* xfaces.c (Fbitmap_spec_p): Fix integer overflow bug.

Without this fix, (bitmap-spec-p '(34359738368 1 "x"))
would wrongly return t on a 64-bit host.

diff --git a/src/ChangeLog b/src/ChangeLog
index b0913ab983cfb9935bc098a2e153194401a6d641..8911b6bdce2f8014a311b182502f709c50be2e81 100644 (file)
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,9 @@
+2011-07-12  Paul Eggert  <eggert@cs.ucla.edu>
+
+       * xfaces.c (Fbitmap_spec_p): Fix integer overflow bug.
+       Without this fix, (bitmap-spec-p '(34359738368 1 "x"))
+       would wrongly return t on a 64-bit host.
+
 2011-07-11  Paul Eggert  <eggert@cs.ucla.edu>
 
        * dispnew.c (init_display): Use *_RANGE_OVERFLOW macros.

diff --git a/src/xfaces.c b/src/xfaces.c
index c1e75ab3e597d0e053babe54bd8c60f451601a09..e0dc2883f335936af0497f2764400afbbec964d5 100644 (file)
--- a/src/xfaces.c
+++ b/src/xfaces.c
@@ -940,11 +940,13 @@ the pixmap.  Bits are stored row by row, each row occupies
            }
        }
 
-      if (NATNUMP (width) && NATNUMP (height) && STRINGP (data))
+      if (STRINGP (data)
+         && INTEGERP (width) && 0 < XINT (width)
+         && INTEGERP (height) && 0 < XINT (height))
        {
-         int bytes_per_row = ((XFASTINT (width) + BITS_PER_CHAR - 1)
-                              / BITS_PER_CHAR);
-         if (SBYTES (data) >= bytes_per_row * XINT (height))
+         EMACS_INT bytes_per_row = ((XINT (width) + BITS_PER_CHAR - 1)
+                                    / BITS_PER_CHAR);
+         if (XINT (height) <= SBYTES (data) / bytes_per_row)
            pixmap_p = 1;
        }
     }