Integer overflow and signedness fixes (Bug#8873).

1 files changed, 9 insertions, 7 deletions

diff --git a/src/bytecode.c b/src/bytecode.c
index 74cf401bf1d..58b26c79b84 100644
--- a/src/bytecode.c
+++ b/src/bytecode.c
@@ -433,7 +433,7 @@ If the third argument is incorrect, Emacs may crash.  */)
 
 Lisp_Object
 exec_byte_code (Lisp_Object bytestr, Lisp_Object vector, Lisp_Object maxdepth,
-                Lisp_Object args_template, int nargs, Lisp_Object *args)
+                Lisp_Object args_template, ptrdiff_t nargs, Lisp_Object *args)
 {
   int count = SPECPDL_INDEX ();
 #ifdef BYTE_CODE_METER
@@ -444,7 +444,7 @@ exec_byte_code (Lisp_Object bytestr, Lisp_Object vector, Lisp_Object maxdepth,
   /* Lisp_Object v1, v2; */
   Lisp_Object *vectorp;
 #ifdef BYTE_CODE_SAFE
-  int const_length;
+  ptrdiff_t const_length;
   Lisp_Object *stacke;
   int bytestr_length;
 #endif
@@ -464,7 +464,7 @@ exec_byte_code (Lisp_Object bytestr, Lisp_Object vector, Lisp_Object maxdepth,
 
   CHECK_STRING (bytestr);
   CHECK_VECTOR (vector);
-  CHECK_NUMBER (maxdepth);
+  CHECK_NATNUM (maxdepth);
 
 #ifdef BYTE_CODE_SAFE
   const_length = ASIZE (vector);
@@ -486,6 +486,8 @@ exec_byte_code (Lisp_Object bytestr, Lisp_Object vector, Lisp_Object maxdepth,
   stack.byte_string = bytestr;
   stack.pc = stack.byte_string_start = SDATA (bytestr);
   stack.constants = vector;
+  if (min (PTRDIFF_MAX, SIZE_MAX) / sizeof (Lisp_Object) < XFASTINT (maxdepth))
+    memory_full (SIZE_MAX);
   top = (Lisp_Object *) alloca (XFASTINT (maxdepth)
                                          * sizeof (Lisp_Object));
 #if BYTE_MAINTAIN_TOP
@@ -502,14 +504,14 @@ exec_byte_code (Lisp_Object bytestr, Lisp_Object vector, Lisp_Object maxdepth,
 
   if (INTEGERP (args_template))
     {
-      int at = XINT (args_template);
+      ptrdiff_t at = XINT (args_template);
       int rest = at & 128;
       int mandatory = at & 127;
-      int nonrest = at >> 8;
+      ptrdiff_t nonrest = at >> 8;
       eassert (mandatory <= nonrest);
       if (nargs <= nonrest)
         {
-          int i;
+          ptrdiff_t i;
           for (i = 0 ; i < nargs; i++, args++)
             PUSH (*args);
           if (nargs < mandatory)
@@ -528,7 +530,7 @@ exec_byte_code (Lisp_Object bytestr, Lisp_Object vector, Lisp_Object maxdepth,
         }
       else if (rest)
         {
-          int i;
+          ptrdiff_t i;
           for (i = 0 ; i < nonrest; i++, args++)
             PUSH (*args);
           PUSH (Flist (nargs - nonrest, args));