* frame.c: Integer overflow fixes.

(set_menu_bar_lines, x_set_frame_parameters, x_set_scroll_bar_width)
(x_figure_window_size): Check for integer overflow.
(x_set_alpha): Do not assume XINT fits in int.

diff --git a/src/ChangeLog b/src/ChangeLog
index 7a7c8c14407c369e0f389357abf40e975a88b5c4..c46eec626bd811fff2d9cf2fa770a99e97e498ff 100644 (file)
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,5 +1,10 @@
 2011-07-28  Paul Eggert  <eggert@cs.ucla.edu>
 
+       * frame.c: Integer overflow fixes.
+       (set_menu_bar_lines, x_set_frame_parameters, x_set_scroll_bar_width)
+       (x_figure_window_size): Check for integer overflow.
+       (x_set_alpha): Do not assume XINT fits in int.
+
        * eval.c: Integer and memory overflow fixes.
        (init_eval_once, grow_specpdl): Don't update size until alloc succeeds.
        (call_debugger, grow_specpdl): Redo calculations to avoid overflow.

diff --git a/src/frame.c b/src/frame.c
index 635996ca424d964e4921a63b48cf92c6747e9bff..ca3ca49577cf690e4917e66ae1d481654bac7fc1 100644 (file)
--- a/src/frame.c
+++ b/src/frame.c
@@ -160,7 +160,7 @@ set_menu_bar_lines (struct frame *f, Lisp_Object value, Lisp_Object oldval)
   if (FRAME_MINIBUF_ONLY_P (f))
     return;
 
-  if (INTEGERP (value))
+  if (TYPE_RANGED_INTEGERP (int, value))
     nlines = XINT (value);
   else
     nlines = 0;
@@ -2994,7 +2994,7 @@ x_set_frame_parameters (FRAME_PTR f, Lisp_Object alist)
        f->size_hint_flags &= ~ (XNegative | YNegative);
        if (EQ (left, Qminus))
          f->size_hint_flags |= XNegative;
-       else if (INTEGERP (left))
+       else if (TYPE_RANGED_INTEGERP (int, left))
          {
            leftpos = XINT (left);
            if (leftpos < 0)
@@ -3002,21 +3002,21 @@ x_set_frame_parameters (FRAME_PTR f, Lisp_Object alist)
          }
        else if (CONSP (left) && EQ (XCAR (left), Qminus)
                 && CONSP (XCDR (left))
-                && INTEGERP (XCAR (XCDR (left))))
+                && RANGED_INTEGERP (-INT_MAX, XCAR (XCDR (left)), INT_MAX))
          {
            leftpos = - XINT (XCAR (XCDR (left)));
            f->size_hint_flags |= XNegative;
          }
        else if (CONSP (left) && EQ (XCAR (left), Qplus)
                 && CONSP (XCDR (left))
-                && INTEGERP (XCAR (XCDR (left))))
+                && TYPE_RANGED_INTEGERP (int, XCAR (XCDR (left))))
          {
            leftpos = XINT (XCAR (XCDR (left)));
          }
 
        if (EQ (top, Qminus))
          f->size_hint_flags |= YNegative;
-       else if (INTEGERP (top))
+       else if (TYPE_RANGED_INTEGERP (int, top))
          {
            toppos = XINT (top);
            if (toppos < 0)
@@ -3024,14 +3024,14 @@ x_set_frame_parameters (FRAME_PTR f, Lisp_Object alist)
          }
        else if (CONSP (top) && EQ (XCAR (top), Qminus)
                 && CONSP (XCDR (top))
-                && INTEGERP (XCAR (XCDR (top))))
+                && RANGED_INTEGERP (-INT_MAX, XCAR (XCDR (top)), INT_MAX))
          {
            toppos = - XINT (XCAR (XCDR (top)));
            f->size_hint_flags |= YNegative;
          }
        else if (CONSP (top) && EQ (XCAR (top), Qplus)
                 && CONSP (XCDR (top))
-                && INTEGERP (XCAR (XCDR (top))))
+                && TYPE_RANGED_INTEGERP (int, XCAR (XCDR (top))))
          {
            toppos = XINT (XCAR (XCDR (top)));
          }
@@ -3483,7 +3483,7 @@ x_set_scroll_bar_width (struct frame *f, Lisp_Object arg, Lisp_Object oldval)
         x_set_window_size (f, 0, FRAME_COLS (f), FRAME_LINES (f));
       do_pending_window_change (0);
     }
-  else if (INTEGERP (arg) && XINT (arg) > 0
+  else if (RANGED_INTEGERP (1, arg, INT_MAX)
           && XFASTINT (arg) != FRAME_CONFIG_SCROLL_BAR_WIDTH (f))
     {
       if (XFASTINT (arg) <= 2 * VERTICAL_SCROLL_BAR_WIDTH_TRIM)
@@ -3522,7 +3522,7 @@ x_set_alpha (struct frame *f, Lisp_Object arg, Lisp_Object oldval)
 {
   double alpha = 1.0;
   double newval[2];
-  int i, ialpha;
+  int i;
   Lisp_Object item;
 
