mirrors/emacs
1
Fork 0
mirror of git://git.sv.gnu.org/emacs.git synced 2026-02-03 14:10:47 -08:00
Code Issues Projects Releases Wiki Activity

make-docfile: don't corrupt heap for an invalid .elc file

Browse source
This commit is contained in:
Jim Meyering 2011-01-30 10:17:36 +01:00
parent 7920f98294
commit 8aec9916dd
2 changed files with 17 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

8
lib-src/ChangeLog
View file

@ -1,3 +1,11 @@
2011-01-30 Jim Meyering <meyering@redhat.com>
make-docfile: don't corrupt heap for an invalid .elc file
"printf '#@1a' > in.elc; ./make-docfile in.elc" would store 0
one byte before just-malloc'd saved_string buffer.
* make-docfile.c (scan_lisp_file): Diagnose an invalid dynamic
doc string length. Also fix an always-false while-loop test.
2011-01-29 Eli Zaretskii <eliz@gnu.org>
* makefile.w32-in (LOCAL_FLAGS): Add -I../lib.

12
lib-src/make-docfile.c
View file

@ -873,8 +873,8 @@ scan_lisp_file (const char *filename, const char *mode)
c = getc (infile);
if (c == '@')
{
int length = 0;
int i;
size_t length = 0;
size_t i;
/* Read the length. */
while ((c = getc (infile),
@ -884,6 +884,12 @@ scan_lisp_file (const char *filename, const char *mode)
length += c - '0';
}
if (length <= 1)
fatal ("invalid dynamic doc string length", "");
if (c != ' ')
fatal ("space not found after dynamic doc string length", "");
/* The next character is a space that is counted in the length
but not part of the doc string.
We already read it, so just ignore it. */
@ -899,7 +905,7 @@ scan_lisp_file (const char *filename, const char *mode)
but it is redundant in DOC. So get rid of it here. */
saved_string[length - 1] = 0;
/* Skip the line break. */
while (c == '\n' && c == '\r')
while (c == '\n' || c == '\r')
c = getc (infile);
/* Skip the following line. */
while (c != '\n' && c != '\r')