Minor integer overflow fixes.

* window.c (Fset_window_new_pixel): Don't let new_pixel go negative.
This improves on the previous fix to this function.
(window_resize_check): When summing up pixel counts, don't rely on
undefined behavior if the sum overflows.

Fixes: debbugs:16033

diff --git a/src/ChangeLog b/src/ChangeLog
index bdd111f5083843e0891f6f6a6c3b1e3f3f492732..44039f83d8b56c13a1971613f76d92403b2ea08a 100644 (file)
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,11 @@
+2013-12-03  Paul Eggert  <eggert@cs.ucla.edu>
+
+       Minor integer overflow fixes (Bug#16033).
+       * window.c (Fset_window_new_pixel): Don't let new_pixel go negative.
+       This improves on the previous fix to this function.
+       (window_resize_check): When summing up pixel counts, don't rely on
+       undefined behavior if the sum overflows.
+
 2013-12-03  Martin Rudalics  <rudalics@gmx.at>
 
        * window.c (Fset_window_new_pixel): Don't choke at negative

diff --git a/src/window.c b/src/window.c
index 1ef2b4a0e382e423c6241c1bc54cf09d7b0542a6..b7d4502e3ecf9e7a363f71c55e20c65b720e3c4d 100644 (file)
--- a/src/window.c
+++ b/src/window.c
@@ -3646,10 +3646,8 @@ Note: This function does not operate on any child windows of WINDOW.  */)
   (Lisp_Object window, Lisp_Object size, Lisp_Object add)
 {
   struct window *w = decode_valid_window (window);
-  EMACS_INT size_min = (max (INT_MIN, MOST_NEGATIVE_FIXNUM)
-                       + (NILP (add) ? 0 : XINT (w->new_pixel)));
-  EMACS_INT size_max = (min (INT_MAX, MOST_POSITIVE_FIXNUM)
-                       - (NILP (add) ? 0 : XINT (w->new_pixel)));
+  EMACS_INT size_min = NILP (add) ? 0 : - XINT (w->new_pixel);
+  EMACS_INT size_max = size_min + min (INT_MAX, MOST_POSITIVE_FIXNUM);
 
   CHECK_RANGED_INTEGER (size, size_min, size_max);
   if (NILP (add))
@@ -3729,18 +3727,20 @@ window_resize_check (struct window *w, bool horflag)
        /* The sum of the heights of the child windows of W must equal
           W's height.  */
        {
-         int sum_of_pixels = 0;
+         int remaining_pixels = XINT (w->new_pixel);
 
          while (c)
            {
              if (!window_resize_check (c, horflag))
                return 0;
 
-             sum_of_pixels = sum_of_pixels + XINT (c->new_pixel);
+             remaining_pixels -= XINT (c->new_pixel);
+             if (remaining_pixels < 0)
+               return 0;
              c = NILP (c->next) ? 0 : XWINDOW (c->next);
            }
 
-         return (sum_of_pixels == XINT (w->new_pixel));
+         return remaining_pixels == 0;
        }
     }
   else if (WINDOW_HORIZONTAL_COMBINATION_P (w))
@@ -3751,18 +3751,20 @@ window_resize_check (struct window *w, bool horflag)
        /* The sum of the widths of the child windows of W must equal W's
           width.  */
        {
-         int sum_of_pixels = 0;
+         int remaining_pixels = XINT (w->new_pixel);
 
          while (c)
            {
              if (!window_resize_check (c, horflag))
                return 0;
 
-             sum_of_pixels = sum_of_pixels + XINT (c->new_pixel);
+             remaining_pixels -= XINT (c->new_pixel);
+             if (remaining_pixels < 0)
+               return 0;
              c = NILP (c->next) ? 0 : XWINDOW (c->next);
            }
 
-         return (sum_of_pixels == XINT (w->new_pixel));
+         return remaining_pixels == 0;
        }
       else
        /* All child windows of W must have the same height as W.  */