   for (i = 0; i < 2; i++)
@@ -3546,7 +3546,7 @@ x_set_alpha (struct frame *f, Lisp_Object arg, Lisp_Object oldval)
        }
       else if (INTEGERP (item))
        {
-         ialpha = XINT (item);
+         EMACS_INT ialpha = XINT (item);
          if (ialpha < 0 || 100 < ialpha)
            args_out_of_range (make_number (0), make_number (100));
          else
@@ -4033,11 +4033,15 @@ x_figure_window_size (struct frame *f, Lisp_Object parms, int toolbar_p)
       if (!EQ (tem0, Qunbound))
        {
          CHECK_NUMBER (tem0);
+         if (! (0 <= XINT (tem0) && XINT (tem0) <= INT_MAX))
+           xsignal1 (Qargs_out_of_range, tem0);
          FRAME_LINES (f) = XINT (tem0);
        }
       if (!EQ (tem1, Qunbound))
        {
          CHECK_NUMBER (tem1);
+         if (! (0 <= XINT (tem1) && XINT (tem1) <= INT_MAX))
+           xsignal1 (Qargs_out_of_range, tem1);
          SET_FRAME_COLS (f, XINT (tem1));
        }
       if (!NILP (tem2) && !EQ (tem2, Qunbound))
@@ -4068,12 +4072,10 @@ x_figure_window_size (struct frame *f, Lisp_Object parms, int toolbar_p)
                ? tool_bar_button_relief
                : DEFAULT_TOOL_BAR_BUTTON_RELIEF);
 
-      if (INTEGERP (Vtool_bar_button_margin)
-         && XINT (Vtool_bar_button_margin) > 0)
+      if (RANGED_INTEGERP (1, Vtool_bar_button_margin, INT_MAX))
        margin = XFASTINT (Vtool_bar_button_margin);
       else if (CONSP (Vtool_bar_button_margin)
-              && INTEGERP (XCDR (Vtool_bar_button_margin))
-              && XINT (XCDR (Vtool_bar_button_margin)) > 0)
+              && RANGED_INTEGERP (1, XCDR (Vtool_bar_button_margin), INT_MAX))
        margin = XFASTINT (XCDR (Vtool_bar_button_margin));
       else
        margin = 0;
@@ -4099,14 +4101,14 @@ x_figure_window_size (struct frame *f, Lisp_Object parms, int toolbar_p)
        }
       else if (CONSP (tem0) && EQ (XCAR (tem0), Qminus)
               && CONSP (XCDR (tem0))
-              && INTEGERP (XCAR (XCDR (tem0))))
+              && RANGED_INTEGERP (-INT_MAX, XCAR (XCDR (tem0)), INT_MAX))
        {
          f->top_pos = - XINT (XCAR (XCDR (tem0)));
          window_prompting |= YNegative;
        }
       else if (CONSP (tem0) && EQ (XCAR (tem0), Qplus)
               && CONSP (XCDR (tem0))
-              && INTEGERP (XCAR (XCDR (tem0))))
+              && TYPE_RANGED_INTEGERP (int, XCAR (XCDR (tem0))))
        {
          f->top_pos = XINT (XCAR (XCDR (tem0)));
        }
@@ -4127,14 +4129,14 @@ x_figure_window_size (struct frame *f, Lisp_Object parms, int toolbar_p)
        }
       else if (CONSP (tem1) && EQ (XCAR (tem1), Qminus)
               && CONSP (XCDR (tem1))
-              && INTEGERP (XCAR (XCDR (tem1))))
+              && RANGED_INTEGERP (-INT_MAX, XCAR (XCDR (tem1)), INT_MAX))
        {
          f->left_pos = - XINT (XCAR (XCDR (tem1)));
          window_prompting |= XNegative;
        }
       else if (CONSP (tem1) && EQ (XCAR (tem1), Qplus)
               && CONSP (XCDR (tem1))
-              && INTEGERP (XCAR (XCDR (tem1))))
+              && TYPE_RANGED_INTEGERP (int, XCAR (XCDR (tem1))))
        {
          f->left_pos = XINT (XCAR (XCDR (tem1)));
        }