From: Paul Eggert <eggert@cs.ucla.edu>
Date: Tue, 3 Dec 2013 21:37:41 +0000 (-0800)
Subject: Minor integer overflow fixes.
X-Git-Tag: emacs-24.3.90~173^2^2~42^2~45^2~387^2~569
X-Git-Url: http://git.eshelyaron.com/gitweb/?a=commitdiff_plain;h=2654ac09ccc5da6e2fe99e60291d4c6013958c3e;p=emacs.git

Minor integer overflow fixes.

* window.c (Fset_window_new_pixel): Don't let new_pixel go negative.
This improves on the previous fix to this function.
(window_resize_check): When summing up pixel counts, don't rely on
undefined behavior if the sum overflows.

Fixes: debbugs:16033
---

diff --git a/src/ChangeLog b/src/ChangeLog
index bdd111f5083..44039f83d8b 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,11 @@
+2013-12-03  Paul Eggert  <eggert@cs.ucla.edu>
+
+	Minor integer overflow fixes (Bug#16033).
+	* window.c (Fset_window_new_pixel): Don't let new_pixel go negative.
+	This improves on the previous fix to this function.
+	(window_resize_check): When summing up pixel counts, don't rely on
+	undefined behavior if the sum overflows.
+
 2013-12-03  Martin Rudalics  <rudalics@gmx.at>
 
 	* window.c (Fset_window_new_pixel): Don't choke at negative
diff --git a/src/window.c b/src/window.c
index 1ef2b4a0e38..b7d4502e3ec 100644
--- a/src/window.c
+++ b/src/window.c
@@ -3646,10 +3646,8 @@ Note: This function does not operate on any child windows of WINDOW.  */)
   (Lisp_Object window, Lisp_Object size, Lisp_Object add)
 {
   struct window *w = decode_valid_window (window);
-  EMACS_INT size_min = (max (INT_MIN, MOST_NEGATIVE_FIXNUM)
-			+ (NILP (add) ? 0 : XINT (w->new_pixel)));
-  EMACS_INT size_max = (min (INT_MAX, MOST_POSITIVE_FIXNUM)
-			- (NILP (add) ? 0 : XINT (w->new_pixel)));
+  EMACS_INT size_min = NILP (add) ? 0 : - XINT (w->new_pixel);
+  EMACS_INT size_max = size_min + min (INT_MAX, MOST_POSITIVE_FIXNUM);
 
   CHECK_RANGED_INTEGER (size, size_min, size_max);
   if (NILP (add))
@@ -3729,18 +3727,20 @@ window_resize_check (struct window *w, bool horflag)
 	/* The sum of the heights of the child windows of W must equal
 	   W's height.  */
 	{
-	  int sum_of_pixels = 0;
+	  int remaining_pixels = XINT (w->new_pixel);
 
 	  while (c)
 	    {
 	      if (!window_resize_check (c, horflag))
 		return 0;
 
-	      sum_of_pixels = sum_of_pixels + XINT (c->new_pixel);
+	      remaining_pixels -= XINT (c->new_pixel);
+	      if (remaining_pixels < 0)
+		return 0;
 	      c = NILP (c->next) ? 0 : XWINDOW (c->next);
 	    }
 
-	  return (sum_of_pixels == XINT (w->new_pixel));
+	  return remaining_pixels == 0;
 	}
     }
   else if (WINDOW_HORIZONTAL_COMBINATION_P (w))
@@ -3751,18 +3751,20 @@ window_resize_check (struct window *w, bool horflag)
 	/* The sum of the widths of the child windows of W must equal W's
 	   width.  */
 	{
-	  int sum_of_pixels = 0;
+	  int remaining_pixels = XINT (w->new_pixel);
 
 	  while (c)
 	    {
 	      if (!window_resize_check (c, horflag))
 		return 0;
 
-	      sum_of_pixels = sum_of_pixels + XINT (c->new_pixel);
+	      remaining_pixels -= XINT (c->new_pixel);
+	      if (remaining_pixels < 0)
+		return 0;
 	      c = NILP (c->next) ? 0 : XWINDOW (c->next);
 	    }
 
-	  return (sum_of_pixels == XINT (w->new_pixel));
+	  return remaining_pixels == 0;
 	}
       else
 	/* All child windows of W must have the same height as W.  */