Fix unsafe SDATA usage in print.c (bug#78590)

* src/print.c (print_string_1): Renamed from 'print_string', with an
extra argument to disable nonascii escaping.
(print_string): New function.
(print_object): Use 'print_string_1', not 'strout'.

(cherry picked from commit d14fc6b75f128ed538c123ec79bd3d955ca9bf70)

diff --git a/src/print.c b/src/print.c
index b17ec337f70af48fea740e689f5266abbb18e98e..b6ee89478c7a075caf9c0f737609d8a2f825033c 100644 (file)
--- a/src/print.c
+++ b/src/print.c
@@ -469,18 +469,18 @@ strout (const char *ptr, ptrdiff_t size, ptrdiff_t size_byte,
    because printing one char can relocate.  */
 
 static void
-print_string (Lisp_Object string, Lisp_Object printcharfun)
+print_string_1 (Lisp_Object string, Lisp_Object printcharfun, bool escape_nonascii)
 {
   if (EQ (printcharfun, Qt) || NILP (printcharfun))
     {
       ptrdiff_t chars;
 
-      if (print_escape_nonascii)
+      if (escape_nonascii)
        string = string_escape_byte8 (string);
 
       if (STRING_MULTIBYTE (string))
        chars = SCHARS (string);
-      else if (! print_escape_nonascii
+      else if (! escape_nonascii
               && (EQ (printcharfun, Qt)
                   ? ! NILP (BVAR (&buffer_defaults, enable_multibyte_characters))
                   : ! NILP (BVAR (current_buffer, enable_multibyte_characters))))
@@ -543,6 +543,12 @@ print_string (Lisp_Object string, Lisp_Object printcharfun)
          }
     }
 }
+
+static void
+print_string (Lisp_Object string, Lisp_Object printcharfun)
+{
+  print_string_1 (string, printcharfun, print_escape_nonascii);
+}
 \f
 DEFUN ("write-char", Fwrite_char, Swrite_char, 1, 2, 0,
        doc: /* Output character CHARACTER to stream PRINTCHARFUN.
@@ -2282,7 +2288,7 @@ print_object (Lisp_Object obj, Lisp_Object printcharfun, bool escapeflag)
        }
       else if (STRINGP (num))
        {
-         strout (SSDATA (num), SCHARS (num), SBYTES (num), printcharfun);
+         print_string_1 (num, printcharfun, false);
          goto next_obj;
        }
     }

diff --git a/test/src/print-tests.el b/test/src/print-tests.el
index af57311135bfea82eeb51daccb8e66f719d75fcd..036248fd09107c5aa09d3a00463bd8014569690a 100644 (file)
--- a/test/src/print-tests.el
+++ b/test/src/print-tests.el
@@ -540,5 +540,23 @@ otherwise, use a different charset."
       (should (eq callback-buffer buffer))
       (should (equal str "tata"))))
 
+(ert-deftest test-print-number-realloc ()
+  ;; Test for bug#78590.  Note that this may in rare cases crash unfixed
+  ;; Emacs versions.
+  (let ((print-circle t)
+        (print-number-table (make-hash-table))
+        (print-continuous-numbering t)
+        (str "yy")
+        (outstr ""))
+    (garbage-collect)
+    (ignore (make-string 100 ?a))
+    (puthash str (make-string 3 ?x) print-number-table)
+    (prin1 str
+           (lambda (c)
+             (setq outstr (concat outstr (string c)))
+             (garbage-collect)
+             (ignore (make-string 100 ?b))))
+    (should (equal outstr "xxx"))))
+
 (provide 'print-tests)
 ;;; print-tests.el ends here