Minor integer overflow fixes.

* window.c (Fset_window_new_pixel): Don't let new_pixel go negative.
This improves on the previous fix to this function.
(window_resize_check): When summing up pixel counts, don't rely on
undefined behavior if the sum overflows.

Fixes: debbugs:16033

2 files changed, 20 insertions, 10 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index bdd111f5083..44039f83d8b 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,11 @@
+2013-12-03  Paul Eggert  <eggert@cs.ucla.edu>
+
+        Minor integer overflow fixes (Bug#16033).
+        * window.c (Fset_window_new_pixel): Don't let new_pixel go negative.
+        This improves on the previous fix to this function.
+        (window_resize_check): When summing up pixel counts, don't rely on
+        undefined behavior if the sum overflows.
+
 2013-12-03  Martin Rudalics  <rudalics@gmx.at>
 
         * window.c (Fset_window_new_pixel): Don't choke at negative
diff --git a/src/window.c b/src/window.c
index 1ef2b4a0e38..b7d4502e3ec 100644
--- a/src/window.c
+++ b/src/window.c
@@ -3646,10 +3646,8 @@ Note: This function does not operate on any child windows of WINDOW.  */)
   (Lisp_Object window, Lisp_Object size, Lisp_Object add)
 {
   struct window *w = decode_valid_window (window);
-  EMACS_INT size_min = (max (INT_MIN, MOST_NEGATIVE_FIXNUM)
-                        + (NILP (add) ? 0 : XINT (w->new_pixel)));
-  EMACS_INT size_max = (min (INT_MAX, MOST_POSITIVE_FIXNUM)
-                        - (NILP (add) ? 0 : XINT (w->new_pixel)));
+  EMACS_INT size_min = NILP (add) ? 0 : - XINT (w->new_pixel);
+  EMACS_INT size_max = size_min + min (INT_MAX, MOST_POSITIVE_FIXNUM);
 
   CHECK_RANGED_INTEGER (size, size_min, size_max);
   if (NILP (add))
@@ -3729,18 +3727,20 @@ window_resize_check (struct window *w, bool horflag)
         /* The sum of the heights of the child windows of W must equal
            W's height.  */
         {
-          int sum_of_pixels = 0;
+          int remaining_pixels = XINT (w->new_pixel);
 
           while (c)
             {
               if (!window_resize_check (c, horflag))
                 return 0;
 
-              sum_of_pixels = sum_of_pixels + XINT (c->new_pixel);
+              remaining_pixels -= XINT (c->new_pixel);
+              if (remaining_pixels < 0)
+                return 0;
               c = NILP (c->next) ? 0 : XWINDOW (c->next);
             }
 
-          return (sum_of_pixels == XINT (w->new_pixel));
+          return remaining_pixels == 0;
         }
     }
   else if (WINDOW_HORIZONTAL_COMBINATION_P (w))
@@ -3751,18 +3751,20 @@ window_resize_check (struct window *w, bool horflag)
         /* The sum of the widths of the child windows of W must equal W's
            width.  */
         {
-          int sum_of_pixels = 0;
+          int remaining_pixels = XINT (w->new_pixel);
 
           while (c)
             {
               if (!window_resize_check (c, horflag))
                 return 0;
 
-              sum_of_pixels = sum_of_pixels + XINT (c->new_pixel);
+              remaining_pixels -= XINT (c->new_pixel);
+              if (remaining_pixels < 0)
+                return 0;
               c = NILP (c->next) ? 0 : XWINDOW (c->next);
             }
 
-          return (sum_of_pixels == XINT (w->new_pixel));
+          return remaining_pixels == 0;
         }
       else
         /* All child windows of W must have the same height as W.  */