unofficial mirror of bug-gnu-emacs@gnu.org 
 help / color / mirror / code / Atom feed
* bug#8344: (substring ...) crashes on large vectors
@ 2011-03-25 18:17 Paul Eggert
  2011-03-25 21:24 ` Stefan Monnier
  0 siblings, 1 reply; 6+ messages in thread
From: Paul Eggert @ 2011-03-25 18:17 UTC (permalink / raw)
  To: 8344

I found this problem while compiling the Emacs trunk with
gcc -Wstrict-overflow.

Currently, on a 64-bit machine, (substring VEC FROM TO)
fails if TO and FROM are valid indexes and
TO - FROM is 2**31 or greater.  On typical hosts there
can be buffer overruns or crashes.

The problem is that (substring ...) internally calls
(vector ...), and (vector ...) cannot create a vector
whose length is 2**31 or greater, because it follows
the Emacs convention that varargs functions count the
number of arguments using an 'int'.

The simplest and most general way to address this problem
is to change the Emacs convention to use EMACS_INT rather
than 'int' to count the number of arguments to a function.
I'm preparing a patch along those lines.  The changes
to lisp.h are below; the other changes should be
straightforward albeit tedious.

Before I work any more on this, can anyone see why not
to do this?

=== modified file 'src/lisp.h'
--- src/lisp.h	2011-03-22 09:08:11 +0000
+++ src/lisp.h	2011-03-24 08:54:15 +0000
@@ -964,7 +964,7 @@ struct Lisp_Subr
       Lisp_Object (*a7) (Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object);
       Lisp_Object (*a8) (Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object);
       Lisp_Object (*aUNEVALLED) (Lisp_Object args);
-      Lisp_Object (*aMANY) (int, Lisp_Object *);
+      Lisp_Object (*aMANY) (EMACS_INT, Lisp_Object *);
     } function;
     short min_args, max_args;
     const char *symbol_name;
@@ -1809,7 +1809,7 @@ typedef struct {
 
 /* Note that the weird token-substitution semantics of ANSI C makes
    this work for MANY and UNEVALLED.  */
-#define DEFUN_ARGS_MANY		(int, Lisp_Object *)
+#define DEFUN_ARGS_MANY		(EMACS_INT, Lisp_Object *)
 #define DEFUN_ARGS_UNEVALLED	(Lisp_Object)
 #define DEFUN_ARGS_0	(void)
 #define DEFUN_ARGS_1	(Lisp_Object)
@@ -2079,7 +2079,7 @@ struct gcpro
   volatile Lisp_Object *var;
 
   /* Number of consecutive protected variables.  */
-  int nvars;
+  EMACS_INT nvars;
 
 #ifdef DEBUG_GCPRO
   int level;
@@ -2860,7 +2860,7 @@ extern Lisp_Object internal_lisp_conditi
 extern Lisp_Object internal_condition_case (Lisp_Object (*) (void), Lisp_Object, Lisp_Object (*) (Lisp_Object));
 extern Lisp_Object internal_condition_case_1 (Lisp_Object (*) (Lisp_Object), Lisp_Object, Lisp_Object, Lisp_Object (*) (Lisp_Object));
 extern Lisp_Object internal_condition_case_2 (Lisp_Object (*) (Lisp_Object, Lisp_Object), Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object (*) (Lisp_Object));
-extern Lisp_Object internal_condition_case_n (Lisp_Object (*) (int, Lisp_Object *), int, Lisp_Object *, Lisp_Object, Lisp_Object (*) (Lisp_Object));
+extern Lisp_Object internal_condition_case_n (Lisp_Object (*) (EMACS_INT, Lisp_Object *), EMACS_INT, Lisp_Object *, Lisp_Object, Lisp_Object (*) (Lisp_Object));
 extern void specbind (Lisp_Object, Lisp_Object);
 extern void record_unwind_protect (Lisp_Object (*) (Lisp_Object), Lisp_Object);
 extern Lisp_Object unbind_to (int, Lisp_Object);
@@ -2870,7 +2870,7 @@ extern void do_autoload (Lisp_Object, Li
 extern Lisp_Object un_autoload (Lisp_Object);
 EXFUN (Ffetch_bytecode, 1);
 extern void init_eval_once (void);
-extern Lisp_Object safe_call (int, Lisp_Object *);
+extern Lisp_Object safe_call (EMACS_INT, Lisp_Object *);
 extern Lisp_Object safe_call1 (Lisp_Object, Lisp_Object);
 extern Lisp_Object safe_call2 (Lisp_Object, Lisp_Object, Lisp_Object);
 extern void init_eval (void);






^ permalink raw reply	[flat|nested] 6+ messages in thread

* bug#8344: (substring ...) crashes on large vectors
  2011-03-25 18:17 bug#8344: (substring ...) crashes on large vectors Paul Eggert
@ 2011-03-25 21:24 ` Stefan Monnier
  2011-03-25 21:48   ` Paul Eggert
  0 siblings, 1 reply; 6+ messages in thread
From: Stefan Monnier @ 2011-03-25 21:24 UTC (permalink / raw)
  To: Paul Eggert; +Cc: 8344

> The problem is that (substring ...) internally calls
> (vector ...), and (vector ...) cannot create a vector
> whose length is 2**31 or greater, because it follows
> the Emacs convention that varargs functions count the
> number of arguments using an 'int'.

I'm pretty sure that even with your patch such a vector would bump into
all kinds of other problems.
Already buffers larger than 2GB are causing troubles right now.  So if
you want to fix things, I'd urge you to focus on "handling an 8GB file"
(on 32bit systems this won't work, but on 64bit it should but didn't
last time I tried).


        Stefan





^ permalink raw reply	[flat|nested] 6+ messages in thread

* bug#8344: (substring ...) crashes on large vectors
  2011-03-25 21:24 ` Stefan Monnier
@ 2011-03-25 21:48   ` Paul Eggert
  2011-03-27  2:18     ` Paul Eggert
  0 siblings, 1 reply; 6+ messages in thread
From: Paul Eggert @ 2011-03-25 21:48 UTC (permalink / raw)
  To: Stefan Monnier; +Cc: 8344

On 03/25/2011 02:24 PM, Stefan Monnier wrote:
> I'd urge you to focus on "handling an 8GB file"
> (on 32bit systems this won't work, but on 64bit it should but didn't
> last time I tried)

Yes, thanks, that is on my list of things to do.  This
nargs business is one of the (easier) steps needed
to get it done.  Another (easier) step will be to
merge the gnulib fixes for regular expressions into
Emacs, since gnulib has fixed several problems with
matching buffers larger than 2**31 bytes.
There are several other steps, of course, and some
will be harder.

To some extent I'm using gcc -Wstrict-overflow
as a first pass, to fix the more-obvious gotchas, in such
a way that regressions can be caught statically.  Many
of the other changes won't be so easy, but by then I hope
to understand Emacs internals better.  For example,
the Emacs regex code fails the static checks now, and
that is why I want to turn to the regex code at some point in the
near future.





^ permalink raw reply	[flat|nested] 6+ messages in thread

* bug#8344: (substring ...) crashes on large vectors
  2011-03-25 21:48   ` Paul Eggert
@ 2011-03-27  2:18     ` Paul Eggert
  2011-03-27  7:52       ` Andreas Schwab
  0 siblings, 1 reply; 6+ messages in thread
From: Paul Eggert @ 2011-03-27  2:18 UTC (permalink / raw)
  To: 8344

[-- Attachment #1: Type: text/plain, Size: 179 bytes --]

Here's the full patch for this, which I mentioned earlier,
to give you a feel for what's needed.
It's tedious, but is pretty straightforward.
I'll test it more before committing.

[-- Attachment #2: patch.txt --]
[-- Type: text/plain, Size: 45361 bytes --]

=== modified file 'src/ChangeLog'
--- src/ChangeLog	2011-03-26 04:17:38 +0000
+++ src/ChangeLog	2011-03-27 02:12:36 +0000
@@ -1,3 +1,22 @@
+2011-03-27  Paul Eggert  <eggert@cs.ucla.edu>
+
+	Variadic C functions now count arguments with size_t, not int.
+	This avoids an unnecessary limitation on 64-bit machines, which
+	caused (substring ...) to crash on large vectors (Bug#8344).
+	* lisp.h (struct Lisp_Subr.function.aMANY): Now takes size_t, not int.
+	(DEFUN_ARGS_MANY, internal_condition_case_n, safe_call): Likewise.
+	All variadic functions changed accordingly.
+	(struct gcpro.nvars): Now size_t, not int.  All uses changed.
+	* data.c (arith_driver, float_arith_driver): Likewise.
+	* editfns.c (general_insert_function): Likewise.
+	* eval.c (struct backtrace.nargs, interactive_p)
+	(internal_condition_case_n, run_hook_with_args, apply_lambda)
+	(funcall_lambda, mark_backtrace): Likewise.
+	* fns.c (concat): Likewise.
+	* frame.c (x_set_frame_parameters): Likewise.
+	* fns.c (get_key_arg): Now accepts and returns size_t, and returns
+	0 if not found, not -1.  All callers changed.
+
 2011-03-26  Paul Eggert  <eggert@cs.ucla.edu>
 
 	* alloc.c (garbage_collect): Don't assume stack size fits in int.

