From: Paul Eggert <eggert@cs.ucla.edu>
Date: Wed, 9 Oct 2013 22:39:57 +0000 (-0700)
Subject: * fns.c (sxhash_bool_vector): Fix buffer read overrun.
X-Git-Tag: emacs-24.3.90~173^2^2~42^2~45^2~387^2~1312
X-Git-Url: http://git.eshelyaron.com/gitweb/?a=commitdiff_plain;h=e20bb24948dd53afe77a5987c5408c715d1f388f;p=emacs.git

* fns.c (sxhash_bool_vector): Fix buffer read overrun.
---

diff --git a/src/ChangeLog b/src/ChangeLog
index 0597c5d9f21..f46733d1ebe 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,7 @@
+2013-10-09  Paul Eggert  <eggert@cs.ucla.edu>
+
+	* fns.c (sxhash_bool_vector): Fix buffer read overrun.
+
 2013-10-09  Eli Zaretskii  <eliz@gnu.org>
 
 	* term.c (tty_menu_activate): Flush the output stream after
diff --git a/src/fns.c b/src/fns.c
index e991711b871..1ee0a758fc2 100644
--- a/src/fns.c
+++ b/src/fns.c
@@ -4191,7 +4191,9 @@ sxhash_bool_vector (Lisp_Object vec)
   EMACS_UINT hash = XBOOL_VECTOR (vec)->size;
   int i, n;
 
-  n = min (SXHASH_MAX_LEN, XBOOL_VECTOR (vec)->header.size);
+  n = min (SXHASH_MAX_LEN,
+	   ((XBOOL_VECTOR (vec)->size + BOOL_VECTOR_BITS_PER_CHAR - 1)
+	    / BOOL_VECTOR_BITS_PER_CHAR));
   for (i = 0; i < n; ++i)
     hash = sxhash_combine (hash, XBOOL_VECTOR (vec)->data[i]);