* character.c (Fstring): Check for size-calculation overflow.

2 files changed, 4 insertions, 0 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index b35f5607619..9f50e928fac 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,5 +1,7 @@
 2011-07-28  Paul Eggert  <eggert@cs.ucla.edu>
 
+        * character.c (Fstring): Check for size-calculation overflow.
+
         * ccl.c: Integer and memory overflow fixes.
         (Fccl_execute_on_string): Check for memory overflow.
         Use ptrdiff_t rather than EMACS_INT where ptrdiff_t will do.
diff --git a/src/character.c b/src/character.c
index 5e2eccf54db..50b5b252871 100644
--- a/src/character.c
+++ b/src/character.c
@@ -902,6 +902,8 @@ usage: (string &rest CHARACTERS)  */)
   Lisp_Object str;
   USE_SAFE_ALLOCA;
 
+  if (min (PTRDIFF_MAX, SIZE_MAX) / MAX_MULTIBYTE_LENGTH < n)
+    memory_full (SIZE_MAX);
   SAFE_ALLOCA (buf, unsigned char *, MAX_MULTIBYTE_LENGTH * n);
   p = buf;