=== modified file 'src/alloc.c'
--- src/alloc.c	2011-03-26 04:17:38 +0000
+++ src/alloc.c	2011-03-27 02:12:36 +0000
@@ -2707,7 +2707,7 @@
        doc: /* Return a newly created list with specified arguments as elements.
 Any number of arguments, even zero arguments, are allowed.
 usage: (list &rest OBJECTS)  */)
-  (int nargs, register Lisp_Object *args)
+  (size_t nargs, register Lisp_Object *args)
 {
   register Lisp_Object val;
   val = Qnil;
@@ -2923,10 +2923,10 @@
        doc: /* Return a newly created vector with specified arguments as elements.
 Any number of arguments, even zero arguments, are allowed.
 usage: (vector &rest OBJECTS)  */)
-  (register int nargs, Lisp_Object *args)
+  (register size_t nargs, Lisp_Object *args)
 {
   register Lisp_Object len, val;
-  register int i;
+  register size_t i;
   register struct Lisp_Vector *p;
 
   XSETFASTINT (len, nargs);
@@ -2945,10 +2945,10 @@
 The first four arguments are required; at most six have any
 significance.
 usage: (make-byte-code ARGLIST BYTE-CODE CONSTANTS DEPTH &optional DOCSTRING INTERACTIVE-SPEC &rest ELEMENTS)  */)
-  (register int nargs, Lisp_Object *args)
+  (register size_t nargs, Lisp_Object *args)
 {
   register Lisp_Object len, val;
-  register int i;
+  register size_t i;
   register struct Lisp_Vector *p;
 
   XSETFASTINT (len, nargs);
@@ -4230,7 +4230,7 @@
 check_gcpros (void)
 {
   struct gcpro *p;
-  int i;
+  size_t i;
 
   for (p = gcprolist; p; p = p->next)
     for (i = 0; i < p->nvars; ++i)
@@ -4839,7 +4839,7 @@
 {
   register struct specbinding *bind;
   char stack_top_variable;
-  register int i;
+  register size_t i;
   int message_p;
   Lisp_Object total[8];
   int count = SPECPDL_INDEX ();

=== modified file 'src/callint.c'
--- src/callint.c	2011-03-23 10:06:57 +0000
+++ src/callint.c	2011-03-27 02:12:36 +0000
@@ -265,8 +265,9 @@
      recorded as a call to the function named callint_argfuns[varies[i]].  */
   int *varies;
 
-  register int i, j;
-  int count, foo;
+  register size_t i, j;
+  size_t count;
+  int foo;
   char prompt1[100];
   char *tem1;
   int arg_from_tty = 0;

=== modified file 'src/callproc.c'
--- src/callproc.c	2011-03-18 05:56:46 +0000
+++ src/callproc.c	2011-03-27 02:12:36 +0000
@@ -177,7 +177,7 @@
 If you quit, the process is killed with SIGINT, or SIGKILL if you quit again.
 
 usage: (call-process PROGRAM &optional INFILE BUFFER DISPLAY &rest ARGS)  */)
-  (int nargs, register Lisp_Object *args)
+  (size_t nargs, register Lisp_Object *args)
 {
   Lisp_Object infile, buffer, current_dir, path;
   volatile int display_p_volatile;
@@ -221,7 +221,7 @@
   /* Decide the coding-system for giving arguments.  */
   {
     Lisp_Object val, *args2;
-    int i;
+    size_t i;
 
     /* If arguments are supplied, we may have to encode them.  */
     if (nargs >= 5)
@@ -373,10 +373,10 @@
     path = Fsubstring (path, make_number (2), Qnil);
 
   new_argv_volatile = new_argv = (const unsigned char **)
-    alloca (max (2, nargs - 2) * sizeof (char *));
+    alloca ((nargs > 4 ? nargs - 2 : 2) * sizeof (char *));
   if (nargs > 4)
     {
-      register int i;
+      register size_t i;
       struct gcpro gcpro1, gcpro2, gcpro3, gcpro4, gcpro5;
 
       GCPRO5 (infile, buffer, current_dir, path, error_file);
@@ -643,7 +643,7 @@
 	{
 	  if (EQ (coding_systems, Qt))
 	    {
-	      int i;
+	      size_t i;
 
 	      args2 = (Lisp_Object *) alloca ((nargs + 1) * sizeof *args2);
 	      args2[0] = Qcall_process;
@@ -864,7 +864,7 @@
 If you quit, the process is killed with SIGINT, or SIGKILL if you quit again.
 
 usage: (call-process-region START END PROGRAM &optional DELETE BUFFER DISPLAY &rest ARGS)  */)
-  (int nargs, register Lisp_Object *args)
+  (size_t nargs, register Lisp_Object *args)
 {
   struct gcpro gcpro1;
   Lisp_Object filename_string;
@@ -873,7 +873,7 @@
   /* Qt denotes we have not yet called Ffind_operation_coding_system.  */
   Lisp_Object coding_systems;
   Lisp_Object val, *args2;
-  int i;
+  size_t i;
   char *tempfile;
   Lisp_Object tmpdir, pattern;
 

=== modified file 'src/character.c'
--- src/character.c	2011-03-08 07:49:41 +0000
+++ src/character.c	2011-03-27 02:12:36 +0000
@@ -893,9 +893,10 @@
        doc: /*
 Concatenate all the argument characters and make the result a string.
 usage: (string &rest CHARACTERS)  */)
-  (int n, Lisp_Object *args)
+  (size_t n, Lisp_Object *args)
 {
-  int i, c;
+  size_t i;
+  int c;
   unsigned char *buf, *p;
   Lisp_Object str;
   USE_SAFE_ALLOCA;
@@ -918,9 +919,10 @@
 DEFUN ("unibyte-string", Funibyte_string, Sunibyte_string, 0, MANY, 0,
        doc: /* Concatenate all the argument bytes and make the result a unibyte string.
 usage: (unibyte-string &rest BYTES)  */)
-  (int n, Lisp_Object *args)
+  (size_t n, Lisp_Object *args)
 {
-  int i, c;
+  size_t i;
+  int c;
   unsigned char *buf, *p;
   Lisp_Object str;
   USE_SAFE_ALLOCA;

=== modified file 'src/charset.c'
--- src/charset.c	2011-03-08 00:46:23 +0000
+++ src/charset.c	2011-03-27 02:12:36 +0000
@@ -845,7 +845,7 @@
        Sdefine_charset_internal, charset_arg_max, MANY, 0,
        doc: /* For internal use only.
 usage: (define-charset-internal ...)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   /* Charset attr vector.  */
   Lisp_Object attrs;
@@ -2171,11 +2171,12 @@
        1, MANY, 0,
        doc: /* Assign higher priority to the charsets given as arguments.
 usage: (set-charset-priority &rest charsets)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   Lisp_Object new_head, old_list, arglist[2];
   Lisp_Object list_2022, list_emacs_mule;
-  int i, id;
+  size_t i;
+  int id;
 
   old_list = Fcopy_sequence (Vcharset_ordered_list);
   new_head = Qnil;

=== modified file 'src/coding.c'
--- src/coding.c	2011-03-22 16:20:45 +0000
+++ src/coding.c	2011-03-27 02:12:36 +0000
@@ -9300,7 +9300,7 @@
 contents of BUFFER instead of reading the file.
 
 usage: (find-operation-coding-system OPERATION ARGUMENTS...)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   Lisp_Object operation, target_idx, target, val;
   register Lisp_Object chain;
@@ -9309,17 +9309,17 @@
     error ("Too few arguments");
   operation = args[0];
   if (!SYMBOLP (operation)
-      || !INTEGERP (target_idx = Fget (operation, Qtarget_idx)))
+      || !NATNUMP (target_idx = Fget (operation, Qtarget_idx)))
     error ("Invalid first argument");
-  if (nargs < 1 + XINT (target_idx))
+  if (nargs < 1 + XFASTINT (target_idx))
     error ("Too few arguments for operation: %s",
 	   SDATA (SYMBOL_NAME (operation)));
-  target = args[XINT (target_idx) + 1];
+  target = args[XFASTINT (target_idx) + 1];
   if (!(STRINGP (target)
 	|| (EQ (operation, Qinsert_file_contents) && CONSP (target)
 	    && STRINGP (XCAR (target)) && BUFFERP (XCDR (target)))
 	|| (EQ (operation, Qopen_network_stream) && INTEGERP (target))))
-    error ("Invalid %dth argument", XINT (target_idx) + 1);
+    error ("Invalid %dth argument", XFASTINT (target_idx) + 1);
   if (CONSP (target))
     target = XCAR (target);
 
