Fix infloop in 'number-sequence'

* lisp/subr.el (number-sequence): Avoid overflow leading to an
infloop.  (Bug#23627)

* test/automated/subr-tests.el (number-sequence-test): New test.

2 files changed, 15 insertions, 3 deletions

diff --git a/lisp/subr.el b/lisp/subr.el
index 3ac61f9a45f..43660d74377 100644
--- a/lisp/subr.el
+++ b/lisp/subr.el
@@ -484,13 +484,16 @@ of course, also replace TO with a slightly larger value
       (list from)
     (or inc (setq inc 1))
     (when (zerop inc) (error "The increment can not be zero"))
-    (let (seq (n 0) (next from))
+    (let (seq (n 0) (next from) (last from))
       (if (> inc 0)
-          (while (<= next to)
+          ;; The (>= next last) condition protects against integer
+          ;; overflow in computing NEXT.
+          (while (and (>= next last) (<= next to))
             (setq seq (cons next seq)
                   n (1+ n)
+                  last next
                   next (+ from (* n inc))))
-        (while (>= next to)
+        (while (and (<= next last) (>= next to))
           (setq seq (cons next seq)
                 n (1+ n)
                 next (+ from (* n inc)))))
diff --git a/test/automated/subr-tests.el b/test/automated/subr-tests.el
index 7906a207a96..ce212903c9d 100644
--- a/test/automated/subr-tests.el
+++ b/test/automated/subr-tests.el
@@ -61,6 +61,15 @@
                      (quote
                       (0 font-lock-keyword-face))))))))
 
+(ert-deftest number-sequence-test ()
+  (should (= (length
+              (number-sequence (1- most-positive-fixnum) most-positive-fixnum))
+             2))
+  (should (= (length
+              (number-sequence
+               (1+ most-negative-fixnum) most-negative-fixnum -1))
+             2)))
+
 (ert-deftest string-comparison-test ()
   (should (string-lessp "abc" "acb"))
   (should (string-lessp "aBc" "abc"))