Re: define-prefix-command with a name, pressing key sequence bound to it results in memory corruption

Re: define-prefix-command with a name, pressing key sequence bound to it results in memory corruption

[Chong Yidong]

> I have trimmed my .emacs to:
>
> (define-prefix-command 'my-nice-map nil "cOnfigure, Compile, Make, make tEsts, run Tests, trY build, Install, sVn, ctaGs, cscoPe")
> (define-key my-nice-map "c" 'compile)
> (global-set-key [(meta ?m)] 'my-nice-map)
>
> Sometimes, when pressing my key sequence (meta-m) for the prefix
> command, emacs crashes. Sometimes it crashes on the second key
> (e.g. the 'c' following the meta-m).  I have also tried with (control
> ?.).

I can reproduce this.

It's strange that realloc fails.  If you replacing the xrealloc in
enlarge_buffer_text with xmalloc/bcopy/xfree, Emacs crashes at the call
to malloc.

Anyone have an idea what causes this?


#0  0x00110402 in __kernel_vsyscall ()
#1  0x0049e690 in raise () from /lib/libc.so.6
#2  0x0049ff91 in abort () from /lib/libc.so.6
#3  0x004d69eb in __libc_message () from /lib/libc.so.6
#4  0x004df253 in _int_malloc () from /lib/libc.so.6
#5  0x004e0472 in _int_realloc () from /lib/libc.so.6
#6  0x004e23f7 in realloc () from /lib/libc.so.6
#7  0x0814784d in xrealloc (block=0x0, size=2090) at alloc.c:786
#8  0x0810ef21 in enlarge_buffer_text (b=0x8c2df98, delta=2069)
    at buffer.c:5067
#9  0x08118a45 in make_gap_larger (nbytes_added=69) at insdel.c:526
#10 0x08119db0 in insert_1_both (
    string=0x8966798 "cOnfigure, Compile, Make, make tEsts, run Tests, trY build, Install, sVn, ctaGs, cscoPe: ", nchars=89, nbytes=89, inherit=1, prepare=0, 
    before_markers=0) at insdel.c:978

Re: define-prefix-command with a name, pressing key sequence bound to it results in memory corruption

[Chong Yidong]

Chong Yidong <cyd@stupidchicken.com> writes:

> I can reproduce this.
>
> It's strange that realloc fails.  If you replacing the xrealloc in
> enlarge_buffer_text with xmalloc/bcopy/xfree, Emacs crashes at the call
> to malloc.
>
> Anyone have an idea what causes this?

Found the bug: a bad strcpy in read_char_minibuf_menu_prompt.  I've
checked in a fix.