From: Eli Zaretskii <eliz@gnu.org>
Date: Wed, 24 Feb 2021 15:55:28 +0000 (+0200)
Subject: Fix dangerous code in xdisp.c
X-Git-Tag: emacs-28.0.90~3572
X-Git-Url: http://git.eshelyaron.com/gitweb/?a=commitdiff_plain;h=ac45f314547ed9904ddc387157d3f4ba0c5fe1d2;p=emacs.git

Fix dangerous code in xdisp.c

* src/xdisp.c (move_it_to, display_line): Make sure ZV_BYTE is
greater than 1 before fetching previous byte.
---

diff --git a/src/xdisp.c b/src/xdisp.c
index cd3455aefcf..cc0a689ba32 100644
--- a/src/xdisp.c
+++ b/src/xdisp.c
@@ -10052,7 +10052,7 @@ move_it_to (struct it *it, ptrdiff_t to_charpos, int to_x, int to_y, int to_vpos
 	      && (IT_CHARPOS (*it) > to_charpos
 		  || (IT_CHARPOS (*it) == to_charpos
 		      && to_charpos == ZV
-		      && FETCH_BYTE (ZV_BYTE - 1) != '\n')))
+		      && (ZV_BYTE <= 1 || FETCH_BYTE (ZV_BYTE - 1) != '\n'))))
 	    {
 	      reached = 9;
 	      goto out;
@@ -24118,7 +24118,8 @@ display_line (struct it *it, int cursor_vpos)
 	     the logical order.  */
 	  if (IT_BYTEPOS (*it) > BEG_BYTE)
 	    row->ends_at_zv_p =
-	      IT_BYTEPOS (*it) >= ZV_BYTE && FETCH_BYTE (ZV_BYTE - 1) != '\n';
+	      IT_BYTEPOS (*it) >= ZV_BYTE
+	      && (ZV_BYTE <= 1 || FETCH_BYTE (ZV_BYTE - 1) != '\n');
 	  else
 	    row->ends_at_zv_p = false;
 	  break;