Fix read buffer overrun on overflowed integers

* src/lread.c (read_integer): Fix off-by-1 buffer overrun
introduced in 2018-04-17T23:23:16Z!eggert@cs.ucla.edu.  The
bug could occur when Emacs read radixed integers containing
more than 100 digits.  Bug caught by AddressSanitizer.

1 files changed, 2 insertions, 2 deletions

diff --git a/src/lread.c b/src/lread.c
index d2c7eae20f9..4229ff568be 100644
--- a/src/lread.c
+++ b/src/lread.c
@@ -2680,8 +2680,8 @@ read_integer (Lisp_Object readcharfun, EMACS_INT radix)
             valid = 0;
           if (valid < 0)
             valid = 1;
-          *p = c;
-          p += p < buf + sizeof buf;
+          if (p < buf + sizeof buf)
+            *p++ = c;
           c = READCHAR;
         }