mirrors/emacs
1
Fork 0
mirror of git://git.sv.gnu.org/emacs.git synced 2026-01-01 01:41:01 -08:00
Code Issues Projects Releases Wiki Activity

* lread.c (read1): Check for size overflow.

Browse source
This commit is contained in:
Paul Eggert 2011-06-22 22:41:40 -07:00
parent 437b2cb453
commit 20270765be
2 changed files with 7 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
src/ChangeLog
View file

@ -13,6 +13,7 @@
(substitute_object_recurse, read_vector, read_list, map_obarray):
Use ptrdiff_t, not int, for sizes.
(read1): Use EMACS_INT, not int, for sizes.
Check for size overflow.
* image.c (cache_image): Check for size arithmetic overflow.

6
src/lread.c
View file

@ -2869,6 +2869,8 @@ read1 (register Lisp_Object readcharfun, int *pch, int first_in_list)
if (end - p < MAX_MULTIBYTE_LENGTH)
{
ptrdiff_t offset = p - read_buffer;
if (min (PTRDIFF_MAX, SIZE_MAX) / 2 < read_buffer_size)
memory_full (SIZE_MAX);
read_buffer = (char *) xrealloc (read_buffer,
read_buffer_size *= 2);
p = read_buffer + offset;
@ -3012,6 +3014,8 @@ read1 (register Lisp_Object readcharfun, int *pch, int first_in_list)
if (end - p < MAX_MULTIBYTE_LENGTH)
{
ptrdiff_t offset = p - read_buffer;
if (min (PTRDIFF_MAX, SIZE_MAX) / 2 < read_buffer_size)
memory_full (SIZE_MAX);
read_buffer = (char *) xrealloc (read_buffer,
read_buffer_size *= 2);
p = read_buffer + offset;
@ -3039,6 +3043,8 @@ read1 (register Lisp_Object readcharfun, int *pch, int first_in_list)
if (p == end)
{
ptrdiff_t offset = p - read_buffer;
if (min (PTRDIFF_MAX, SIZE_MAX) / 2 < read_buffer_size)
memory_full (SIZE_MAX);
read_buffer = (char *) xrealloc (read_buffer,
read_buffer_size *= 2);
p = read_buffer + offset;