From 17828df2d81aef1c7886cddd881ad6f67f1e4abe Mon Sep 17 00:00:00 2001 From: Paul Eggert Date: Thu, 28 Jul 2011 13:30:20 -0700 Subject: [PATCH] * character.c (Fstring): Check for size-calculation overflow. --- src/ChangeLog | 2 ++ src/character.c | 2 ++ 2 files changed, 4 insertions(+) diff --git a/src/ChangeLog b/src/ChangeLog index b35f5607619..9f50e928fac 100644 --- a/src/ChangeLog +++ b/src/ChangeLog @@ -1,5 +1,7 @@ 2011-07-28 Paul Eggert + * character.c (Fstring): Check for size-calculation overflow. + * ccl.c: Integer and memory overflow fixes. (Fccl_execute_on_string): Check for memory overflow. Use ptrdiff_t rather than EMACS_INT where ptrdiff_t will do. diff --git a/src/character.c b/src/character.c index 5e2eccf54db..50b5b252871 100644 --- a/src/character.c +++ b/src/character.c @@ -902,6 +902,8 @@ usage: (string &rest CHARACTERS) */) Lisp_Object str; USE_SAFE_ALLOCA; + if (min (PTRDIFF_MAX, SIZE_MAX) / MAX_MULTIBYTE_LENGTH < n) + memory_full (SIZE_MAX); SAFE_ALLOCA (buf, unsigned char *, MAX_MULTIBYTE_LENGTH * n); p = buf; -- 2.39.2