Fix bounds checking for text properties in `format' (Bug#5306).

* intervals.h, textprop.c (extend_property_ranges): Return value
and args changed.  Discard properties that begin at or after the
new end (Bug#5306).

* editfns.c (Fformat): Caller changed.

1 files changed, 2 insertions, 2 deletions

diff --git a/src/editfns.c b/src/editfns.c
index cb302f7b1e7..58e13b1ed7c 100644
--- a/src/editfns.c
+++ b/src/editfns.c
@@ -4177,8 +4177,8 @@ usage: (format STRING &rest OBJECTS)  */)
               len = make_number (SCHARS (args[n]));
               new_len = make_number (info[n].end - info[n].start);
               props = text_property_list (args[n], make_number (0), len, Qnil);
-              extend_property_ranges (props, len, new_len);
-              /* If successive arguments have properites, be sure that
+              props = extend_property_ranges (props, new_len);
+              /* If successive arguments have properties, be sure that
                  the value of `composition' property be the copy.  */
               if (n > 1 && info[n - 1].end)
                 make_composition_value_copy (props);