@@ -9376,9 +9376,9 @@
 all but the first one are ignored.
 
 usage: (set-coding-system-priority &rest coding-systems)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
-  int i, j;
+  size_t i, j;
   int changed[coding_category_max];
   enum coding_category priorities[coding_category_max];
 
@@ -9421,7 +9421,7 @@
 
   /* Update `coding-category-list'.  */
   Vcoding_category_list = Qnil;
-  for (i = coding_category_max - 1; i >= 0; i--)
+  for (i = coding_category_max; i-- > 0; )
     Vcoding_category_list
       = Fcons (AREF (Vcoding_category_table, priorities[i]),
 	       Vcoding_category_list);
@@ -9482,7 +9482,7 @@
        Sdefine_coding_system_internal, coding_arg_max, MANY, 0,
        doc: /* For internal use only.
 usage: (define-coding-system-internal ...)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   Lisp_Object name;
   Lisp_Object spec_vec;		/* [ ATTRS ALIASE EOL_TYPE ] */

=== modified file 'src/data.c'
--- src/data.c	2011-03-15 23:22:38 +0000
+++ src/data.c	2011-03-27 02:12:36 +0000
@@ -2474,13 +2474,13 @@
     Amin
   };
 
-static Lisp_Object float_arith_driver (double, int, enum arithop,
-                                       int, Lisp_Object *);
+static Lisp_Object float_arith_driver (double, size_t, enum arithop,
+                                       size_t, Lisp_Object *);
 static Lisp_Object
-arith_driver (enum arithop code, int nargs, register Lisp_Object *args)
+arith_driver (enum arithop code, size_t nargs, register Lisp_Object *args)
 {
   register Lisp_Object val;
-  register int argnum;
+  register size_t argnum;
   register EMACS_INT accum = 0;
   register EMACS_INT next;
 
@@ -2562,7 +2562,8 @@
 #define isnan(x) ((x) != (x))
 
 static Lisp_Object
-float_arith_driver (double accum, register int argnum, enum arithop code, int nargs, register Lisp_Object *args)
+float_arith_driver (double accum, register size_t argnum, enum arithop code,
+		    size_t nargs, register Lisp_Object *args)
 {
   register Lisp_Object val;
   double next;
@@ -2624,7 +2625,7 @@
 DEFUN ("+", Fplus, Splus, 0, MANY, 0,
        doc: /* Return sum of any number of arguments, which are numbers or markers.
 usage: (+ &rest NUMBERS-OR-MARKERS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   return arith_driver (Aadd, nargs, args);
 }
@@ -2634,7 +2635,7 @@
 With one arg, negates it.  With more than one arg,
 subtracts all but the first from the first.
 usage: (- &optional NUMBER-OR-MARKER &rest MORE-NUMBERS-OR-MARKERS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   return arith_driver (Asub, nargs, args);
 }
@@ -2642,7 +2643,7 @@
 DEFUN ("*", Ftimes, Stimes, 0, MANY, 0,
        doc: /* Return product of any number of arguments, which are numbers or markers.
 usage: (* &rest NUMBERS-OR-MARKERS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   return arith_driver (Amult, nargs, args);
 }
@@ -2651,9 +2652,9 @@
        doc: /* Return first argument divided by all the remaining arguments.
 The arguments must be numbers or markers.
 usage: (/ DIVIDEND DIVISOR &rest DIVISORS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
-  int argnum;
+  size_t argnum;
   for (argnum = 2; argnum < nargs; argnum++)
     if (FLOATP (args[argnum]))
       return float_arith_driver (0, 0, Adiv, nargs, args);
@@ -2735,7 +2736,7 @@
        doc: /* Return largest of all the arguments (which must be numbers or markers).
 The value is always a number; markers are converted to numbers.
 usage: (max NUMBER-OR-MARKER &rest NUMBERS-OR-MARKERS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   return arith_driver (Amax, nargs, args);
 }
@@ -2744,7 +2745,7 @@
        doc: /* Return smallest of all the arguments (which must be numbers or markers).
 The value is always a number; markers are converted to numbers.
 usage: (min NUMBER-OR-MARKER &rest NUMBERS-OR-MARKERS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   return arith_driver (Amin, nargs, args);
 }
@@ -2753,7 +2754,7 @@
        doc: /* Return bitwise-and of all the arguments.
 Arguments may be integers, or markers converted to integers.
 usage: (logand &rest INTS-OR-MARKERS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   return arith_driver (Alogand, nargs, args);
 }
@@ -2762,7 +2763,7 @@
        doc: /* Return bitwise-or of all the arguments.
 Arguments may be integers, or markers converted to integers.
 usage: (logior &rest INTS-OR-MARKERS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   return arith_driver (Alogior, nargs, args);
 }
@@ -2771,7 +2772,7 @@
        doc: /* Return bitwise-exclusive-or of all the arguments.
 Arguments may be integers, or markers converted to integers.
 usage: (logxor &rest INTS-OR-MARKERS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   return arith_driver (Alogxor, nargs, args);
 }

=== modified file 'src/dbusbind.c'
--- src/dbusbind.c	2011-03-14 03:25:51 +0000
+++ src/dbusbind.c	2011-03-27 02:12:36 +0000
@@ -1051,7 +1051,7 @@
   => "i686"
 
 usage: (dbus-call-method BUS SERVICE PATH INTERFACE METHOD &optional :timeout TIMEOUT &rest ARGS)  */)
-  (int nargs, register Lisp_Object *args)
+  (size_t nargs, register Lisp_Object *args)
 {
   Lisp_Object bus, service, path, interface, method;
   Lisp_Object result;
@@ -1063,7 +1063,7 @@
   DBusError derror;
   unsigned int dtype;
   int timeout = -1;
-  int i = 5;
+  size_t i = 5;
   char signature[DBUS_MAXIMUM_SIGNATURE_LENGTH];
 
   /* Check parameters.  */
@@ -1116,7 +1116,7 @@
 	{
 	  XD_DEBUG_VALID_LISP_OBJECT_P (args[i]);
 	  XD_DEBUG_VALID_LISP_OBJECT_P (args[i+1]);
-	  XD_DEBUG_MESSAGE ("Parameter%d %s %s", i-4,
+	  XD_DEBUG_MESSAGE ("Parameter%lu %s %s", (unsigned long) (i-4),
 			    SDATA (format2 ("%s", args[i], Qnil)),
 			    SDATA (format2 ("%s", args[i+1], Qnil)));
 	  ++i;
@@ -1124,7 +1124,7 @@
       else
 	{
 	  XD_DEBUG_VALID_LISP_OBJECT_P (args[i]);
-	  XD_DEBUG_MESSAGE ("Parameter%d %s", i-4,
+	  XD_DEBUG_MESSAGE ("Parameter%lu %s", (unsigned long) (i-4),
 			    SDATA (format2 ("%s", args[i], Qnil)));
 	}
 
@@ -1233,7 +1233,7 @@
   -| i686
 
 usage: (dbus-call-method-asynchronously BUS SERVICE PATH INTERFACE METHOD HANDLER &optional :timeout TIMEOUT &rest ARGS)  */)
-  (int nargs, register Lisp_Object *args)
+  (size_t nargs, register Lisp_Object *args)
 {
   Lisp_Object bus, service, path, interface, method, handler;
   Lisp_Object result;
@@ -1243,7 +1243,7 @@
   DBusMessageIter iter;
   unsigned int dtype;
   int timeout = -1;
-  int i = 6;
+  size_t i = 6;
   char signature[DBUS_MAXIMUM_SIGNATURE_LENGTH];
 
   /* Check parameters.  */
@@ -1298,7 +1298,7 @@
 	{
 	  XD_DEBUG_VALID_LISP_OBJECT_P (args[i]);
 	  XD_DEBUG_VALID_LISP_OBJECT_P (args[i+1]);
-	  XD_DEBUG_MESSAGE ("Parameter%d %s %s", i-4,
+	  XD_DEBUG_MESSAGE ("Parameter%lu %s %s", (unsigned long) (i-4),
 			    SDATA (format2 ("%s", args[i], Qnil)),
 			    SDATA (format2 ("%s", args[i+1], Qnil)));
 	  ++i;
@@ -1306,7 +1306,7 @@
       else
 	{
 	  XD_DEBUG_VALID_LISP_OBJECT_P (args[i]);
-	  XD_DEBUG_MESSAGE ("Parameter%d %s", i-4,
+	  XD_DEBUG_MESSAGE ("Parameter%lu %s", (unsigned long) (i - 4),
 			    SDATA (format2 ("%s", args[i], Qnil)));
 	}
 
