mirrors/emacs
1
Fork 0
mirror of git://git.sv.gnu.org/emacs.git synced 2026-04-27 08:43:40 -07:00
Code Issues Projects Releases Wiki Activity

Allocate some buffers used during event handling safely

Browse source 
* src/xterm.c (handle_one_xevent): Allocate string lookup and
device disable data safely since they can potentially become
very large.
This commit is contained in:
Po Lu 2022-05-15 09:38:56 +08:00
parent 8e59297378
commit 2a5e1d8c44
1 changed files with 8 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

13
src/xterm.c
View file

@ -14536,6 +14536,7 @@ handle_one_xevent (struct x_display_info *dpyinfo,
GdkEvent *copy = NULL;
GdkDisplay *gdpy = gdk_x11_lookup_xdisplay (dpyinfo->display);
#endif
USE_SAFE_ALLOCA;
*finish = X_EVENT_NORMAL;
@ -15753,7 +15754,7 @@ handle_one_xevent (struct x_display_info *dpyinfo,
if (status_return == XBufferOverflow)
{
copy_bufsiz = nbytes + 1;
copy_bufptr = alloca (copy_bufsiz);
copy_bufptr = SAFE_ALLOCA (copy_bufsiz);
nbytes = XmbLookupString (FRAME_XIC (f),
&xkey, (char *) copy_bufptr,
copy_bufsiz, &keysym,
@ -18858,7 +18859,7 @@ handle_one_xevent (struct x_display_info *dpyinfo,
if (status_return == XBufferOverflow)
{
copy_bufsiz = nbytes + 1;
copy_bufptr = alloca (copy_bufsiz);
copy_bufptr = SAFE_ALLOCA (copy_bufsiz);
nbytes = XmbLookupString (FRAME_XIC (f),
&xkey, (char *) copy_bufptr,
copy_bufsiz, &keysym,
@ -18890,8 +18891,8 @@ handle_one_xevent (struct x_display_info *dpyinfo,
copy_bufsiz, &overflow);
if (overflow)
{
copy_bufptr = alloca ((copy_bufsiz += overflow)
* sizeof *copy_bufptr);
copy_bufptr = SAFE_ALLOCA ((copy_bufsiz += overflow)
* sizeof *copy_bufptr);
overflow = 0;
nbytes = XkbTranslateKeySym (dpyinfo->display, &sym,
state & ~mods_rtrn, copy_bufptr,
@ -19202,7 +19203,7 @@ handle_one_xevent (struct x_display_info *dpyinfo,
struct xi_touch_point_t *tem, *last;
#endif
disabled = alloca (sizeof *disabled * hev->num_info);
disabled = SAFE_ALLOCA (sizeof *disabled * hev->num_info);
n_disabled = 0;
for (i = 0; i < hev->num_info; ++i)
@ -20072,6 +20073,8 @@ handle_one_xevent (struct x_display_info *dpyinfo,
if (any && any != f)
flush_dirty_back_buffer_on (any);
#endif
SAFE_FREE ();
return count;
}