Make sure a 64-bit char is never passed to CHAR_STRING.

Otherwise, CHAR_STRING would do the wrong thing on a 64-bit platform,
by silently ignoring the top 32 bits, allowing some values
that were far too large to be valid characters.
* character.h: Include <verify.h>.
(CHAR_STRING, CHAR_STRING_ADVANCE): Verify that the character
arguments are no wider than unsigned, as a compile-time check
to prevent future regressions in this area.
* data.c (Faset):
* editfns.c (Fchar_to_string, general_insert_function, Finsert_char):
(Fsubst_char_in_region):
* fns.c (concat):
* xdisp.c (decode_mode_spec_coding):
Adjust to CHAR_STRING's new requirement.
* editfns.c (Finsert_char, Fsubst_char_in_region):
* fns.c (concat): Check that character args are actually
characters.  Without this test, these functions did the wrong
thing with wildly out-of-range values on 64-bit hosts.

1 files changed, 3 insertions, 1 deletions

diff --git a/src/data.c b/src/data.c
index 57d7753e393..3a08a7a8cd3 100644
--- a/src/data.c
+++ b/src/data.c
@@ -2152,17 +2152,19 @@ bool-vector.  IDX starts at 0.  */)
     {
       EMACS_INT idxval_byte, prev_bytes, new_bytes, nbytes;
       unsigned char workbuf[MAX_MULTIBYTE_LENGTH], *p0 = workbuf, *p1;
+      int c;
 
       if (idxval < 0 || idxval >= SCHARS (array))
         args_out_of_range (array, idx);
       CHECK_CHARACTER (newelt);
+      c = XFASTINT (newelt);
 
       nbytes = SBYTES (array);
 
       idxval_byte = string_char_to_byte (array, idxval);
       p1 = SDATA (array) + idxval_byte;
       prev_bytes = BYTES_BY_CHAR_HEAD (*p1);
-      new_bytes = CHAR_STRING (XINT (newelt), p0);
+      new_bytes = CHAR_STRING (c, p0);
       if (prev_bytes != new_bytes)
         {
           /* We must relocate the string data.  */