Fix bug #11073 with bidi-related crashes displaying some byte sequences.

 src/bidi.c (bidi_fetch_char): Use STRING_CHAR_AND_LENGTH instead of
 FETCH_MULTIBYTE_CHAR followed by CHAR_BYTES.  Prevents crashes
 when fetching a multibyte character consumes more bytes than
 CHAR_BYTES returns, due to unification of CJK characters in
 string_char.

2 files changed, 11 insertions, 5 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index 40186c65496..028b8325aae 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,11 @@
+2012-03-23  Eli Zaretskii  <eliz@gnu.org>
+
+        * bidi.c (bidi_fetch_char): Use STRING_CHAR_AND_LENGTH instead of
+        FETCH_MULTIBYTE_CHAR followed by CHAR_BYTES.  Prevents crashes
+        when fetching a multibyte character consumes more bytes than
+        CHAR_BYTES returns, due to unification of CJK characters in
+        string_char.  (Bug#11073)
+
 2012-03-23  Troels Nielsen  <bn.troels@gmail.com>  (tiny change)
 
         * process.c (wait_reading_process_output): Handle pty disconnect
diff --git a/src/bidi.c b/src/bidi.c
index 107c817abba..b3479b17b16 100644
--- a/src/bidi.c
+++ b/src/bidi.c
@@ -932,6 +932,7 @@ bidi_fetch_char (EMACS_INT bytepos, EMACS_INT charpos, EMACS_INT *disp_pos,
   EMACS_INT endpos
     = (string->s || STRINGP (string->lstring)) ? string->schars : ZV;
   struct text_pos pos;
+  int len;
 
   /* If we got past the last known position of display string, compute
      the position of the next one.  That position could be at CHARPOS.  */
@@ -1003,7 +1004,6 @@ bidi_fetch_char (EMACS_INT bytepos, EMACS_INT charpos, EMACS_INT *disp_pos,
     normal_char:
       if (string->s)
         {
-          int len;
 
           if (!string->unibyte)
             {
@@ -1018,8 +1018,6 @@ bidi_fetch_char (EMACS_INT bytepos, EMACS_INT charpos, EMACS_INT *disp_pos,
         }
       else if (STRINGP (string->lstring))
         {
-          int len;
-
           if (!string->unibyte)
             {
               ch = STRING_CHAR_AND_LENGTH (SDATA (string->lstring) + bytepos,
@@ -1034,8 +1032,8 @@ bidi_fetch_char (EMACS_INT bytepos, EMACS_INT charpos, EMACS_INT *disp_pos,
         }
       else
         {
-          ch = FETCH_MULTIBYTE_CHAR (bytepos);
-          *ch_len = CHAR_BYTES (ch);
+          ch = STRING_CHAR_AND_LENGTH (BYTE_POS_ADDR (bytepos), len);
+          *ch_len = len;
         }
       *nchars = 1;
     }