* editfns.c: Integer and memory overflow fixes.

(set_time_zone_rule): Don't assume environment length fits in int.
(message_length): Now ptrdiff_t, not int.
(Fmessage_box): Don't update size until allocation succeeds.
Don't assume message length fits in int.
(Fformat): Use ptrdiff_t, not EMACS_INT, where ptrdiff_t will do.

diff --git a/src/ChangeLog b/src/ChangeLog
index 6cf9a1f862226c255d9bd080c08dd36ca15bb0b4..b823dd54498f1721cde5c57e32ba4aaa3445d58b 100644 (file)
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,5 +1,12 @@
 2011-07-28  Paul Eggert  <eggert@cs.ucla.edu>
 
+       * editfns.c: Integer and memory overflow fixes.
+       (set_time_zone_rule): Don't assume environment length fits in int.
+       (message_length): Now ptrdiff_t, not int.
+       (Fmessage_box): Don't update size until allocation succeeds.
+       Don't assume message length fits in int.
+       (Fformat): Use ptrdiff_t, not EMACS_INT, where ptrdiff_t will do.
+
        * doc.c: Integer and memory overflow fixes.
        (get_doc_string_buffer_size): Now ptrdiff_t, not int.
        (get_doc_string): Check for size calculation overflow.

diff --git a/src/editfns.c b/src/editfns.c
index 18fefa5e3b53a98fc5c3ef7620e40dd07a3f1d2b..1616305faa35d0e65c0c3d3b9529b1b502fca718 100644 (file)
--- a/src/editfns.c
+++ b/src/editfns.c
@@ -2105,7 +2105,7 @@ static char set_time_zone_rule_tz2[] = "TZ=GMT+1";
 void
 set_time_zone_rule (const char *tzstring)
 {
-  int envptrs;
+  ptrdiff_t envptrs;
   char **from, **to, **newenv;
 
   /* Make the ENVIRON vector longer with room for TZSTRING.  */
@@ -3355,7 +3355,7 @@ usage: (save-restriction &rest BODY)  */)
 static char *message_text;
 
 /* Allocated length of that buffer.  */
-static int message_length;
+static ptrdiff_t message_length;
 
 DEFUN ("message", Fmessage, Smessage, 1, MANY, 0,
        doc: /* Display a message at the bottom of the screen.
@@ -3437,8 +3437,8 @@ usage: (message-box FORMAT-STRING &rest ARGS)  */)
        }
       if (SBYTES (val) > message_length)
        {
+         message_text = (char *) xrealloc (message_text, SBYTES (val));
          message_length = SBYTES (val);
-         message_text = (char *)xrealloc (message_text, message_length);
        }
       memcpy (message_text, SDATA (val), SBYTES (val));
       message2 (message_text, SBYTES (val),
@@ -4163,7 +4163,7 @@ usage: (format STRING &rest OBJECTS)  */)
         character.  CONVBYTES says how much room is needed.  Allocate
         enough room (and then some) and do it again.  */
       {
-       EMACS_INT used = p - buf;
+       ptrdiff_t used = p - buf;
 
        if (max_bufsize - used < convbytes)
          string_overflow ();