From: Paul Eggert <eggert@cs.ucla.edu>
Date: Tue, 12 Jul 2011 17:34:59 +0000 (-0700)
Subject: * xfaces.c (Fbitmap_spec_p): Fix integer overflow bug.
X-Git-Tag: emacs-pretest-24.0.90~104^2~152^2~161
X-Git-Url: http://git.eshelyaron.com/gitweb/?a=commitdiff_plain;h=c8907a930eb953a30831faa3a7ccae74e4ae2f23;p=emacs.git

* xfaces.c (Fbitmap_spec_p): Fix integer overflow bug.

Without this fix, (bitmap-spec-p '(34359738368 1 "x"))
would wrongly return t on a 64-bit host.
---

diff --git a/src/ChangeLog b/src/ChangeLog
index b0913ab983c..8911b6bdce2 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,9 @@
+2011-07-12  Paul Eggert  <eggert@cs.ucla.edu>
+
+	* xfaces.c (Fbitmap_spec_p): Fix integer overflow bug.
+	Without this fix, (bitmap-spec-p '(34359738368 1 "x"))
+	would wrongly return t on a 64-bit host.
+
 2011-07-11  Paul Eggert  <eggert@cs.ucla.edu>
 
 	* dispnew.c (init_display): Use *_RANGE_OVERFLOW macros.
diff --git a/src/xfaces.c b/src/xfaces.c
index c1e75ab3e59..e0dc2883f33 100644
--- a/src/xfaces.c
+++ b/src/xfaces.c
@@ -940,11 +940,13 @@ the pixmap.  Bits are stored row by row, each row occupies
 	    }
 	}
 
-      if (NATNUMP (width) && NATNUMP (height) && STRINGP (data))
+      if (STRINGP (data)
+	  && INTEGERP (width) && 0 < XINT (width)
+	  && INTEGERP (height) && 0 < XINT (height))
 	{
-	  int bytes_per_row = ((XFASTINT (width) + BITS_PER_CHAR - 1)
-			       / BITS_PER_CHAR);
-	  if (SBYTES (data) >= bytes_per_row * XINT (height))
+	  EMACS_INT bytes_per_row = ((XINT (width) + BITS_PER_CHAR - 1)
+				     / BITS_PER_CHAR);
+	  if (XINT (height) <= SBYTES (data) / bytes_per_row)
 	    pixmap_p = 1;
 	}
     }