (max_bufsize - used < convbytes)
string_overflow ();
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment