From: Chong Yidong <cyd@stupidchicken.com>
Date: Tue, 18 May 2010 18:01:10 +0000 (-0400)
Subject: * character.c (Fstring, Funibyte_string): Use SAFE_ALLOCA to
X-Git-Tag: emacs-pretest-23.2.90~139^2~175
X-Git-Url: http://git.eshelyaron.com/gitweb/?a=commitdiff_plain;h=754790b6c5a0ebe9cc1f2463d9446c5cb19b4264;p=emacs.git

* character.c (Fstring, Funibyte_string): Use SAFE_ALLOCA to
prevent stack overflow if number of arguments is too large
(Bug#6214).
---

diff --git a/src/ChangeLog b/src/ChangeLog
index 8e2774f2a03..557cda8d4f9 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,9 @@
+2010-05-18  Chong Yidong  <cyd@stupidchicken.com>
+
+	* character.c (Fstring, Funibyte_string): Use SAFE_ALLOCA to
+	prevent stack overflow if number of arguments is too large
+	(Bug#6214).
+
 2010-05-11  Eli Zaretskii  <eliz@gnu.org>
 
 	* makefile.w32-in ($(BLD)/w32fns.$(O)): Depend on $(SRC)/w32.h.
diff --git a/src/character.c b/src/character.c
index 5912a70d0ce..7cd1eedcef4 100644
--- a/src/character.c
+++ b/src/character.c
@@ -961,10 +961,13 @@ usage: (string &rest CHARACTERS)  */)
      int n;
      Lisp_Object *args;
 {
-  int i;
-  unsigned char *buf = (unsigned char *) alloca (MAX_MULTIBYTE_LENGTH * n);
-  unsigned char *p = buf;
-  int c;
+  int i, c;
+  unsigned char *buf, *p;
+  Lisp_Object str;
+  USE_SAFE_ALLOCA;
+
+  SAFE_ALLOCA (buf, unsigned char *, MAX_MULTIBYTE_LENGTH * n);
+  p = buf;
 
   for (i = 0; i < n; i++)
     {
@@ -973,7 +976,9 @@ usage: (string &rest CHARACTERS)  */)
       p += CHAR_STRING (c, p);
     }
 
-  return make_string_from_bytes ((char *) buf, n, p - buf);
+  str = make_string_from_bytes ((char *) buf, n, p - buf);
+  SAFE_FREE ();
+  return str;
 }
 
 DEFUN ("unibyte-string", Funibyte_string, Sunibyte_string, 0, MANY, 0,
@@ -983,10 +988,13 @@ usage: (unibyte-string &rest BYTES)  */)
      int n;
      Lisp_Object *args;
 {
-  int i;
-  unsigned char *buf = (unsigned char *) alloca (n);
-  unsigned char *p = buf;
-  unsigned c;
+  int i, c;
+  unsigned char *buf, *p;
+  Lisp_Object str;
+  USE_SAFE_ALLOCA;
+
+  SAFE_ALLOCA (buf, unsigned char *, n);
+  p = buf;
 
   for (i = 0; i < n; i++)
     {
@@ -997,7 +1005,9 @@ usage: (unibyte-string &rest BYTES)  */)
       *p++ = c;
     }
 
-  return make_string_from_bytes ((char *) buf, n, p - buf);
+  str = make_string_from_bytes ((char *) buf, n, p - buf);
+  SAFE_FREE ();
+  return str;
 }
 
 DEFUN ("char-resolve-modifiers", Fchar_resolve_modifiers,