APPROVE COMMIT NOTE: This patch has been committed. # HG changeset patch # User Aidan Kehoe <kehoea(a)parhasard.net&gt; # Date 1426203102 0 # Thu Mar 12 23:31:42 2015 +0000 # Node ID 6ec4964c168757948e11cb77e28966c253f00559 # Parent 27876789edc5d9485f2c9895ec4790edeaaf71f1 Be more careful about echo_buf arithmetic, event-stream.c. src/ChangeLog addition: 2015-03-12 Aidan Kehoe <kehoea(a)parhasard.net&gt; * event-stream.c (lookup_command_event): Check whether echo_buf_fill_pointer is negative before using it in arithmetic, avoiding a crash in GC. Oddly the old code didn't do this check and didn't crash, but its echo_buf was from malloced memory, not from our string data, so there may have been more room to manoeuvre. diff -r 27876789edc5 -r 6ec4964c1687 src/ChangeLog --- a/src/ChangeLog Thu Mar 12 00:59:27 2015 +0000 +++ b/src/ChangeLog Thu Mar 12 23:31:42 2015 +0000 ＠＠ -1,3 +1,12 ＠＠ +2015-03-12 Aidan Kehoe <kehoea(a)parhasard.net&gt; + + * event-stream.c (lookup_command_event): + Check whether echo_buf_fill_pointer is negative before using it in + arithmetic, avoiding a crash in GC. + Oddly the old code didn't do this check and didn't crash, but its + echo_buf was from malloced memory, not from our string data, so + there may have been more room to manoeuvre. + 2015-03-04 Aidan Kehoe <kehoea(a)parhasard.net&gt; * sequence.c (count_with_tail): diff -r 27876789edc5 -r 6ec4964c1687 src/event-stream.c --- a/src/event-stream.c Thu Mar 12 00:59:27 2015 +0000 +++ b/src/event-stream.c Thu Mar 12 23:31:42 2015 +0000 ＠＠ -4067,10 +4067,11 ＠＠ #endif { Lisp_Object prompt = Fkeymap_prompt (leaf, Qt); - if (STRINGP (prompt)) + if (STRINGP (prompt) && STRINGP (command_builder->echo_buf)) { /* Append keymap prompt to key echo buffer */ - int buf_fill_pointer = command_builder->echo_buf_fill_pointer; + Bytecount buf_fill_pointer + = max (command_builder->echo_buf_fill_pointer, 0); Bytecount len = XSTRING_LENGTH (prompt); if (len + buf_fill_pointer + 1 ＠＠ -4090,7 +4091,8 ＠＠ /* Show the keymap prompt, but don't adjust the fill pointer to reflect it. */ command_builder->echo_buf_end - = command_builder->echo_buf_fill_pointer + len; + = buf_fill_pointer + len; + command_builder->echo_buf_fill_pointer = buf_fill_pointer; } maybe_echo_keys (command_builder, 1); } -- ‘Tramadol is further fed to cattle […] when working them […] (as draft animals) so that the animals do not get tired quickly. …’ — Angewandte Chemie, Sept 2014, describing the social context of (synthetic) tramadol having been found in Cameroon tree roots. _______________________________________________ XEmacs-Patches mailing list XEmacs-Patches(a)xemacs.org http://lists.xemacs.org/mailman/listinfo/xemacs-patches