bug#24064: 24.5; NULL pointer dereference in compute_motion(), indent.c

[Sergei Litvin <litvindev@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 1092 bytes --]

Package: emacs

Version: 24.5

struct position *
compute_motion (ptrdiff_t from, ptrdiff_t frombyte, EMACS_INT fromvpos,
         EMACS_INT fromhpos, bool did_motion, ptrdiff_t to,
         EMACS_INT tovpos, EMACS_INT tohpos, EMACS_INT width,
         ptrdiff_t hscroll, int tab_offset, struct window *win)
{

...

   if (dp == buffer_display_table ())
     width_table = (VECTORP (BVAR (current_buffer, width_table))
                    ? XVECTOR (BVAR (current_buffer, width_table))->contents
                    : 0);
   else
     /* If the window has its own display table, we can't use the width
        run cache, because that's based on the buffer's display table.  */
     width_table = 0; // initialize it with 0 (current buffer has no 
display table)

...

       if (width_cache)
         {
           /* Is this character part of the current run?  If so, extend
          the run.  */
           if (pos - 1 == width_run_end
           && XFASTINT (width_table[c]) == width_run_width) // 
dereference width_table here, and crash
         width_run_end = pos;
...


Sergei Litvin


[-- Attachment #2: Type: text/html, Size: 1827 bytes --]