From c8907a930eb953a30831faa3a7ccae74e4ae2f23 Mon Sep 17 00:00:00 2001 From: Paul Eggert Date: Tue, 12 Jul 2011 10:34:59 -0700 Subject: [PATCH] * xfaces.c (Fbitmap_spec_p): Fix integer overflow bug. Without this fix, (bitmap-spec-p '(34359738368 1 "x")) would wrongly return t on a 64-bit host. --- src/ChangeLog | 6 ++++++ src/xfaces.c | 10 ++++++---- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/src/ChangeLog b/src/ChangeLog index b0913ab983c..8911b6bdce2 100644 --- a/src/ChangeLog +++ b/src/ChangeLog @@ -1,3 +1,9 @@ +2011-07-12 Paul Eggert + + * xfaces.c (Fbitmap_spec_p): Fix integer overflow bug. + Without this fix, (bitmap-spec-p '(34359738368 1 "x")) + would wrongly return t on a 64-bit host. + 2011-07-11 Paul Eggert * dispnew.c (init_display): Use *_RANGE_OVERFLOW macros. diff --git a/src/xfaces.c b/src/xfaces.c index c1e75ab3e59..e0dc2883f33 100644 --- a/src/xfaces.c +++ b/src/xfaces.c @@ -940,11 +940,13 @@ the pixmap. Bits are stored row by row, each row occupies } } - if (NATNUMP (width) && NATNUMP (height) && STRINGP (data)) + if (STRINGP (data) + && INTEGERP (width) && 0 < XINT (width) + && INTEGERP (height) && 0 < XINT (height)) { - int bytes_per_row = ((XFASTINT (width) + BITS_PER_CHAR - 1) - / BITS_PER_CHAR); - if (SBYTES (data) >= bytes_per_row * XINT (height)) + EMACS_INT bytes_per_row = ((XINT (width) + BITS_PER_CHAR - 1) + / BITS_PER_CHAR); + if (XINT (height) <= SBYTES (data) / bytes_per_row) pixmap_p = 1; } } -- 2.39.2