bug#31186: 27.0.50; Undefined behavior in lisp_file_lexically_bound_p

[Andreas Schwab <schwab@suse.de>]

On Apr 17 2018, Philipp <p.stephani2@gmail.com> wrote:

> Loading a file or evaluating a buffer with the following contents causes
> undefined behavior, normally resulting in a segmentation fault:
>
> ;; -*- -:*-
>
> For example:
>
> $ emacs -Q -batch -nw -eval '(with-temp-buffer (insert ";; -*- -:*-") (eval-buffer))'
> Fatal error 11: Segmentation faultAbort trap: 6

I have installed this patch in the emacs-26 branch:

* src/lread.c (lisp_file_lexically_bound_p): Reset
beg_end_state before reading variable or value.
---
 src/lread.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/lread.c b/src/lread.c
index 3104c441ec..72523c057f 100644
--- a/src/lread.c
+++ b/src/lread.c
@@ -896,6 +896,7 @@ lisp_file_lexically_bound_p (Lisp_Object readcharfun)
 	    ch = READCHAR;
 
 	  i = 0;
+	  beg_end_state = NOMINAL;
 	  while (ch != ':' && ch != '\n' && ch != EOF && in_file_vars)
 	    {
 	      if (i < sizeof var - 1)
@@ -921,6 +922,7 @@ lisp_file_lexically_bound_p (Lisp_Object readcharfun)
 		ch = READCHAR;
 
 	      i = 0;
+	      beg_end_state = NOMINAL;
 	      while (ch != ';' && ch != '\n' && ch != EOF && in_file_vars)
 		{
 		  if (i < sizeof val - 1)
-- 
2.17.0


Andreas.

-- 
Andreas Schwab, SUSE Labs, schwab@suse.de
GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE  1748 E4D4 88E3 0EEA B9D7
"And now for something completely different."