* alloc.c (allocate_string_data): Update next_free immediately, to

	reduce risk of memory clobberage.

diff --git a/src/ChangeLog b/src/ChangeLog
index 5f3e1322395a4eb4bfa6f852f7dff1285a51855c..4ee94dff6938a75f2e9161d63294e6964ae954db 100644 (file)
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,8 @@
+2006-01-24  Chong Yidong  <cyd@stupidchicken.com>
+
+       * alloc.c (allocate_string_data): Update next_free immediately, to
+       reduce risk of memory clobberage.
+
 2006-01-24  L\e$,1 q\e(Brentey K\e,Aa\e(Broly  <lorentey@elte.hu>
 
        * xdisp.c (handle_invisible_prop): Set it->position to fix cursor

diff --git a/src/alloc.c b/src/alloc.c
index d81a9bf853bdf1625c7033e638226dd120c0aed1..f0c77a26710380b6356a316827338fa0d6dd5989 100644 (file)
--- a/src/alloc.c
+++ b/src/alloc.c
@@ -1978,6 +1978,8 @@ allocate_string_data (s, nchars, nbytes)
   old_nbytes = GC_STRING_BYTES (s);
 
   data = b->next_free;
+  b->next_free = (struct sdata *) ((char *) data + needed + GC_STRING_EXTRA);
+
   data->string = s;
   s->data = SDATA_DATA (data);
 #ifdef GC_CHECK_STRING_BYTES
@@ -1990,7 +1992,6 @@ allocate_string_data (s, nchars, nbytes)
   bcopy (string_overrun_cookie, (char *) data + needed,
         GC_STRING_OVERRUN_COOKIE_SIZE);
 #endif
-  b->next_free = (struct sdata *) ((char *) data + needed + GC_STRING_EXTRA);
 
   /* If S had already data assigned, mark that as free by setting its
      string back-pointer to null, and recording the size of the data