bug#30004: 27.0.50; call-interactively reads uninitialized memory

[Eli Zaretskii <eliz@gnu.org>]

> From: Philipp <p.stephani2@gmail.com>
> Date: Sat, 06 Jan 2018 12:31:51 +0100
> 
> When passing a byte that would start a multibyte sequence,
> `call-interactively` uses STRING_CHAR without checking whether the
> entire multibyte sequence is actually part of the string.  For example:
> 
> $ emacs -batch -nw -Q -eval '(call-interactively (lambda () (interactive "\xFF")))'
> Invalid control letter ‘𿯾’ (#o775776, #x3fbfe) in interactive calling string

Thanks for catching this.  Does the patch below fix this?

diff --git a/src/callint.c b/src/callint.c
index ef22851..ede9a02 100644
--- a/src/callint.c
+++ b/src/callint.c
@@ -774,10 +774,18 @@ invoke it.  If KEYS is omitted or nil, the return value of
 	     if anyone tries to define one here.  */
 	case '+':
 	default:
-	  error ("Invalid control letter `%c' (#o%03o, #x%04x) in interactive calling string",
-		 STRING_CHAR ((unsigned char *) tem),
-		 (unsigned) STRING_CHAR ((unsigned char *) tem),
-		 (unsigned) STRING_CHAR ((unsigned char *) tem));
+	  {
+	    ptrdiff_t bytes_left = SBYTES (specs) - (tem - string);
+	    unsigned letter;
+
+	    if (bytes_left >= BYTES_BY_CHAR_HEAD (*((unsigned char *) tem)))
+	      letter = STRING_CHAR ((unsigned char *) tem);
+	    else
+	      letter = *((unsigned char *) tem);
+
+	    error ("Invalid control letter `%c' (#o%03o, #x%04x) in interactive calling string",
+		   (int) letter, letter, letter);
+	  }
 	}
 
       if (varies[i] == 0)