From: Paul Eggert <eggert@cs.ucla.edu>
To: 9496@debbugs.gnu.org
Subject: bug#9496: 24.0.50; Segfault on TAB-only composition
Date: Fri, 03 Feb 2012 11:28:29 -0800 [thread overview]
Message-ID: <4F2C355D.6020302@cs.ucla.edu> (raw)
In-Reply-To: <8739g0tcp5.fsf@gnu.org>
When a fix for this was merged into the trunk I noticed a problem from the
trunk's point of view: the fix introduced the possibility of an unchecked
integer overflow which would cause character widths to go negative
and could cause real problems later. I installed this further fix
to the trunk:
Handle overflow when computing char display width (Bug#9496).
* character.c (char_width): Return EMACS_INT, not int.
(char_width, c_string_width): Check for overflow when
computing the width; this is possible now that individual
characters can have unbounded width. Problem introduced
by merge from Emacs 23 on 2012-01-19.
=== modified file 'src/character.c'
--- src/character.c 2012-01-19 07:21:25 +0000
+++ src/character.c 2012-02-03 19:19:42 +0000
@@ -311,10 +311,10 @@
/* Return width (columns) of C considering the buffer display table DP. */
-static int
+static EMACS_INT
char_width (int c, struct Lisp_Char_Table *dp)
{
- int width = CHAR_WIDTH (c);
+ EMACS_INT width = CHAR_WIDTH (c);
if (dp)
{
@@ -326,7 +326,12 @@
{
ch = AREF (disp, i);
if (CHARACTERP (ch))
- width += CHAR_WIDTH (XFASTINT (ch));
+ {
+ int w = CHAR_WIDTH (XFASTINT (ch));
+ if (INT_ADD_OVERFLOW (width, w))
+ string_overflow ();
+ width += w;
+ }
}
}
return width;
@@ -340,7 +345,8 @@
usage: (char-width CHAR) */)
(Lisp_Object ch)
{
- int c, width;
+ int c;
+ EMACS_INT width;
CHECK_CHARACTER (ch);
c = XINT (ch);
@@ -367,10 +373,14 @@
{
int bytes;
int c = STRING_CHAR_AND_LENGTH (str + i_byte, bytes);
- int thiswidth = char_width (c, dp);
+ EMACS_INT thiswidth = char_width (c, dp);
- if (precision > 0
- && (width + thiswidth > precision))
+ if (precision <= 0)
+ {
+ if (INT_ADD_OVERFLOW (width, thiswidth))
+ string_overflow ();
+ }
+ else if (precision - width < thiswidth)
{
*nchars = i;
*nbytes = i_byte;
next prev parent reply other threads:[~2012-02-03 19:28 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-09-13 20:22 bug#9496: 24.0.50; Segfault on TAB-only composition Johan Bockgård
2011-09-14 5:33 ` Eli Zaretskii
2011-09-14 12:57 ` Kenichi Handa
2011-09-14 13:07 ` Eli Zaretskii
2011-09-15 0:28 ` Kenichi Handa
2011-09-15 0:47 ` Stefan Monnier
2011-09-15 4:10 ` Kenichi Handa
2011-11-11 7:15 ` Kenichi Handa
2012-02-03 19:28 ` Paul Eggert [this message]
2012-02-03 21:22 ` Eli Zaretskii
2012-02-03 22:07 ` Paul Eggert
2012-02-04 6:58 ` Eli Zaretskii
2012-02-04 7:18 ` Paul Eggert
2012-02-04 8:14 ` Eli Zaretskii
2012-02-04 23:43 ` Paul Eggert
2012-02-05 16:36 ` Eli Zaretskii
2012-02-05 16:39 ` Paul Eggert
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://www.gnu.org/software/emacs/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4F2C355D.6020302@cs.ucla.edu \
--to=eggert@cs.ucla.edu \
--cc=9496@debbugs.gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/emacs.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).