@@ -1357,7 +1357,7 @@
 This is an internal function, it shall not be used outside dbus.el.
 
 usage: (dbus-method-return-internal BUS SERIAL SERVICE &rest ARGS)  */)
-  (int nargs, register Lisp_Object *args)
+  (size_t nargs, register Lisp_Object *args)
 {
   Lisp_Object bus, serial, service;
   struct gcpro gcpro1, gcpro2, gcpro3;
@@ -1365,7 +1365,7 @@
   DBusMessage *dmessage;
   DBusMessageIter iter;
   unsigned int dtype;
-  int i;
+  size_t i;
   char signature[DBUS_MAXIMUM_SIGNATURE_LENGTH];
 
   /* Check parameters.  */
@@ -1405,7 +1405,7 @@
 	{
 	  XD_DEBUG_VALID_LISP_OBJECT_P (args[i]);
 	  XD_DEBUG_VALID_LISP_OBJECT_P (args[i+1]);
-	  XD_DEBUG_MESSAGE ("Parameter%d %s %s", i-2,
+	  XD_DEBUG_MESSAGE ("Parameter%lu %s %s", (unsigned long) (i-2),
 			    SDATA (format2 ("%s", args[i], Qnil)),
 			    SDATA (format2 ("%s", args[i+1], Qnil)));
 	  ++i;
@@ -1413,7 +1413,7 @@
       else
 	{
 	  XD_DEBUG_VALID_LISP_OBJECT_P (args[i]);
-	  XD_DEBUG_MESSAGE ("Parameter%d %s", i-2,
+	  XD_DEBUG_MESSAGE ("Parameter%lu %s", (unsigned long) (i-2),
 			    SDATA (format2 ("%s", args[i], Qnil)));
 	}
 
@@ -1445,7 +1445,7 @@
 This is an internal function, it shall not be used outside dbus.el.
 
 usage: (dbus-method-error-internal BUS SERIAL SERVICE &rest ARGS)  */)
-  (int nargs, register Lisp_Object *args)
+  (size_t nargs, register Lisp_Object *args)
 {
   Lisp_Object bus, serial, service;
   struct gcpro gcpro1, gcpro2, gcpro3;
@@ -1453,7 +1453,7 @@
   DBusMessage *dmessage;
   DBusMessageIter iter;
   unsigned int dtype;
-  int i;
+  size_t i;
   char signature[DBUS_MAXIMUM_SIGNATURE_LENGTH];
 
   /* Check parameters.  */
@@ -1494,7 +1494,7 @@
 	{
 	  XD_DEBUG_VALID_LISP_OBJECT_P (args[i]);
 	  XD_DEBUG_VALID_LISP_OBJECT_P (args[i+1]);
-	  XD_DEBUG_MESSAGE ("Parameter%d %s %s", i-2,
+	  XD_DEBUG_MESSAGE ("Parameter%lu %s %s", (unsigned long) (i-2),
 			    SDATA (format2 ("%s", args[i], Qnil)),
 			    SDATA (format2 ("%s", args[i+1], Qnil)));
 	  ++i;
@@ -1502,7 +1502,7 @@
       else
 	{
 	  XD_DEBUG_VALID_LISP_OBJECT_P (args[i]);
-	  XD_DEBUG_MESSAGE ("Parameter%d %s", i-2,
+	  XD_DEBUG_MESSAGE ("Parameter%lu %s", (unsigned long) (i-2),
 			    SDATA (format2 ("%s", args[i], Qnil)));
 	}
 
@@ -1557,7 +1557,7 @@
   "org.gnu.Emacs.FileManager" "FileModified" "/home/albinus/.emacs")
 
 usage: (dbus-send-signal BUS SERVICE PATH INTERFACE SIGNAL &rest ARGS)  */)
-  (int nargs, register Lisp_Object *args)
+  (size_t nargs, register Lisp_Object *args)
 {
   Lisp_Object bus, service, path, interface, signal;
   struct gcpro gcpro1, gcpro2, gcpro3, gcpro4, gcpro5;
@@ -1565,7 +1565,7 @@
   DBusMessage *dmessage;
   DBusMessageIter iter;
   unsigned int dtype;
-  int i;
+  size_t i;
   char signature[DBUS_MAXIMUM_SIGNATURE_LENGTH];
 
   /* Check parameters.  */
@@ -1609,7 +1609,7 @@
 	{
 	  XD_DEBUG_VALID_LISP_OBJECT_P (args[i]);
 	  XD_DEBUG_VALID_LISP_OBJECT_P (args[i+1]);
-	  XD_DEBUG_MESSAGE ("Parameter%d %s %s", i-4,
+	  XD_DEBUG_MESSAGE ("Parameter%lu %s %s", (unsigned long) (i-4),
 			    SDATA (format2 ("%s", args[i], Qnil)),
 			    SDATA (format2 ("%s", args[i+1], Qnil)));
 	  ++i;
@@ -1617,7 +1617,7 @@
       else
 	{
 	  XD_DEBUG_VALID_LISP_OBJECT_P (args[i]);
-	  XD_DEBUG_MESSAGE ("Parameter%d %s", i-4,
+	  XD_DEBUG_MESSAGE ("Parameter%lu %s", (unsigned long) (i-4),
 			    SDATA (format2 ("%s", args[i], Qnil)));
 	}
 
@@ -1885,11 +1885,11 @@
   => :already-owner.
 
 usage: (dbus-register-service BUS SERVICE &rest FLAGS)  */)
-  (int nargs, register Lisp_Object *args)
+  (size_t nargs, register Lisp_Object *args)
 {
   Lisp_Object bus, service;
   DBusConnection *connection;
-  unsigned int i;
+  size_t i;
   unsigned int value;
   unsigned int flags = 0;
   int result;
@@ -1985,13 +1985,13 @@
 `dbus-unregister-object' for removing the registration.
 
 usage: (dbus-register-signal BUS SERVICE PATH INTERFACE SIGNAL HANDLER &rest ARGS) */)
-  (int nargs, register Lisp_Object *args)
+  (size_t nargs, register Lisp_Object *args)
 {
   Lisp_Object bus, service, path, interface, signal, handler;
   struct gcpro gcpro1, gcpro2, gcpro3, gcpro4, gcpro5, gcpro6;
   Lisp_Object uname, key, key1, value;
   DBusConnection *connection;
-  int i;
+  size_t i;
   char rule[DBUS_MAXIMUM_MATCH_RULE_LENGTH];
   char x[DBUS_MAXIMUM_MATCH_RULE_LENGTH];
   DBusError derror;
@@ -2061,7 +2061,8 @@
 	if (!NILP (args[i]))
 	  {
 	    CHECK_STRING (args[i]);
-	    sprintf (x, ",arg%d='%s'", i-6, SDATA (args[i]));
+	    sprintf (x, ",arg%lu='%s'", (unsigned long) (i-6),
+		     SDATA (args[i]));
 	    strcat (rule, x);
 	  }
 

=== modified file 'src/editfns.c'
--- src/editfns.c	2011-03-23 10:06:57 +0000
+++ src/editfns.c	2011-03-27 02:12:36 +0000
@@ -101,7 +101,7 @@
 				     void (*) (Lisp_Object, EMACS_INT,
 					       EMACS_INT, EMACS_INT,
 					       EMACS_INT, int),
-				     int, int, Lisp_Object *);
+				     int, size_t, Lisp_Object *);
 static Lisp_Object subst_char_in_region_unwind (Lisp_Object);
 static Lisp_Object subst_char_in_region_unwind_1 (Lisp_Object);
 static void transpose_markers (EMACS_INT, EMACS_INT, EMACS_INT, EMACS_INT,
@@ -1871,7 +1871,7 @@
 year values as low as 1901 do work.
 
 usage: (encode-time SECOND MINUTE HOUR DAY MONTH YEAR &optional ZONE)  */)
-  (int nargs, register Lisp_Object *args)
+  (size_t nargs, register Lisp_Object *args)
 {
   time_t value;
   struct tm tm;
@@ -2207,9 +2207,9 @@
 			 void (*insert_from_string_func)
 			      (Lisp_Object, EMACS_INT, EMACS_INT,
 			       EMACS_INT, EMACS_INT, int),
-			 int inherit, int nargs, Lisp_Object *args)
+			 int inherit, size_t nargs, Lisp_Object *args)
 {
-  register int argnum;
+  register size_t argnum;
   register Lisp_Object val;
 
   for (argnum = 0; argnum < nargs; argnum++)
@@ -2272,7 +2272,7 @@
 and insert the result.
 
