* xterm.c: don't go over XClientMessageEvent limit

(scroll_bar_windows_size): Now ptrdiff_t, as we prefer signed.
(x_send_scroll_bar_event): Likewise.  Check that the size does not
exceed limits imposed by XClientMessageEvent, as well as the usual
ptrdiff_t and size_t limits.

diff --git a/src/ChangeLog b/src/ChangeLog
index 32a117ed7670211bb29f67625c8cb54776bf89d1..940beee887d54066c88248e68d4ffa1cc48b1ba5 100644 (file)
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,5 +1,11 @@
 2011-07-17  Paul Eggert  <eggert@cs.ucla.edu>
 
+       * xterm.c: don't go over XClientMessageEvent limit
+       (scroll_bar_windows_size): Now ptrdiff_t, as we prefer signed.
+       (x_send_scroll_bar_event): Likewise.  Check that the size does not
+       exceed limits imposed by XClientMessageEvent, as well as the usual
+       ptrdiff_t and size_t limits.
+
        * keyboard.c: Overflow, signedness and related fixes.
        (make_lispy_movement): Use same integer type in forward decl
        that is used in the definition.

diff --git a/src/xterm.c b/src/xterm.c
index 20516ee9d6f3970abdc3760dd881ad94d10d170c..5b6ddbb8ddf7c4aa2025ab9c68291750f5a3b06b 100644 (file)
--- a/src/xterm.c
+++ b/src/xterm.c
@@ -4190,7 +4190,7 @@ xt_action_hook (Widget widget, XtPointer client_data, String action_name,
    x_send_scroll_bar_event and x_scroll_bar_to_input_event.  */
 
 static struct window **scroll_bar_windows;
-static size_t scroll_bar_windows_size;
+static ptrdiff_t scroll_bar_windows_size;
 
 
 /* Send a client message with message type Xatom_Scrollbar for a
@@ -4205,7 +4205,7 @@ x_send_scroll_bar_event (Lisp_Object window, int part, int portion, int whole)
   XClientMessageEvent *ev = (XClientMessageEvent *) &event;
   struct window *w = XWINDOW (window);
   struct frame *f = XFRAME (w->frame);
-  size_t i;
+  ptrdiff_t i;
 
   BLOCK_INPUT;
 
@@ -4226,12 +4226,16 @@ x_send_scroll_bar_event (Lisp_Object window, int part, int portion, int whole)
 
   if (i == scroll_bar_windows_size)
     {
-      size_t new_size = max (10, 2 * scroll_bar_windows_size);
-      size_t nbytes = new_size * sizeof *scroll_bar_windows;
-      size_t old_nbytes = scroll_bar_windows_size * sizeof *scroll_bar_windows;
-
-      if ((size_t) -1 / sizeof *scroll_bar_windows < new_size)
+      ptrdiff_t new_size, old_nbytes, nbytes;
+      /* Check the 32-bit XClientMessageEvent limit, as well as the
+        usual ptrdiff_t/size_t limit.  */
+      if (min (0x7fffffff,
+              min (PTRDIFF_MAX, SIZE_MAX) / sizeof *scroll_bar_windows / 2)
+         < scroll_bar_windows_size)
        memory_full (SIZE_MAX);
+      new_size = max (10, 2 * scroll_bar_windows_size);
+      nbytes = new_size * sizeof *scroll_bar_windows;
+      old_nbytes = scroll_bar_windows_size * sizeof *scroll_bar_windows;
       scroll_bar_windows = (struct window **) xrealloc (scroll_bar_windows,
                                                        nbytes);
       memset (&scroll_bar_windows[i], 0, nbytes - old_nbytes);