Fix bug #13084 with crashes during search.

 src/search.c (search_buffer): Check the inverse translations of each
 character in pattern when the buffer being searched is unibyte.

2 files changed, 21 insertions, 1 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index b3c7a5e6549..5239559f867 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,9 @@
+2012-12-11  Eli Zaretskii  <eliz@gnu.org>
+
+        * search.c (search_buffer): Check the inverse translations of each
+        character in pattern when the buffer being searched is unibyte.
+        (Bug#13084)
+
 2012-12-10  Paul Eggert  <eggert@cs.ucla.edu>
 
         * fileio.c (Fvisited_file_modtime): Return (-1 ...) for nonexistent
diff --git a/src/search.c b/src/search.c
index aacdbe33eef..7f26601cc69 100644
--- a/src/search.c
+++ b/src/search.c
@@ -1406,7 +1406,7 @@ search_buffer (Lisp_Object string, ptrdiff_t pos, ptrdiff_t pos_byte,
           char_base = 0;
           while (--len >= 0)
             {
-              int c, translated;
+              int c, translated, inverse;
 
               /* If we got here and the RE flag is set, it's because we're
                  dealing with a regexp known to be trivial, so the backslash
@@ -1420,6 +1420,20 @@ search_buffer (Lisp_Object string, ptrdiff_t pos, ptrdiff_t pos_byte,
               c = *base_pat++;
               TRANSLATE (translated, trt, c);
               *pat++ = translated;
+              /* Check that none of C's equivalents violates the
+                 assumptions of boyer_moore.  */
+              TRANSLATE (inverse, inverse_trt, c);
+              while (1)
+                {
+                  if (inverse >= 0200)
+                    {
+                      boyer_moore_ok = 0;
+                      break;
+                    }
+                  if (c == inverse)
+                    break;
+                  TRANSLATE (inverse, inverse_trt, inverse);
+                }
             }
         }