From 754790b6c5a0ebe9cc1f2463d9446c5cb19b4264 Mon Sep 17 00:00:00 2001 From: Chong Yidong Date: Tue, 18 May 2010 14:01:10 -0400 Subject: [PATCH] * character.c (Fstring, Funibyte_string): Use SAFE_ALLOCA to prevent stack overflow if number of arguments is too large (Bug#6214). --- src/ChangeLog | 6 ++++++ src/character.c | 30 ++++++++++++++++++++---------- 2 files changed, 26 insertions(+), 10 deletions(-) diff --git a/src/ChangeLog b/src/ChangeLog index 8e2774f2a03..557cda8d4f9 100644 --- a/src/ChangeLog +++ b/src/ChangeLog @@ -1,3 +1,9 @@ +2010-05-18 Chong Yidong + + * character.c (Fstring, Funibyte_string): Use SAFE_ALLOCA to + prevent stack overflow if number of arguments is too large + (Bug#6214). + 2010-05-11 Eli Zaretskii * makefile.w32-in ($(BLD)/w32fns.$(O)): Depend on $(SRC)/w32.h. diff --git a/src/character.c b/src/character.c index 5912a70d0ce..7cd1eedcef4 100644 --- a/src/character.c +++ b/src/character.c @@ -961,10 +961,13 @@ usage: (string &rest CHARACTERS) */) int n; Lisp_Object *args; { - int i; - unsigned char *buf = (unsigned char *) alloca (MAX_MULTIBYTE_LENGTH * n); - unsigned char *p = buf; - int c; + int i, c; + unsigned char *buf, *p; + Lisp_Object str; + USE_SAFE_ALLOCA; + + SAFE_ALLOCA (buf, unsigned char *, MAX_MULTIBYTE_LENGTH * n); + p = buf; for (i = 0; i < n; i++) { @@ -973,7 +976,9 @@ usage: (string &rest CHARACTERS) */) p += CHAR_STRING (c, p); } - return make_string_from_bytes ((char *) buf, n, p - buf); + str = make_string_from_bytes ((char *) buf, n, p - buf); + SAFE_FREE (); + return str; } DEFUN ("unibyte-string", Funibyte_string, Sunibyte_string, 0, MANY, 0, @@ -983,10 +988,13 @@ usage: (unibyte-string &rest BYTES) */) int n; Lisp_Object *args; { - int i; - unsigned char *buf = (unsigned char *) alloca (n); - unsigned char *p = buf; - unsigned c; + int i, c; + unsigned char *buf, *p; + Lisp_Object str; + USE_SAFE_ALLOCA; + + SAFE_ALLOCA (buf, unsigned char *, n); + p = buf; for (i = 0; i < n; i++) { @@ -997,7 +1005,9 @@ usage: (unibyte-string &rest BYTES) */) *p++ = c; } - return make_string_from_bytes ((char *) buf, n, p - buf); + str = make_string_from_bytes ((char *) buf, n, p - buf); + SAFE_FREE (); + return str; } DEFUN ("char-resolve-modifiers", Fchar_resolve_modifiers, -- 2.39.2