(decode_composition_emacs_mule): Give up if NCOMPONENT

gets too large to index `component'.

diff --git a/src/ChangeLog b/src/ChangeLog
index 5aa0299efac9061f02a781f1dbddbc8b3cd19c2e..abaf23e695172d71f895de6ccc2ed10c19ad22ec 100644 (file)
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,8 @@
+2002-02-01  Eli Zaretskii  <eliz@is.elta.co.il>
+
+       * coding.c (decode_composition_emacs_mule): Give up if NCOMPONENT
+       gets too large to index `component'.
+
 2002-01-28  Richard M. Stallman  <rms@gnu.org>
 
        * buffer.c (syms_of_buffer): Doc fixes for scroll-...-aggressively.

diff --git a/src/coding.c b/src/coding.c
index 89cca87e1294f5009aa25e5d759d59fb8644f681..48201ed921c349aa07086fabf68bc4c3315a5496 100644 (file)
--- a/src/coding.c
+++ b/src/coding.c
@@ -811,6 +811,10 @@ decode_composition_emacs_mule (coding, src, src_end,
        return 0;
       for (ncomponent = 0; src < src_base + data_len; ncomponent++)
        {
+         /* If it is longer than this, it can't be valid.  */
+         if (ncomponent >= COMPOSITION_DATA_MAX_BUNCH_LENGTH)
+           return 0;
+
          if (ncomponent % 2 && with_rule)
            {
              ONE_MORE_BYTE (gref);