Fix crashes with lots of overlays.

 src/editfns.c (get_pos_property): Use SAFE_ALLOCA_LISP, to avoid
 segfault when there are lots of overlays.
 src/buffer.c (sort_overlays): Use SAFE_NALLOCA, to avoid segfault
 when there are lots of overlays.  See
 http://lists.gnu.org/archive/html/emacs-devel/2013-01/msg00421.html
 for the details and a way to reproduce.

1 files changed, 4 insertions, 1 deletions

diff --git a/src/editfns.c b/src/editfns.c
index 197950517b7..020285cf4ec 100644
--- a/src/editfns.c
+++ b/src/editfns.c
@@ -386,6 +386,7 @@ get_pos_property (Lisp_Object position, register Lisp_Object prop, Lisp_Object o
       ptrdiff_t noverlays;
       Lisp_Object *overlay_vec, tem;
       struct buffer *obuf = current_buffer;
+      USE_SAFE_ALLOCA;
 
       set_buffer_temp (XBUFFER (object));
 
@@ -398,7 +399,7 @@ get_pos_property (Lisp_Object position, register Lisp_Object prop, Lisp_Object o
          make enough space for all, and try again.  */
       if (noverlays > 40)
         {
-          overlay_vec = alloca (noverlays * sizeof *overlay_vec);
+          SAFE_ALLOCA_LISP (overlay_vec, noverlays);
           noverlays = overlays_around (posn, overlay_vec, noverlays);
         }
       noverlays = sort_overlays (overlay_vec, noverlays, NULL);
@@ -421,10 +422,12 @@ get_pos_property (Lisp_Object position, register Lisp_Object prop, Lisp_Object o
                 ; /* The overlay will not cover a char inserted at point.  */
               else
                 {
+                  SAFE_FREE ();
                   return tem;
                 }
             }
         }
+      SAFE_FREE ();
 
       { /* Now check the text properties.  */
         int stickiness = text_property_stickiness (prop, position, object);