From: Philipp Stephani <phst@google.com>
Date: Sun, 2 Aug 2020 14:05:44 +0000 (+0200)
Subject: * src/alloc.c (mark_maybe_object): Avoid signed integer overflow
X-Git-Tag: emacs-28.0.90~6861
X-Git-Url: http://git.eshelyaron.com/gitweb/?a=commitdiff_plain;h=2e9d1f4d44036e7c0605cfeac091368e013e3ed9;p=emacs.git

* src/alloc.c (mark_maybe_object): Avoid signed integer overflow
---

diff --git a/src/alloc.c b/src/alloc.c
index da11426075b..5220ef84783 100644
--- a/src/alloc.c
+++ b/src/alloc.c
@@ -4652,7 +4652,8 @@ mark_maybe_object (Lisp_Object obj)
 #else
   (void) overflow;
 #endif
-  void *po = (char *) ((intptr_t) (char *) XLP (obj) + offset);
+  INT_ADD_WRAPV (offset, (intptr_t) (char *) XLP (obj), &offset);
+  void *po = (char *) offset;
 
   /* If the pointer is in the dump image and the dump has a record
      of the object starting at the place where the pointer points, we