From: Eli Zaretskii <eliz@gnu.org>
Date: Fri, 1 Feb 2002 18:03:09 +0000 (+0000)
Subject: (decode_composition_emacs_mule): Give up if NCOMPONENT
X-Git-Tag: emacs-21.2~138
X-Git-Url: http://git.eshelyaron.com/gitweb/?a=commitdiff_plain;h=b678e3717c441a9145ab4599c606cb11af170f9f;p=emacs.git

(decode_composition_emacs_mule): Give up if NCOMPONENT
gets too large to index `component'.
---

diff --git a/src/ChangeLog b/src/ChangeLog
index 5aa0299efac..abaf23e6951 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,8 @@
+2002-02-01  Eli Zaretskii  <eliz@is.elta.co.il>
+
+	* coding.c (decode_composition_emacs_mule): Give up if NCOMPONENT
+	gets too large to index `component'.
+
 2002-01-28  Richard M. Stallman  <rms@gnu.org>
 
 	* buffer.c (syms_of_buffer): Doc fixes for scroll-...-aggressively.
diff --git a/src/coding.c b/src/coding.c
index 89cca87e129..48201ed921c 100644
--- a/src/coding.c
+++ b/src/coding.c
@@ -811,6 +811,10 @@ decode_composition_emacs_mule (coding, src, src_end,
 	return 0;
       for (ncomponent = 0; src < src_base + data_len; ncomponent++)
 	{
+	  /* If it is longer than this, it can't be valid.  */
+	  if (ncomponent >= COMPOSITION_DATA_MAX_BUNCH_LENGTH)
+	    return 0;
+
 	  if (ncomponent % 2 && with_rule)
 	    {
 	      ONE_MORE_BYTE (gref);