upstream

1 files changed, 29 insertions, 26 deletions

diff --git a/src/xterm.c b/src/xterm.c
index cefb98a476d..be456a61a6f 100644
--- a/src/xterm.c
+++ b/src/xterm.c
@@ -1662,19 +1662,18 @@ x_color_cells (Display *dpy, int *ncells)
   if (dpyinfo->color_cells == NULL)
     {
       Screen *screen = dpyinfo->screen;
+      int ncolor_cells = XDisplayCells (dpy, XScreenNumberOfScreen (screen));
       int i;
 
-      dpyinfo->ncolor_cells
-        = XDisplayCells (dpy, XScreenNumberOfScreen (screen));
-      dpyinfo->color_cells
-        = (XColor *) xmalloc (dpyinfo->ncolor_cells
-                              * sizeof *dpyinfo->color_cells);
+      dpyinfo->color_cells = xnmalloc (ncolor_cells,
+                                       sizeof *dpyinfo->color_cells);
+      dpyinfo->ncolor_cells = ncolor_cells;
 
-      for (i = 0; i < dpyinfo->ncolor_cells; ++i)
+      for (i = 0; i < ncolor_cells; ++i)
         dpyinfo->color_cells[i].pixel = i;
 
       XQueryColors (dpy, dpyinfo->cmap,
-                    dpyinfo->color_cells, dpyinfo->ncolor_cells);
+                    dpyinfo->color_cells, ncolor_cells);
     }
 
   *ncells = dpyinfo->ncolor_cells;
@@ -4233,7 +4232,7 @@ xt_action_hook (Widget widget, XtPointer client_data, String action_name,
    x_send_scroll_bar_event and x_scroll_bar_to_input_event.  */
 
 static struct window **scroll_bar_windows;
-static size_t scroll_bar_windows_size;
+static ptrdiff_t scroll_bar_windows_size;
 
 
 /* Send a client message with message type Xatom_Scrollbar for a
@@ -4248,7 +4247,7 @@ x_send_scroll_bar_event (Lisp_Object window, int part, int portion, int whole)
   XClientMessageEvent *ev = (XClientMessageEvent *) &event;
   struct window *w = XWINDOW (window);
   struct frame *f = XFRAME (w->frame);
-  size_t i;
+  ptrdiff_t i;
 
   BLOCK_INPUT;
 
@@ -4269,16 +4268,15 @@ x_send_scroll_bar_event (Lisp_Object window, int part, int portion, int whole)
 
   if (i == scroll_bar_windows_size)
     {
-      size_t new_size = max (10, 2 * scroll_bar_windows_size);
-      size_t nbytes = new_size * sizeof *scroll_bar_windows;
-      size_t old_nbytes = scroll_bar_windows_size * sizeof *scroll_bar_windows;
-
-      if ((size_t) -1 / sizeof *scroll_bar_windows < new_size)
-        memory_full (SIZE_MAX);
-      scroll_bar_windows = (struct window **) xrealloc (scroll_bar_windows,
-                                                        nbytes);
+      ptrdiff_t old_nbytes =
+        scroll_bar_windows_size * sizeof *scroll_bar_windows;
+      ptrdiff_t nbytes;
+      enum { XClientMessageEvent_MAX = 0x7fffffff };
+      scroll_bar_windows =
+        xpalloc (scroll_bar_windows, &scroll_bar_windows_size, 1,
+                 XClientMessageEvent_MAX, sizeof *scroll_bar_windows);
+      nbytes = scroll_bar_windows_size * sizeof *scroll_bar_windows;
       memset (&scroll_bar_windows[i], 0, nbytes - old_nbytes);
-      scroll_bar_windows_size = new_size;
     }
 
   scroll_bar_windows[i] = w;
@@ -5856,11 +5854,12 @@ handle_one_xevent (struct x_display_info *dpyinfo, XEvent *eventptr,
   } inev;
   int count = 0;
   int do_help = 0;
-  int nbytes = 0;
+  ptrdiff_t nbytes = 0;
   struct frame *f = NULL;
   struct coding_system coding;
   XEvent event = *eventptr;
   Mouse_HLInfo *hlinfo = &dpyinfo->mouse_highlight;
+  USE_SAFE_ALLOCA;
 
   *finish = X_EVENT_NORMAL;
 
@@ -6556,7 +6555,7 @@ handle_one_xevent (struct x_display_info *dpyinfo, XEvent *eventptr,
             }
 
           {     /* Raw bytes, not keysym.  */
-            register int i;
+            ptrdiff_t i;
             int nchars, len;
 
             for (i = 0, nchars = 0; i < nbytes; i++)
@@ -6569,7 +6568,6 @@ handle_one_xevent (struct x_display_info *dpyinfo, XEvent *eventptr,
             if (nchars < nbytes)
               {
                 /* Decode the input data.  */
-                int require;
 
                 /* The input should be decoded with `coding_system'
                    which depends on which X*LookupString function
@@ -6582,9 +6580,9 @@ handle_one_xevent (struct x_display_info *dpyinfo, XEvent *eventptr,
                    gives us composition information.  */
                 coding.common_flags &= ~CODING_ANNOTATION_MASK;
 
-                require = MAX_MULTIBYTE_LENGTH * nbytes;
-                coding.destination = alloca (require);
-                coding.dst_bytes = require;
+                SAFE_NALLOCA (coding.destination, MAX_MULTIBYTE_LENGTH,
+                              nbytes);
+                coding.dst_bytes = MAX_MULTIBYTE_LENGTH * nbytes;
                 coding.mode |= CODING_MODE_LAST_BLOCK;
                 decode_coding_c_string (&coding, copy_bufptr, nbytes, Qnil);
                 nbytes = coding.produced;
@@ -7043,6 +7041,7 @@ handle_one_xevent (struct x_display_info *dpyinfo, XEvent *eventptr,
       count++;
     }
 
+  SAFE_FREE ();
   *eventptr = event;
   return count;
 }
@@ -9872,6 +9871,7 @@ x_term_init (Lisp_Object display_name, char *xrm_option, char *resource_name)
   struct x_display_info *dpyinfo;
   XrmDatabase xrdb;
   Mouse_HLInfo *hlinfo;
+  ptrdiff_t lim;
 
   BLOCK_INPUT;
 
@@ -10094,12 +10094,15 @@ x_term_init (Lisp_Object display_name, char *xrm_option, char *resource_name)
   XSetAfterFunction (x_current_display, x_trace_wire);
 #endif /* ! 0 */
 
+  lim = min (PTRDIFF_MAX, SIZE_MAX) - sizeof "@";
+  if (lim - SBYTES (Vinvocation_name) < SBYTES (Vsystem_name))
+    memory_full (SIZE_MAX);
   dpyinfo->x_id_name
     = (char *) xmalloc (SBYTES (Vinvocation_name)
                         + SBYTES (Vsystem_name)
                         + 2);
-  sprintf (dpyinfo->x_id_name, "%s@%s",
-           SSDATA (Vinvocation_name), SSDATA (Vsystem_name));
+  strcat (strcat (strcpy (dpyinfo->x_id_name, SSDATA (Vinvocation_name)), "@"),
+          SSDATA (Vsystem_name));
 
   /* Figure out which modifier bits mean what.  */
   x_find_modifier_meanings (dpyinfo);