* minibuf.c (read_minibuf_noninteractive): Use size_t for sizes.

Check for integer overflow on size calculations.

diff --git a/src/ChangeLog b/src/ChangeLog
index a470962d74d8054d1cb87e4fba7fb020db33d86f..73be884837f0775786b3b78e92a93f02c56ea4c5 100644 (file)
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,5 +1,8 @@
 2011-04-02  Paul Eggert  <eggert@cs.ucla.edu>
 
+       * minibuf.c (read_minibuf_noninteractive): Use size_t for sizes.
+       Check for integer overflow on size calculations.
+
        * buffer.c (Fprevious_overlay_change): Remove var that is set
        but not used.
 

diff --git a/src/minibuf.c b/src/minibuf.c
index 4adf665f8f43a6dd508d36df40a136773ed58e41..54cb9c1acd728278d8979f58af2134a875e5d859 100644 (file)
--- a/src/minibuf.c
+++ b/src/minibuf.c
@@ -229,7 +229,7 @@ read_minibuf_noninteractive (Lisp_Object map, Lisp_Object initial,
                             Lisp_Object defalt,
                             int allow_props, int inherit_input_method)
 {
-  int size, len;
+  size_t size, len;
   char *line, *s;
   Lisp_Object val;
 
@@ -244,6 +244,8 @@ read_minibuf_noninteractive (Lisp_Object map, Lisp_Object initial,
         && (len = strlen (line),
             len == size - 1 && line[len - 1] != '\n'))
     {
+      if ((size_t) -1 / 2 < size)
+       memory_full ();
       size *= 2;
       line = (char *) xrealloc (line, size);
     }