 usage: (insert &rest ARGS)  */)
-  (int nargs, register Lisp_Object *args)
+  (size_t nargs, register Lisp_Object *args)
 {
   general_insert_function (insert, insert_from_string, 0, nargs, args);
   return Qnil;
@@ -2291,7 +2291,7 @@
 to unibyte for insertion.
 
 usage: (insert-and-inherit &rest ARGS)  */)
-  (int nargs, register Lisp_Object *args)
+  (size_t nargs, register Lisp_Object *args)
 {
   general_insert_function (insert_and_inherit, insert_from_string, 1,
 			   nargs, args);
@@ -2308,7 +2308,7 @@
 to unibyte for insertion.
 
 usage: (insert-before-markers &rest ARGS)  */)
-  (int nargs, register Lisp_Object *args)
+  (size_t nargs, register Lisp_Object *args)
 {
   general_insert_function (insert_before_markers,
 			   insert_from_string_before_markers, 0,
@@ -2327,7 +2327,7 @@
 to unibyte for insertion.
 
 usage: (insert-before-markers-and-inherit &rest ARGS)  */)
-  (int nargs, register Lisp_Object *args)
+  (size_t nargs, register Lisp_Object *args)
 {
   general_insert_function (insert_before_markers_and_inherit,
 			   insert_from_string_before_markers, 1,
@@ -3399,7 +3399,7 @@
 also `current-message'.
 
 usage: (message FORMAT-STRING &rest ARGS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   if (NILP (args[0])
       || (STRINGP (args[0])
@@ -3427,7 +3427,7 @@
 message; let the minibuffer contents show.
 
 usage: (message-box FORMAT-STRING &rest ARGS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   if (NILP (args[0]))
     {
@@ -3484,7 +3484,7 @@
 message; let the minibuffer contents show.
 
 usage: (message-or-box FORMAT-STRING &rest ARGS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
 #ifdef HAVE_MENUS
   if ((NILP (last_nonmenu_event) || CONSP (last_nonmenu_event))
@@ -3508,14 +3508,14 @@
 Remaining arguments form a sequence of PROPERTY VALUE pairs for text
 properties to add to the result.
 usage: (propertize STRING &rest PROPERTIES)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   Lisp_Object properties, string;
   struct gcpro gcpro1, gcpro2;
-  int i;
+  size_t i;
 
   /* Number of args must be odd.  */
-  if ((nargs & 1) == 0 || nargs < 1)
+  if ((nargs & 1) == 0)
     error ("Wrong number of arguments");
 
   properties = string = Qnil;
@@ -3590,10 +3590,10 @@
 specifier truncates the string to the given width.
 
 usage: (format STRING &rest OBJECTS)  */)
-  (int nargs, register Lisp_Object *args)
+  (size_t nargs, register Lisp_Object *args)
 {
-  register int n;		/* The number of the next arg to substitute */
-  register EMACS_INT total;	/* An estimate of the final length */
+  register size_t n;		/* The number of the next arg to substitute */
+  register size_t total;	/* An estimate of the final length */
   char *buf, *p;
   register char *format, *end, *format_start;
   int nchars;
@@ -3669,8 +3669,8 @@
 
   /* Allocate the info and discarded tables.  */
   {
-    int nbytes = (nargs+1) * sizeof *info;
-    int i;
+    size_t nbytes = (nargs+1) * sizeof *info;
+    size_t i;
     if (!info)
       info = (struct info *) alloca (nbytes);
     memset (info, 0, nbytes);

=== modified file 'src/eval.c'
--- src/eval.c	2011-03-16 07:44:19 +0000
+++ src/eval.c	2011-03-27 02:12:36 +0000
@@ -38,9 +38,9 @@
   struct backtrace *next;
   Lisp_Object *function;
   Lisp_Object *args;	/* Points to vector of args. */
-  int nargs;		/* Length of vector.
-			   If nargs is UNEVALLED, args points to slot holding
-			   list of unevalled args */
+  size_t nargs;		/* Length of vector.
+			   If nargs is (size_t) UNEVALLED, args points
+			   to slot holding list of unevalled args */
   char evalargs;
   /* Nonzero means call value of debugger when done with this operation. */
   char debug_on_exit;
@@ -111,7 +111,7 @@
 
 int handling_signal;
 
-static Lisp_Object funcall_lambda (Lisp_Object, int, Lisp_Object*);
+static Lisp_Object funcall_lambda (Lisp_Object, size_t, Lisp_Object*);
 static void unwind_to_catch (struct catchtag *, Lisp_Object) NO_RETURN;
 static int interactive_p (int);
 static Lisp_Object apply_lambda (Lisp_Object, Lisp_Object, int);
@@ -553,7 +553,7 @@
      looking at several frames for special forms.  Skip past them.  */
   while (btp
 	 && (EQ (*btp->function, Qbytecode)
-	     || btp->nargs == UNEVALLED))
+	     || btp->nargs == (size_t) UNEVALLED))
     btp = btp->next;
 
   /* btp now points at the frame of the innermost function that isn't
@@ -959,7 +959,7 @@
   Lisp_Object *temps, tem;
   register Lisp_Object elt, varlist;
   int count = SPECPDL_INDEX ();
-  register int argnum;
+  register size_t argnum;
   struct gcpro gcpro1, gcpro2;
   USE_SAFE_ALLOCA;
 
@@ -1511,8 +1511,8 @@
    and ARGS as second argument.  */
 
 Lisp_Object
-internal_condition_case_n (Lisp_Object (*bfun) (int, Lisp_Object*),
-			   int nargs,
+internal_condition_case_n (Lisp_Object (*bfun) (size_t, Lisp_Object *),
+			   size_t nargs,
 			   Lisp_Object *args,
 			   Lisp_Object handlers,
 			   Lisp_Object (*hfun) (Lisp_Object))
@@ -2203,7 +2203,7 @@
 	{
 	  /* Pass a vector of evaluated arguments */
 	  Lisp_Object *vals;
-	  register int argnum = 0;
+	  register size_t argnum = 0;
 	  USE_SAFE_ALLOCA;
 
 	  SAFE_ALLOCA_LISP (vals, XINT (numargs));
@@ -2332,9 +2332,9 @@
 Then return the value FUNCTION returns.
 Thus, (apply '+ 1 2 '(3 4)) returns 10.
 usage: (apply FUNCTION &rest ARGUMENTS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
-  register int i, numargs;
+  register size_t i, numargs;
   register Lisp_Object spread_arg;
   register Lisp_Object *funcall_args;
   Lisp_Object fun, retval;
@@ -2374,7 +2374,7 @@
       if (numargs < XSUBR (fun)->min_args
 	  || (XSUBR (fun)->max_args >= 0 && XSUBR (fun)->max_args < numargs))
 	goto funcall;		/* Let funcall get the error */
-      else if (XSUBR (fun)->max_args > numargs)
+      else if (XSUBR (fun)->max_args >= 0 && XSUBR (fun)->max_args > numargs)
 	{
 	  /* Avoid making funcall cons up a yet another new vector of arguments
 	     by explicitly supplying nil's for optional values */
@@ -2416,7 +2416,7 @@
 /* Run hook variables in various ways.  */
 
 enum run_hooks_condition {to_completion, until_success, until_failure};
-static Lisp_Object run_hook_with_args (int, Lisp_Object *,
+static Lisp_Object run_hook_with_args (size_t, Lisp_Object *,
 				       enum run_hooks_condition);
 
 DEFUN ("run-hooks", Frun_hooks, Srun_hooks, 0, MANY, 0,
@@ -2434,10 +2434,10 @@
 Do not use `make-local-variable' to make a hook variable buffer-local.
 Instead, use `add-hook' and specify t for the LOCAL argument.
 usage: (run-hooks &rest HOOKS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   Lisp_Object hook[1];
-  register int i;
+  register size_t i;
 
   for (i = 0; i < nargs; i++)
     {
@@ -2463,7 +2463,7 @@
 Do not use `make-local-variable' to make a hook variable buffer-local.
 Instead, use `add-hook' and specify t for the LOCAL argument.
 usage: (run-hook-with-args HOOK &rest ARGS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   return run_hook_with_args (nargs, args, to_completion);
 }
@@ -2483,7 +2483,7 @@
 Do not use `make-local-variable' to make a hook variable buffer-local.
 Instead, use `add-hook' and specify t for the LOCAL argument.
 usage: (run-hook-with-args-until-success HOOK &rest ARGS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   return run_hook_with_args (nargs, args, until_success);
 }
@@ -2502,7 +2502,7 @@
 Do not use `make-local-variable' to make a hook variable buffer-local.
 Instead, use `add-hook' and specify t for the LOCAL argument.
 usage: (run-hook-with-args-until-failure HOOK &rest ARGS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   return run_hook_with_args (nargs, args, until_failure);
 }
@@ -2516,7 +2516,8 @@
    except that it isn't necessary to gcpro ARGS[0].  */
 
 static Lisp_Object
-run_hook_with_args (int nargs, Lisp_Object *args, enum run_hooks_condition cond)
+run_hook_with_args (size_t nargs, Lisp_Object *args,
+		    enum run_hooks_condition cond)
 {
   Lisp_Object sym, val, ret;
   struct gcpro gcpro1, gcpro2, gcpro3;
@@ -2763,16 +2764,16 @@
 Return the value that function returns.
 Thus, (funcall 'cons 'x 'y) returns (x . y).
 usage: (funcall FUNCTION &rest ARGUMENTS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   Lisp_Object fun, original_fun;
   Lisp_Object funcar;
-  int numargs = nargs - 1;
+  size_t numargs = nargs - 1;
   Lisp_Object lisp_numargs;
   Lisp_Object val;
   struct backtrace backtrace;
   register Lisp_Object *internal_args;
-  register int i;
+  register size_t i;
 
