Mercurial > hg > xemacs-beta

comparison src/event-stream.c @ 5857:6ec4964c1687

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Be more careful about echo_buf arithmetic, event-stream.c. src/ChangeLog addition: 2015-03-12 Aidan Kehoe <kehoea@parhasard.net> * event-stream.c (lookup_command_event): Check whether echo_buf_fill_pointer is negative before using it in arithmetic, avoiding a crash in GC. Oddly the old code didn't do this check and didn't crash, but its echo_buf was from malloced memory, not from our string data, so there may have been more room to manoeuvre.
author Aidan Kehoe <kehoea@parhasard.net>
date Thu, 12 Mar 2015 23:31:42 +0000
parents b3824b7f5627
children 916b48abd1c6
comparison
equal deleted inserted replaced
5856:27876789edc5 5857:6ec4964c1687
4065 #else 4065 #else
4066 if (1) 4066 if (1)
4067 #endif 4067 #endif
4068 { 4068 {
4069 Lisp_Object prompt = Fkeymap_prompt (leaf, Qt); 4069 Lisp_Object prompt = Fkeymap_prompt (leaf, Qt);
4070 if (STRINGP (prompt)) 4070 if (STRINGP (prompt) && STRINGP (command_builder->echo_buf))
4071 { 4071 {
4072 /* Append keymap prompt to key echo buffer */ 4072 /* Append keymap prompt to key echo buffer */
4073 int buf_fill_pointer = command_builder->echo_buf_fill_pointer; 4073 Bytecount buf_fill_pointer
4074 = max (command_builder->echo_buf_fill_pointer, 0);
4074 Bytecount len = XSTRING_LENGTH (prompt); 4075 Bytecount len = XSTRING_LENGTH (prompt);
4075 4076
4076 if (len + buf_fill_pointer + 1 4077 if (len + buf_fill_pointer + 1
4077 <= XSTRING_LENGTH (command_builder->echo_buf)) 4078 <= XSTRING_LENGTH (command_builder->echo_buf))
4078 { 4079 {
4088 sledgehammer_check_ascii_begin (command_builder->echo_buf); 4089 sledgehammer_check_ascii_begin (command_builder->echo_buf);
4089 4090
4090 /* Show the keymap prompt, but don't adjust the fill 4091 /* Show the keymap prompt, but don't adjust the fill
4091 pointer to reflect it. */ 4092 pointer to reflect it. */
4092 command_builder->echo_buf_end 4093 command_builder->echo_buf_end
4093 = command_builder->echo_buf_fill_pointer + len; 4094 = buf_fill_pointer + len;
4095 command_builder->echo_buf_fill_pointer = buf_fill_pointer;
4094 } 4096 }
4095 maybe_echo_keys (command_builder, 1); 4097 maybe_echo_keys (command_builder, 1);
4096 } 4098 }
4097 else 4099 else
4098 maybe_echo_keys (command_builder, 0); 4100 maybe_echo_keys (command_builder, 0);