mirrors/emacs
1
Fork 0
mirror of git://git.sv.gnu.org/emacs.git synced 2026-01-13 15:00:42 -08:00
Code Issues Projects Releases Wiki Activity

Avoid crashes in read_integer

Browse source 
* src/lread.c (read_integer): Always allocate a buffer, since
we need to use it even when the radix is invalid.  (Bug#35576)
This commit is contained in:
Eli Zaretskii 2019-05-05 17:06:01 +03:00
parent 64f95e4011
commit 708d117a85
1 changed files with 2 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

5
src/lread.c
View file

@ -2660,11 +2660,12 @@ read_integer (Lisp_Object readcharfun, EMACS_INT radix)
Also, room for invalid syntax diagnostic. */
size_t len = max (1 + 1 + UINTMAX_WIDTH + 1,
sizeof "integer, radix " + INT_STRLEN_BOUND (EMACS_INT));
char *buf = NULL;
char *buf = xmalloc (len);
char *p = buf;
int valid = -1; /* 1 if valid, 0 if not, -1 if incomplete. */
ptrdiff_t count = SPECPDL_INDEX ();
record_unwind_protect_ptr (free_contents, &buf);
if (radix < 2 || radix > 36)
valid = 0;
@ -2672,8 +2673,6 @@ read_integer (Lisp_Object readcharfun, EMACS_INT radix)
{
int c, digit;
buf = xmalloc (len);
record_unwind_protect_ptr (free_contents, &buf);
p = buf;
c = READCHAR;