   QUIT;
   if ((consing_since_gc > gc_cons_threshold
@@ -2925,21 +2926,21 @@
 apply_lambda (Lisp_Object fun, Lisp_Object args, int eval_flag)
 {
   Lisp_Object args_left;
-  Lisp_Object numargs;
+  size_t numargs;
   register Lisp_Object *arg_vector;
   struct gcpro gcpro1, gcpro2, gcpro3;
-  register int i;
+  register size_t i;
   register Lisp_Object tem;
   USE_SAFE_ALLOCA;
 
-  numargs = Flength (args);
-  SAFE_ALLOCA_LISP (arg_vector, XINT (numargs));
+  numargs = XINT (Flength (args));
+  SAFE_ALLOCA_LISP (arg_vector, numargs);
   args_left = args;
 
   GCPRO3 (*arg_vector, args_left, fun);
   gcpro1.nvars = 0;
 
-  for (i = 0; i < XINT (numargs);)
+  for (i = 0; i < numargs; )
     {
       tem = Fcar (args_left), args_left = Fcdr (args_left);
       if (eval_flag) tem = Feval (tem);
@@ -2955,7 +2956,7 @@
       backtrace_list->nargs = i;
     }
   backtrace_list->evalargs = 0;
-  tem = funcall_lambda (fun, XINT (numargs), arg_vector);
+  tem = funcall_lambda (fun, numargs, arg_vector);
 
   /* Do the debug-on-exit now, while arg_vector still exists.  */
   if (backtrace_list->debug_on_exit)
@@ -2971,11 +2972,13 @@
    FUN must be either a lambda-expression or a compiled-code object.  */
 
 static Lisp_Object
-funcall_lambda (Lisp_Object fun, int nargs, register Lisp_Object *arg_vector)
+funcall_lambda (Lisp_Object fun, size_t nargs,
+		register Lisp_Object *arg_vector)
 {
   Lisp_Object val, syms_left, next;
   int count = SPECPDL_INDEX ();
-  int i, optional, rest;
+  size_t i;
+  int optional, rest;
 
   if (CONSP (fun))
     {
@@ -3310,7 +3313,7 @@
   while (backlist)
     {
       write_string (backlist->debug_on_exit ? "* " : "  ", 2);
-      if (backlist->nargs == UNEVALLED)
+      if (backlist->nargs == (size_t) UNEVALLED)
 	{
 	  Fprin1 (Fcons (*backlist->function, *backlist->args), Qnil);
 	  write_string ("\n", -1);
@@ -3320,7 +3323,7 @@
 	  tem = *backlist->function;
 	  Fprin1 (tem, Qnil);	/* This can QUIT */
 	  write_string ("(", -1);
-	  if (backlist->nargs == MANY)
+	  if (backlist->nargs == (size_t) MANY)
 	    {
 	      for (tail = *backlist->args, i = 0;
 		   !NILP (tail);
@@ -3372,11 +3375,11 @@
 
   if (!backlist)
     return Qnil;
-  if (backlist->nargs == UNEVALLED)
+  if (backlist->nargs == (size_t) UNEVALLED)
     return Fcons (Qnil, Fcons (*backlist->function, *backlist->args));
   else
     {
-      if (backlist->nargs == MANY)
+      if (backlist->nargs == (size_t) MANY)
 	tem = *backlist->args;
       else
 	tem = Flist (backlist->nargs, backlist->args);
@@ -3390,17 +3393,18 @@
 mark_backtrace (void)
 {
   register struct backtrace *backlist;
-  register int i;
+  register size_t i;
 
   for (backlist = backtrace_list; backlist; backlist = backlist->next)
     {
       mark_object (*backlist->function);
 
-      if (backlist->nargs == UNEVALLED || backlist->nargs == MANY)
-	i = 0;
+      if (backlist->nargs == (size_t) UNEVALLED
+	  || backlist->nargs == (size_t) MANY)
+	i = 1;
       else
-	i = backlist->nargs - 1;
-      for (; i >= 0; i--)
+	i = backlist->nargs;
+      while (i--)
 	mark_object (backlist->args[i]);
     }
 }

=== modified file 'src/fns.c'
--- src/fns.c	2011-03-16 07:49:54 +0000
+++ src/fns.c	2011-03-27 02:12:36 +0000
@@ -348,7 +348,7 @@
   return i1 < SCHARS (s2) ? Qt : Qnil;
 }
 \f
-static Lisp_Object concat (int nargs, Lisp_Object *args,
+static Lisp_Object concat (size_t nargs, Lisp_Object *args,
 			   enum Lisp_Type target_type, int last_special);
 
 /* ARGSUSED */
@@ -378,7 +378,7 @@
 Each argument may be a list, vector or string.
 The last argument is not copied, just used as the tail of the new list.
 usage: (append &rest SEQUENCES)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   return concat (nargs, args, Lisp_Cons, 1);
 }
@@ -388,7 +388,7 @@
 The result is a string whose elements are the elements of all the arguments.
 Each argument may be a string or a list or vector of characters (integers).
 usage: (concat &rest SEQUENCES)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   return concat (nargs, args, Lisp_String, 0);
 }
@@ -398,7 +398,7 @@
 The result is a vector whose elements are the elements of all the arguments.
 Each argument may be a list, vector or string.
 usage: (vconcat &rest SEQUENCES)   */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   return concat (nargs, args, Lisp_Vectorlike, 0);
 }
@@ -446,7 +446,8 @@
 };
 
 static Lisp_Object
-concat (int nargs, Lisp_Object *args, enum Lisp_Type target_type, int last_special)
+concat (size_t nargs, Lisp_Object *args,
+	enum Lisp_Type target_type, int last_special)
 {
   Lisp_Object val;
   register Lisp_Object tail;
@@ -455,7 +456,7 @@
   EMACS_INT toindex_byte = 0;
   register EMACS_INT result_len;
   register EMACS_INT result_len_byte;
-  register int argnum;
+  register size_t argnum;
   Lisp_Object last_tail;
   Lisp_Object prev;
   int some_multibyte;
@@ -2232,9 +2233,9 @@
        doc: /* Concatenate any number of lists by altering them.
 Only the last argument is not altered, and need not be a list.
 usage: (nconc &rest LISTS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
-  register int argnum;
+  register size_t argnum;
   register Lisp_Object tail, tem, val;
 
   val = tail = Qnil;
@@ -2763,7 +2764,7 @@
        doc: /* Apply the value of WIDGET's PROPERTY to the widget itself.
 ARGS are passed as extra arguments to the function.
 usage: (widget-apply WIDGET PROPERTY &rest ARGS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   /* This function can GC. */
   Lisp_Object newargs[3];
@@ -3367,7 +3368,7 @@
 /* Function prototypes.  */
 
 static struct Lisp_Hash_Table *check_hash_table (Lisp_Object);
-static int get_key_arg (Lisp_Object, int, Lisp_Object *, char *);
+static size_t get_key_arg (Lisp_Object, size_t, Lisp_Object *, char *);
 static void maybe_resize_hash_table (struct Lisp_Hash_Table *);
 static int cmpfn_eql (struct Lisp_Hash_Table *, Lisp_Object, unsigned,
                       Lisp_Object, unsigned);
@@ -3422,27 +3423,23 @@
 /* Find KEY in ARGS which has size NARGS.  Don't consider indices for
    which USED[I] is non-zero.  If found at index I in ARGS, set
    USED[I] and USED[I + 1] to 1, and return I + 1.  Otherwise return
-   -1.  This function is used to extract a keyword/argument pair from
+   0.  This function is used to extract a keyword/argument pair from
    a DEFUN parameter list.  */
 
