From: Eli Zaretskii <eliz@gnu.org>
Date: Sun, 5 May 2019 14:06:01 +0000 (+0300)
Subject: Avoid crashes in read_integer
X-Git-Tag: emacs-27.0.90~2980
X-Git-Url: http://git.eshelyaron.com/gitweb/?a=commitdiff_plain;h=708d117a85107331c8a06a9a4887abffcc18ec24;p=emacs.git

Avoid crashes in read_integer

* src/lread.c (read_integer): Always allocate a buffer, since
we need to use it even when the radix is invalid.  (Bug#35576)
---

diff --git a/src/lread.c b/src/lread.c
index 1c97805ca7a..c37719e0d24 100644
--- a/src/lread.c
+++ b/src/lread.c
@@ -2660,11 +2660,12 @@ read_integer (Lisp_Object readcharfun, EMACS_INT radix)
      Also, room for invalid syntax diagnostic.  */
   size_t len = max (1 + 1 + UINTMAX_WIDTH + 1,
 		    sizeof "integer, radix " + INT_STRLEN_BOUND (EMACS_INT));
-  char *buf = NULL;
+  char *buf = xmalloc (len);
   char *p = buf;
   int valid = -1; /* 1 if valid, 0 if not, -1 if incomplete.  */
 
   ptrdiff_t count = SPECPDL_INDEX ();
+  record_unwind_protect_ptr (free_contents, &buf);
 
   if (radix < 2 || radix > 36)
     valid = 0;
@@ -2672,8 +2673,6 @@ read_integer (Lisp_Object readcharfun, EMACS_INT radix)
     {
       int c, digit;
 
-      buf = xmalloc (len);
-      record_unwind_protect_ptr (free_contents, &buf);
       p = buf;
 
       c = READCHAR;