Fix crashes with lots of overlays.

 src/editfns.c (get_pos_property): Use SAFE_ALLOCA_LISP, to avoid
 segfault when there are lots of overlays.
 src/buffer.c (sort_overlays): Use SAFE_NALLOCA, to avoid segfault
 when there are lots of overlays.  See
 http://lists.gnu.org/archive/html/emacs-devel/2013-01/msg00421.html
 for the details and a way to reproduce.

diff --git a/src/ChangeLog b/src/ChangeLog
index c66963738bd30ac29c737f8c56439386dc5b8ac2..2564e57a8255042f69cf7694679ecb9dc601dabf 100644 (file)
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,13 @@
+2013-01-19  Eli Zaretskii  <eliz@gnu.org>
+
+       * editfns.c (get_pos_property): Use SAFE_ALLOCA_LISP, to avoid
+       segfault when there are lots of overlays.
+
+       * buffer.c (sort_overlays): Use SAFE_NALLOCA, to avoid segfault
+       when there are lots of overlays.  See
+       http://lists.gnu.org/archive/html/emacs-devel/2013-01/msg00421.html
+       for the details and a way to reproduce.
+
 2013-01-19  Paul Eggert  <eggert@cs.ucla.edu>
 
        * fileio.c: Use O_APPEND to append.

diff --git a/src/buffer.c b/src/buffer.c
index 66581cb78280dc5155d68737393a8c94dc1670d2..aa3fcf8c234026fe9d06331b183b672f1ded1a5a 100644 (file)
--- a/src/buffer.c
+++ b/src/buffer.c
@@ -3151,7 +3151,10 @@ ptrdiff_t
 sort_overlays (Lisp_Object *overlay_vec, ptrdiff_t noverlays, struct window *w)
 {
   ptrdiff_t i, j;
-  struct sortvec *sortvec = alloca (noverlays * sizeof *sortvec);
+  USE_SAFE_ALLOCA;
+  struct sortvec *sortvec;
+
+  SAFE_NALLOCA (sortvec, 1, noverlays);
 
   /* Put the valid and relevant overlays into sortvec.  */
 
@@ -3197,6 +3200,8 @@ sort_overlays (Lisp_Object *overlay_vec, ptrdiff_t noverlays, struct window *w)
 
   for (i = 0; i < noverlays; i++)
     overlay_vec[i] = sortvec[i].overlay;
+
+  SAFE_FREE ();
   return (noverlays);
 }
 \f

diff --git a/src/editfns.c b/src/editfns.c
index 197950517b7a5bfb18b46459ac9af7a29bc7cd65..020285cf4ec3560b0f02b579a19b1187c5a9f59a 100644 (file)
--- a/src/editfns.c
+++ b/src/editfns.c
@@ -386,6 +386,7 @@ get_pos_property (Lisp_Object position, register Lisp_Object prop, Lisp_Object o
       ptrdiff_t noverlays;
       Lisp_Object *overlay_vec, tem;
       struct buffer *obuf = current_buffer;
+      USE_SAFE_ALLOCA;
 
       set_buffer_temp (XBUFFER (object));
 
@@ -398,7 +399,7 @@ get_pos_property (Lisp_Object position, register Lisp_Object prop, Lisp_Object o
         make enough space for all, and try again.  */
       if (noverlays > 40)
        {
-         overlay_vec = alloca (noverlays * sizeof *overlay_vec);
+         SAFE_ALLOCA_LISP (overlay_vec, noverlays);
          noverlays = overlays_around (posn, overlay_vec, noverlays);
        }
       noverlays = sort_overlays (overlay_vec, noverlays, NULL);
@@ -421,10 +422,12 @@ get_pos_property (Lisp_Object position, register Lisp_Object prop, Lisp_Object o
                ; /* The overlay will not cover a char inserted at point.  */
              else
                {
+                 SAFE_FREE ();
                  return tem;
                }
            }
        }
+      SAFE_FREE ();
 
       { /* Now check the text properties.  */
        int stickiness = text_property_stickiness (prop, position, object);