Re: segfault crash when loading certain rmail files

[Kenichi Handa <handa@etl.go.jp>]

Ulf Rehmann <rehmann@mathematik.uni-bielefeld.de> writes:
> I turned out that the crash can be triggered, for emacs 21.2, by
> loading any file just containing the character (decimal) 128, if this
> file is gzipped and visited by find-file and if "automatic file
> de/compression" is toggled "on".

> No crash with emacs 20.7.

Thank you for the report.  The following change will fix the
problem.

(1) Fix Fcall_process (in callproc.c).

We have this code at line 786.

	      repeat_decoding:
		size = decoding_buffer_size (&process_coding, nread);
		decoding_buf = (char *) xmalloc (size);
		
		if (process_coding.cmp_data)
		  process_coding.cmp_data->char_offset = PT;
		
		decode_coding (&process_coding, bufptr, decoding_buf,
			       nread, size);

Before we check process_coding.cmp_data, if process_coding
requires detection (we have the macro
CODING_REQUIRED_DETECTION for checking it), we must call
detect_coding.  And, if the resulting
process_coding.composing is not COMPOSITION_DISABLED, we
must allocate a memory for handling composition data (we
have the function coding_allocate_composition_data, the
second arg must be PT).

(2) Fix detect_eol (in coding.c).

We have this code at 4316

  if (VECTORP (val) && XVECTOR (val)->size == 3)
    {
      int src_multibyte = coding->src_multibyte;
      int dst_multibyte = coding->dst_multibyte;

      setup_coding_system (XVECTOR (val)->contents[eol_type], coding);
      coding->src_multibyte = src_multibyte;
      coding->dst_multibyte = dst_multibyte;
      coding->heading_ascii = skip;
    }

The value of coding->cmp_data must be saved before calling
setup_coding_system and restored after the call.


And, we potentially have the same kind of problem in the
following places (where, decode_coding is called directly).

w16select.c:663:      decode_coding (&coding, htext, buf, truelen, bufsize);
w32fns.c:6688:  decode_coding (&coding, lplogfont->lfFaceName, fontname,
w32select.c:335:	decode_coding (&coding, src, buf, nbytes, bufsize);
xselect.c:1651:	  decode_coding (&coding, data, buf, size, bufsize);
xterm.c:10688:			    decode_coding (&coding, copy_bufptr, p,

Fortunetly, for all those case, we can simply diable
composition handling by setting the member `composing' of
`struct coding_system' to COMPOSITION_DIABLED.  For example,
in the case of xselect.c, before calling decode_coding at
the line 335, what we need is to set coding.composing to
COMPOSITION_DIABLED.

Could someone please install a fix?  I'll verify the result.

---
Ken'ichi HANDA
handa@etl.go.jp