* fns.c (sxhash_bool_vector): Fix buffer read overrun.

diff --git a/src/ChangeLog b/src/ChangeLog
index 0597c5d9f2110c8779e96fd364336537e100148b..f46733d1ebe68aaa41ef14d403d6fb7cd950ab35 100644 (file)
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,7 @@
+2013-10-09  Paul Eggert  <eggert@cs.ucla.edu>
+
+       * fns.c (sxhash_bool_vector): Fix buffer read overrun.
+
 2013-10-09  Eli Zaretskii  <eliz@gnu.org>
 
        * term.c (tty_menu_activate): Flush the output stream after

diff --git a/src/fns.c b/src/fns.c
index e991711b871fc6cea193704daf784c3dca245f71..1ee0a758fc2f87c0c5c62ad833fec9e1f0412cc5 100644 (file)
--- a/src/fns.c
+++ b/src/fns.c
@@ -4191,7 +4191,9 @@ sxhash_bool_vector (Lisp_Object vec)
   EMACS_UINT hash = XBOOL_VECTOR (vec)->size;
   int i, n;
 
-  n = min (SXHASH_MAX_LEN, XBOOL_VECTOR (vec)->header.size);
+  n = min (SXHASH_MAX_LEN,
+          ((XBOOL_VECTOR (vec)->size + BOOL_VECTOR_BITS_PER_CHAR - 1)
+           / BOOL_VECTOR_BITS_PER_CHAR));
   for (i = 0; i < n; ++i)
     hash = sxhash_combine (hash, XBOOL_VECTOR (vec)->data[i]);