-static int
-get_key_arg (Lisp_Object key, int nargs, Lisp_Object *args, char *used)
+static size_t
+get_key_arg (Lisp_Object key, size_t nargs, Lisp_Object *args, char *used)
 {
-  int i;
-
-  for (i = 0; i < nargs - 1; ++i)
-    if (!used[i] && EQ (args[i], key))
-      break;
-
-  if (i >= nargs - 1)
-    i = -1;
-  else
-    {
-      used[i++] = 1;
-      used[i] = 1;
-    }
-
-  return i;
+  size_t i;
+
+  for (i = 1; i < nargs; i++)
+    if (!used[i - 1] && EQ (args[i - 1], key))
+      {
+	used[i - 1] = 1;
+	used[i] = 1;
+	return i;
+      }
+
+  return 0;
 }
 
 
@@ -4290,12 +4287,12 @@
 is nil.
 
 usage: (make-hash-table &rest KEYWORD-ARGS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   Lisp_Object test, size, rehash_size, rehash_threshold, weak;
   Lisp_Object user_test, user_hash;
   char *used;
-  int i;
+  size_t i;
 
   /* The vector `used' is used to keep track of arguments that
      have been consumed.  */
@@ -4304,7 +4301,7 @@
 
   /* See if there's a `:test TEST' among the arguments.  */
   i = get_key_arg (QCtest, nargs, args, used);
-  test = i < 0 ? Qeql : args[i];
+  test = i ? args[i] : Qeql;
   if (!EQ (test, Qeq) && !EQ (test, Qeql) && !EQ (test, Qequal))
     {
       /* See if it is a user-defined test.  */
@@ -4321,7 +4318,7 @@
 
   /* See if there's a `:size SIZE' argument.  */
   i = get_key_arg (QCsize, nargs, args, used);
-  size = i < 0 ? Qnil : args[i];
+  size = i ? args[i] : Qnil;
   if (NILP (size))
     size = make_number (DEFAULT_HASH_SIZE);
   else if (!INTEGERP (size) || XINT (size) < 0)
@@ -4329,7 +4326,7 @@
 
   /* Look for `:rehash-size SIZE'.  */
   i = get_key_arg (QCrehash_size, nargs, args, used);
-  rehash_size = i < 0 ? make_float (DEFAULT_REHASH_SIZE) : args[i];
+  rehash_size = i ? args[i] : make_float (DEFAULT_REHASH_SIZE);
   if (!NUMBERP (rehash_size)
       || (INTEGERP (rehash_size) && XINT (rehash_size) <= 0)
       || XFLOATINT (rehash_size) <= 1.0)
@@ -4337,7 +4334,7 @@
 
   /* Look for `:rehash-threshold THRESHOLD'.  */
   i = get_key_arg (QCrehash_threshold, nargs, args, used);
-  rehash_threshold = i < 0 ? make_float (DEFAULT_REHASH_THRESHOLD) : args[i];
+  rehash_threshold = i ? args[i] : make_float (DEFAULT_REHASH_THRESHOLD);
   if (!FLOATP (rehash_threshold)
       || XFLOATINT (rehash_threshold) <= 0.0
       || XFLOATINT (rehash_threshold) > 1.0)
@@ -4345,7 +4342,7 @@
 
   /* Look for `:weakness WEAK'.  */
   i = get_key_arg (QCweakness, nargs, args, used);
-  weak = i < 0 ? Qnil : args[i];
+  weak = i ? args[i] : Qnil;
   if (EQ (weak, Qt))
     weak = Qkey_and_value;
   if (!NILP (weak)

=== modified file 'src/font.c'
--- src/font.c	2011-03-16 21:23:37 +0000
+++ src/font.c	2011-03-27 02:12:36 +0000
@@ -3831,10 +3831,10 @@
 language system must contain `mark' feature.
 
 usage: (font-spec ARGS...)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   Lisp_Object spec = font_make_spec ();
-  int i;
+  size_t i;
 
   for (i = 0; i < nargs; i += 2)
     {

=== modified file 'src/frame.c'
--- src/frame.c	2011-03-23 10:06:57 +0000
+++ src/frame.c	2011-03-27 02:12:36 +0000
@@ -2902,7 +2902,7 @@
   /* Record in these vectors all the parms specified.  */
   Lisp_Object *parms;
   Lisp_Object *values;
-  int i, p;
+  size_t i, p;
   int left_no_change = 0, top_no_change = 0;
   int icon_left_no_change = 0, icon_top_no_change = 0;
   int size_changed = 0;
@@ -2975,7 +2975,7 @@
     }
 
   /* Now process them in reverse of specified order.  */
-  for (i--; i >= 0; i--)
+  while (i-- != 0)
     {
       Lisp_Object prop, val;
 

=== modified file 'src/lisp.h'
--- src/lisp.h	2011-03-22 09:08:11 +0000
+++ src/lisp.h	2011-03-27 02:12:36 +0000
@@ -964,7 +964,7 @@
       Lisp_Object (*a7) (Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object);
       Lisp_Object (*a8) (Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object);
       Lisp_Object (*aUNEVALLED) (Lisp_Object args);
-      Lisp_Object (*aMANY) (int, Lisp_Object *);
+      Lisp_Object (*aMANY) (size_t, Lisp_Object *);
     } function;
     short min_args, max_args;
     const char *symbol_name;
@@ -1809,7 +1809,7 @@
 
 /* Note that the weird token-substitution semantics of ANSI C makes
    this work for MANY and UNEVALLED.  */
-#define DEFUN_ARGS_MANY		(int, Lisp_Object *)
+#define DEFUN_ARGS_MANY		(size_t, Lisp_Object *)
 #define DEFUN_ARGS_UNEVALLED	(Lisp_Object)
 #define DEFUN_ARGS_0	(void)
 #define DEFUN_ARGS_1	(Lisp_Object)
@@ -2079,7 +2079,7 @@
   volatile Lisp_Object *var;
 
   /* Number of consecutive protected variables.  */
-  int nvars;
+  size_t nvars;
 
 #ifdef DEBUG_GCPRO
   int level;
@@ -2860,7 +2860,7 @@
 extern Lisp_Object internal_condition_case (Lisp_Object (*) (void), Lisp_Object, Lisp_Object (*) (Lisp_Object));
 extern Lisp_Object internal_condition_case_1 (Lisp_Object (*) (Lisp_Object), Lisp_Object, Lisp_Object, Lisp_Object (*) (Lisp_Object));
 extern Lisp_Object internal_condition_case_2 (Lisp_Object (*) (Lisp_Object, Lisp_Object), Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object (*) (Lisp_Object));
-extern Lisp_Object internal_condition_case_n (Lisp_Object (*) (int, Lisp_Object *), int, Lisp_Object *, Lisp_Object, Lisp_Object (*) (Lisp_Object));
+extern Lisp_Object internal_condition_case_n (Lisp_Object (*) (size_t, Lisp_Object *), size_t, Lisp_Object *, Lisp_Object, Lisp_Object (*) (Lisp_Object));
 extern void specbind (Lisp_Object, Lisp_Object);
 extern void record_unwind_protect (Lisp_Object (*) (Lisp_Object), Lisp_Object);
 extern Lisp_Object unbind_to (int, Lisp_Object);
@@ -2870,7 +2870,7 @@
 extern Lisp_Object un_autoload (Lisp_Object);
 EXFUN (Ffetch_bytecode, 1);
 extern void init_eval_once (void);
-extern Lisp_Object safe_call (int, Lisp_Object *);
+extern Lisp_Object safe_call (size_t, Lisp_Object *);
 extern Lisp_Object safe_call1 (Lisp_Object, Lisp_Object);
 extern Lisp_Object safe_call2 (Lisp_Object, Lisp_Object, Lisp_Object);
 extern void init_eval (void);

=== modified file 'src/process.c'
--- src/process.c	2011-03-26 01:23:15 +0000
+++ src/process.c	2011-03-27 02:12:36 +0000
@@ -1512,11 +1512,11 @@
 syntax.
 
 usage: (start-process NAME BUFFER PROGRAM &rest PROGRAM-ARGS)  */)
-  (int nargs, register Lisp_Object *args)
+  (size_t nargs, register Lisp_Object *args)
 {
   Lisp_Object buffer, name, program, proc, current_dir, tem;
   register unsigned char **new_argv;
-  register int i;
+  register size_t i;
   int count = SPECPDL_INDEX ();
 
   buffer = args[1];
@@ -1722,7 +1722,7 @@
       new_argv = (unsigned char **) alloca ((nargs - 1) * sizeof (char *));
       new_argv[nargs - 2] = 0;
 
