(decode_composition_emacs_mule):

Give up if NCOMPONENT gets too large to index `component'.

diff --git a/src/coding.c b/src/coding.c
index 88ff0ca0a83f5df2f8cd8a7ec9a4b5e1a1544fdb..37a5e88654777d60576d78fa3448e465d240f79c 100644 (file)
--- a/src/coding.c
+++ b/src/coding.c
@@ -811,6 +811,10 @@ decode_composition_emacs_mule (coding, src, src_end,
        return 0;
       for (ncomponent = 0; src < src_base + data_len; ncomponent++)
        {
+         /* If it is longer than this, it can't be valid.  */
+         if (ncomponent >= COMPOSITION_DATA_MAX_BUNCH_LENGTH)
+           return 0;
+
          if (ncomponent % 2 && with_rule)
            {
              ONE_MORE_BYTE (gref);