From: Paul Eggert <eggert@cs.ucla.edu>
Date: Thu, 15 Sep 2011 16:10:37 +0000 (-0700)
Subject: * editfns.c (Fformat): Fix off-by-1 bug for "%%b" (Bug#9514).
X-Git-Tag: emacs-pretest-24.0.90~104^2~32
X-Git-Url: http://git.eshelyaron.com/gitweb/?a=commitdiff_plain;h=a02719a326f3bc0ddf39832ef5390f8034c24c24;p=emacs.git

* editfns.c (Fformat): Fix off-by-1 bug for "%%b" (Bug#9514).

This occurs when processing a multibyte format, which can happen
when using 'eval'.  Problem reported by Wolfgang Jenker.
---

diff --git a/src/ChangeLog b/src/ChangeLog
index 83dc66a1720..895e3e587b3 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,9 @@
+2011-09-15  Paul Eggert  <eggert@cs.ucla.edu>
+
+	* editfns.c (Fformat): Fix off-by-1 bug for "%%b" (Bug#9514).
+	This occurs when processing a multibyte format, which can happen
+	when using 'eval'.  Problem reported by Wolfgang Jenker.
+
 2011-09-15  Johan Bockgård  <bojohan@gnu.org>
 
 	* xdisp.c (try_cursor_movement): Only check for exact match if
diff --git a/src/editfns.c b/src/editfns.c
index 596765d899e..f62efc30790 100644
--- a/src/editfns.c
+++ b/src/editfns.c
@@ -4137,8 +4137,9 @@ usage: (format STRING &rest OBJECTS)  */)
 		format++;
 	      while (! CHAR_HEAD_P (*format));
 
-	      convbytes = format - format0;
-	      memset (&discarded[format0 + 1 - format_start], 2, convbytes - 1);
+	      convbytes = format - src;
+	      memset (&discarded[format0 + 1 - format_start], 2,
+		      format - (format0 + 1));
 	    }
 	  else
 	    {