* chartab.c (sub_char_table_ref_and_range): Redo to avoid overflow

concerns.

diff --git a/src/ChangeLog b/src/ChangeLog
index 47d9dbe5aa2919250b0fe80d5c59c6345e7be5ce..b268681187572b34ac3ea8cbebfc79f7d6b73677 100644 (file)
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,5 +1,8 @@
 2011-03-23  Paul Eggert  <eggert@cs.ucla.edu>
 
+       * chartab.c (sub_char_table_ref_and_range): Redo to avoid overflow
+       concerns.
+
        * term.c (produce_glyphless_glyph): Remove unnecessary test.
 
        * cm.c (calccost): Turn while-do into do-while, for clarity.

diff --git a/src/chartab.c b/src/chartab.c
index 85aa5932ac3e1a622cb8935898c4cbf51e74fea1..9a140eb85603ab8e4ee56cde1c6ba47644c8d8cc 100644 (file)
--- a/src/chartab.c
+++ b/src/chartab.c
@@ -215,7 +215,7 @@ sub_char_table_ref_and_range (Lisp_Object table, int c, int *from, int *to, Lisp
   struct Lisp_Sub_Char_Table *tbl = XSUB_CHAR_TABLE (table);
   int depth = XINT (tbl->depth);
   int min_char = XINT (tbl->min_char);
-  int max_char = min_char + chartab_chars[depth - 1] - 1;
+  int char_offset_lim = chartab_chars[depth - 1];
   int chartab_idx = CHARTAB_IDX (c, depth, min_char), idx;
   Lisp_Object val;
 
@@ -244,8 +244,9 @@ sub_char_table_ref_and_range (Lisp_Object table, int c, int *from, int *to, Lisp
          break;
        }
     }
-  while ((c = min_char + (chartab_idx + 1) * chartab_chars[depth]) <= max_char
-        && *to >= c)
+
+  while ((c = (chartab_idx + 1) * chartab_chars[depth]) < char_offset_lim
+        && (c += min_char) <= *to)
     {
       Lisp_Object this_val;