-      for (i = nargs - 3; i >= 0; i--)
+      for (i = nargs - 2; i-- != 0; )
 	{
 	  new_argv[i] = SDATA (XCAR (tem));
 	  tem = XCDR (tem);
@@ -2681,7 +2681,7 @@
 \(serial-process-configure :port "\\\\.\\COM13" :bytesize 7)
 
 usage: (serial-process-configure &rest ARGS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   struct Lisp_Process *p;
   Lisp_Object contact = Qnil;
@@ -2799,7 +2799,7 @@
 \(make-serial-process :port "/dev/tty.BlueConsole-SPP-1" :speed nil)
 
 usage:  (make-serial-process &rest ARGS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   int fd = -1;
   Lisp_Object proc, contact, port;
@@ -3077,7 +3077,7 @@
 information, is available via the `process-contact' function.
 
 usage: (make-network-process &rest ARGS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   Lisp_Object proc;
   Lisp_Object contact;
@@ -3393,7 +3393,8 @@
 
   for (lres = res; lres; lres = lres->ai_next)
     {
-      int optn, optbits;
+      size_t optn;
+      int optbits;
 
 #ifdef WINDOWSNT
     retry_connect:

=== modified file 'src/xdisp.c'
--- src/xdisp.c	2011-03-25 20:00:25 +0000
+++ src/xdisp.c	2011-03-27 02:12:36 +0000
@@ -2181,7 +2181,7 @@
    redisplay during the evaluation.  */
 
 Lisp_Object
-safe_call (int nargs, Lisp_Object *args)
+safe_call (size_t nargs, Lisp_Object *args)
 {
   Lisp_Object val;
 
@@ -16389,7 +16389,7 @@
 DEFUN ("trace-to-stderr", Ftrace_to_stderr, Strace_to_stderr, 1, MANY, "",
        doc: /* Like `format', but print result to stderr.
 usage: (trace-to-stderr STRING &rest OBJECTS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   Lisp_Object s = Fformat (nargs, args);
   fprintf (stderr, "%s", SDATA (s));


^ permalink raw reply	[flat|nested] 6+ messages in thread

* bug#8344: (substring ...) crashes on large vectors
  2011-03-27  2:18     ` Paul Eggert
@ 2011-03-27  7:52       ` Andreas Schwab
  2011-03-27  9:09         ` Paul Eggert
  0 siblings, 1 reply; 6+ messages in thread
From: Andreas Schwab @ 2011-03-27  7:52 UTC (permalink / raw)
  To: Paul Eggert; +Cc: 8344

Paul Eggert <eggert@cs.ucla.edu> writes:

> @@ -373,10 +373,10 @@
>      path = Fsubstring (path, make_number (2), Qnil);
>  
>    new_argv_volatile = new_argv = (const unsigned char **)
> -    alloca (max (2, nargs - 2) * sizeof (char *));
> +    alloca ((nargs > 4 ? nargs - 2 : 2) * sizeof (char *));

That should perhaps be converted to use SAFE_ALLOCA.

Andreas.

-- 
Andreas Schwab, schwab@linux-m68k.org
GPG Key fingerprint = 58CA 54C7 6D53 942B 1756  01D3 44D5 214B 8276 4ED5
"And now for something completely different."





^ permalink raw reply	[flat|nested] 6+ messages in thread

* bug#8344: (substring ...) crashes on large vectors
  2011-03-27  7:52       ` Andreas Schwab
@ 2011-03-27  9:09         ` Paul Eggert
  0 siblings, 0 replies; 6+ messages in thread
From: Paul Eggert @ 2011-03-27  9:09 UTC (permalink / raw)
  To: Andreas Schwab; +Cc: 8344

On 03/27/2011 12:52 AM, Andreas Schwab wrote:
> That should perhaps be converted to use SAFE_ALLOCA.

Thanks, here's a patch for that, which I'll throw into
the pile of patches I'm testing.

* callproc.c (Fcall_process, Fcall_process_region): Use SAFE_ALLOCA
instead of alloca (Bug#8344).
=== modified file 'src/callproc.c'
--- src/callproc.c	2011-03-27 02:12:36 +0000
+++ src/callproc.c	2011-03-27 08:59:56 +0000
@@ -189,6 +189,7 @@
   char buf[CALLPROC_BUFFER_SIZE_MAX];
   int bufsize = CALLPROC_BUFFER_SIZE_MIN;
   int count = SPECPDL_INDEX ();
+  volatile USE_SAFE_ALLOCA;

   const unsigned char **volatile new_argv_volatile;
   register const unsigned char **new_argv;
@@ -242,7 +243,7 @@
 	  val = Qraw_text;
 	else
 	  {
-	    args2 = (Lisp_Object *) alloca ((nargs + 1) * sizeof *args2);
+	    SAFE_ALLOCA (args2, Lisp_Object *, (nargs + 1) * sizeof *args2);
 	    args2[0] = Qcall_process;
 	    for (i = 0; i < nargs; i++) args2[i + 1] = args[i];
 	    coding_systems = Ffind_operation_coding_system (nargs + 1, args2);
@@ -372,8 +373,9 @@
       && SREF (path, 1) == ':')
     path = Fsubstring (path, make_number (2), Qnil);

-  new_argv_volatile = new_argv = (const unsigned char **)
-    alloca ((nargs > 4 ? nargs - 2 : 2) * sizeof (char *));
+  SAFE_ALLOCA (new_argv, const unsigned char **,
+	       (nargs > 4 ? nargs - 2 : 2) * sizeof *new_argv);
+  new_argv_volatile = new_argv;
   if (nargs > 4)
     {
       register size_t i;
@@ -645,7 +647,7 @@
 	    {
 	      size_t i;

-	      args2 = (Lisp_Object *) alloca ((nargs + 1) * sizeof *args2);
+	      SAFE_ALLOCA (args2, Lisp_Object *, (nargs + 1) * sizeof *args2);
 	      args2[0] = Qcall_process;
 	      for (i = 0; i < nargs; i++) args2[i + 1] = args[i];
 	      coding_systems
@@ -809,6 +811,7 @@
      when exiting.  */
   call_process_exited = 1;

+  SAFE_FREE ();
   unbind_to (count, Qnil);

   if (synch_process_termsig)
@@ -897,30 +900,35 @@
 #endif
     }

-  pattern = Fexpand_file_name (Vtemp_file_name_pattern, tmpdir);
-  tempfile = (char *) alloca (SBYTES (pattern) + 1);
-  memcpy (tempfile, SDATA (pattern), SBYTES (pattern) + 1);
-  coding_systems = Qt;
+  {
+    USE_SAFE_ALLOCA;
+    pattern = Fexpand_file_name (Vtemp_file_name_pattern, tmpdir);
+    SAFE_ALLOCA (tempfile, char *, SBYTES (pattern) + 1);
+    memcpy (tempfile, SDATA (pattern), SBYTES (pattern) + 1);
+    coding_systems = Qt;

 #ifdef HAVE_MKSTEMP
- {
-   int fd;
+    {
+      int fd;

-   BLOCK_INPUT;
-   fd = mkstemp (tempfile);
-   UNBLOCK_INPUT;
-   if (fd == -1)
-     report_file_error ("Failed to open temporary file",
-			Fcons (Vtemp_file_name_pattern, Qnil));
-   else
-     close (fd);
- }
+      BLOCK_INPUT;
+      fd = mkstemp (tempfile);
+      UNBLOCK_INPUT;
+      if (fd == -1)
+	report_file_error ("Failed to open temporary file",
+			   Fcons (Vtemp_file_name_pattern, Qnil));
+      else
+	close (fd);
+    }
 #else
-  mktemp (tempfile);
+    mktemp (tempfile);
 #endif

-  filename_string = build_string (tempfile);
-  GCPRO1 (filename_string);
+    filename_string = build_string (tempfile);
+    GCPRO1 (filename_string);
+    SAFE_FREE ();
+  }
+
   start = args[0];
   end = args[1];
   /* Decide coding-system of the contents of the temporary file.  */
@@ -930,11 +938,13 @@
     val = Qraw_text;
   else
     {
-      args2 = (Lisp_Object *) alloca ((nargs + 1) * sizeof *args2);
+      USE_SAFE_ALLOCA;
+      SAFE_ALLOCA (args2, Lisp_Object *, (nargs + 1) * sizeof *args2);
       args2[0] = Qcall_process_region;
       for (i = 0; i < nargs; i++) args2[i + 1] = args[i];
       coding_systems = Ffind_operation_coding_system (nargs + 1, args2);
       val = CONSP (coding_systems) ? XCDR (coding_systems) : Qnil;
+      SAFE_FREE ();
     }
   val = complement_process_encoding_system (val);







^ permalink raw reply	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2011-03-27  9:09 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-03-25 18:17 bug#8344: (substring ...) crashes on large vectors Paul Eggert
2011-03-25 21:24 ` Stefan Monnier
2011-03-25 21:48   ` Paul Eggert
2011-03-27  2:18     ` Paul Eggert
2011-03-27  7:52       ` Andreas Schwab
2011-03-27  9:09         ` Paul Eggert

Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/emacs.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).