(Fchar_equal): Check they are valid characters.

2 files changed, 6 insertions, 2 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index ceaa1e81c0c..c9bb095afea 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,5 +1,7 @@
 2008-03-17  Stefan Monnier  <monnier@iro.umontreal.ca>
 
+        * editfns.c (Fchar_equal): Check they are valid characters.
+
         * buffer.h (Fbuffer_list): Declare (for use in callint.c).
 
 2008-03-17  Andreas Schwab  <schwab@suse.de>
diff --git a/src/editfns.c b/src/editfns.c
index 0ab1630df3c..264097ffe59 100644
--- a/src/editfns.c
+++ b/src/editfns.c
@@ -4185,8 +4185,10 @@ Case is ignored if `case-fold-search' is non-nil in the current buffer.  */)
      register Lisp_Object c1, c2;
 {
   int i1, i2;
-  CHECK_NUMBER (c1);
-  CHECK_NUMBER (c2);
+  /* Check they're chars, not just integers, otherwise we could get array
+     bounds violations in DOWNCASE.  */
+  CHECK_CHARACTER (c1);
+  CHECK_CHARACTER (c2);
 
   if (XINT (c1) == XINT (c2))
     return Qt;