From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Paul Eggert Newsgroups: gmane.emacs.bugs Subject: bug#8344: (substring ...) crashes on large vectors Date: Fri, 25 Mar 2011 11:17:30 -0700 Organization: UCLA Computer Science Department Message-ID: <4D8CDC3A.4010705@cs.ucla.edu> NNTP-Posting-Host: lo.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Trace: dough.gmane.org 1301078247 6495 80.91.229.12 (25 Mar 2011 18:37:27 GMT) X-Complaints-To: usenet@dough.gmane.org NNTP-Posting-Date: Fri, 25 Mar 2011 18:37:27 +0000 (UTC) To: 8344@debbugs.gnu.org Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Fri Mar 25 19:37:21 2011 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane.org Original-Received: from lists.gnu.org ([199.232.76.165]) by lo.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1Q3Bsu-0004Nb-J1 for geb-bug-gnu-emacs@m.gmane.org; Fri, 25 Mar 2011 19:37:20 +0100 Original-Received: from localhost ([127.0.0.1]:60101 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1Q3Bst-0001Ky-O0 for geb-bug-gnu-emacs@m.gmane.org; Fri, 25 Mar 2011 14:37:19 -0400 Original-Received: from [140.186.70.92] (port=34068 helo=eggs.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1Q3Bsl-0001Jm-Hp for bug-gnu-emacs@gnu.org; Fri, 25 Mar 2011 14:37:12 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Q3Bsk-0006di-Aw for bug-gnu-emacs@gnu.org; Fri, 25 Mar 2011 14:37:11 -0400 Original-Received: from debbugs.gnu.org ([140.186.70.43]:48493) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Q3Bsk-0006de-9F for bug-gnu-emacs@gnu.org; Fri, 25 Mar 2011 14:37:10 -0400 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.69) (envelope-from ) id 1Q3Biw-0001ur-7D; Fri, 25 Mar 2011 14:27:02 -0400 X-Loop: help-debbugs@gnu.org Resent-From: Paul Eggert Original-Sender: debbugs-submit-bounces@debbugs.gnu.org Resent-To: owner@debbugs.gnu.org Resent-CC: bug-gnu-emacs@gnu.org Resent-Date: Fri, 25 Mar 2011 18:27:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: report 8344 X-GNU-PR-Package: emacs X-GNU-PR-Keywords: X-Debbugs-Original-To: bug-gnu-emacs@gnu.org Original-Received: via spool by submit@debbugs.gnu.org id=B.13010776027333 (code B ref -1); Fri, 25 Mar 2011 18:27:02 +0000 Original-Received: (at submit) by debbugs.gnu.org; 25 Mar 2011 18:26:42 +0000 Original-Received: from localhost ([127.0.0.1] helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.69) (envelope-from ) id 1Q3Bia-0001uE-F0 for submit@debbugs.gnu.org; Fri, 25 Mar 2011 14:26:40 -0400 Original-Received: from eggs.gnu.org ([140.186.70.92]) by debbugs.gnu.org with esmtp (Exim 4.69) (envelope-from ) id 1Q3BiY-0001u1-E2 for submit@debbugs.gnu.org; Fri, 25 Mar 2011 14:26:39 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Q3BiR-0003k8-Kq for submit@debbugs.gnu.org; Fri, 25 Mar 2011 14:26:33 -0400 Original-Received: from lists.gnu.org ([199.232.76.165]:57586) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Q3BiR-0003k3-Fz for submit@debbugs.gnu.org; Fri, 25 Mar 2011 14:26:31 -0400 Original-Received: from [140.186.70.92] (port=50431 helo=eggs.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1Q3BiQ-0003nI-IR for bug-gnu-emacs@gnu.org; Fri, 25 Mar 2011 14:26:31 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Q3BiP-0003iz-9N for bug-gnu-emacs@gnu.org; Fri, 25 Mar 2011 14:26:30 -0400 Original-Received: from smtp.cs.ucla.edu ([131.179.128.62]:60178) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Q3BZk-0000ql-W4 for bug-gnu-emacs@gnu.org; Fri, 25 Mar 2011 14:17:33 -0400 Original-Received: from localhost (localhost.localdomain [127.0.0.1]) by smtp.cs.ucla.edu (Postfix) with ESMTP id EFFD439E80F7 for ; Fri, 25 Mar 2011 11:17:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at smtp.cs.ucla.edu Original-Received: from smtp.cs.ucla.edu ([127.0.0.1]) by localhost (smtp.cs.ucla.edu [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TNLERl5qTMGe for ; Fri, 25 Mar 2011 11:17:31 -0700 (PDT) Original-Received: from [131.179.64.200] (Penguin.CS.UCLA.EDU [131.179.64.200]) by smtp.cs.ucla.edu (Postfix) with ESMTPSA id 4AC2C39E80F0 for ; Fri, 25 Mar 2011 11:17:31 -0700 (PDT) User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110307 Fedora/3.1.9-0.39.b3pre.fc14 Thunderbird/3.1.9 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6 (newer, 3) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6 (newer, 2) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.11 Precedence: list Resent-Date: Fri, 25 Mar 2011 14:27:02 -0400 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6 (newer, 3) X-Received-From: 140.186.70.43 X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Original-Sender: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.bugs:45362 Archived-At: I found this problem while compiling the Emacs trunk with gcc -Wstrict-overflow. Currently, on a 64-bit machine, (substring VEC FROM TO) fails if TO and FROM are valid indexes and TO - FROM is 2**31 or greater. On typical hosts there can be buffer overruns or crashes. The problem is that (substring ...) internally calls (vector ...), and (vector ...) cannot create a vector whose length is 2**31 or greater, because it follows the Emacs convention that varargs functions count the number of arguments using an 'int'. The simplest and most general way to address this problem is to change the Emacs convention to use EMACS_INT rather than 'int' to count the number of arguments to a function. I'm preparing a patch along those lines. The changes to lisp.h are below; the other changes should be straightforward albeit tedious. Before I work any more on this, can anyone see why not to do this? === modified file 'src/lisp.h' --- src/lisp.h 2011-03-22 09:08:11 +0000 +++ src/lisp.h 2011-03-24 08:54:15 +0000 @@ -964,7 +964,7 @@ struct Lisp_Subr Lisp_Object (*a7) (Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object); Lisp_Object (*a8) (Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object); Lisp_Object (*aUNEVALLED) (Lisp_Object args); - Lisp_Object (*aMANY) (int, Lisp_Object *); + Lisp_Object (*aMANY) (EMACS_INT, Lisp_Object *); } function; short min_args, max_args; const char *symbol_name; @@ -1809,7 +1809,7 @@ typedef struct { /* Note that the weird token-substitution semantics of ANSI C makes this work for MANY and UNEVALLED. */ -#define DEFUN_ARGS_MANY (int, Lisp_Object *) +#define DEFUN_ARGS_MANY (EMACS_INT, Lisp_Object *) #define DEFUN_ARGS_UNEVALLED (Lisp_Object) #define DEFUN_ARGS_0 (void) #define DEFUN_ARGS_1 (Lisp_Object) @@ -2079,7 +2079,7 @@ struct gcpro volatile Lisp_Object *var; /* Number of consecutive protected variables. */ - int nvars; + EMACS_INT nvars; #ifdef DEBUG_GCPRO int level; @@ -2860,7 +2860,7 @@ extern Lisp_Object internal_lisp_conditi extern Lisp_Object internal_condition_case (Lisp_Object (*) (void), Lisp_Object, Lisp_Object (*) (Lisp_Object)); extern Lisp_Object internal_condition_case_1 (Lisp_Object (*) (Lisp_Object), Lisp_Object, Lisp_Object, Lisp_Object (*) (Lisp_Object)); extern Lisp_Object internal_condition_case_2 (Lisp_Object (*) (Lisp_Object, Lisp_Object), Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object (*) (Lisp_Object)); -extern Lisp_Object internal_condition_case_n (Lisp_Object (*) (int, Lisp_Object *), int, Lisp_Object *, Lisp_Object, Lisp_Object (*) (Lisp_Object)); +extern Lisp_Object internal_condition_case_n (Lisp_Object (*) (EMACS_INT, Lisp_Object *), EMACS_INT, Lisp_Object *, Lisp_Object, Lisp_Object (*) (Lisp_Object)); extern void specbind (Lisp_Object, Lisp_Object); extern void record_unwind_protect (Lisp_Object (*) (Lisp_Object), Lisp_Object); extern Lisp_Object unbind_to (int, Lisp_Object); @@ -2870,7 +2870,7 @@ extern void do_autoload (Lisp_Object, Li extern Lisp_Object un_autoload (Lisp_Object); EXFUN (Ffetch_bytecode, 1); extern void init_eval_once (void); -extern Lisp_Object safe_call (int, Lisp_Object *); +extern Lisp_Object safe_call (EMACS_INT, Lisp_Object *); extern Lisp_Object safe_call1 (Lisp_Object, Lisp_Object); extern Lisp_Object safe_call2 (Lisp_Object, Lisp_Object, Lisp_Object); extern void init_eval (void);