(coding_allocate_composition_data): Reset

coding->composing to COMPOSITION_NO.
(coding_restore_composition): Detect invalid composition data.
Give Fstring and Fvector a Lispy integer, not C int.

2 files changed, 14 insertions, 1 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index 7f56e848050..6ca5fb6d0ee 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,10 @@
+2003-11-07  Kenichi Handa  <handa@m17n.org>
+
+        * coding.c (coding_allocate_composition_data): Reset
+        coding->composing to COMPOSITION_NO.
+        (coding_restore_composition): Detect invalid composition data.
+        Give Fstring and Fvector a Lispy integer, not C int.
+
 2003-11-03  Jan Dj,Ad(Brv  <jan.h.d@swipnet.se>
 
         * xterm.c (x_term_init): Fix formatting.
diff --git a/src/coding.c b/src/coding.c
index 12558b958c4..897538f3835 100644
--- a/src/coding.c
+++ b/src/coding.c
@@ -1689,6 +1689,7 @@ coding_allocate_composition_data (coding, char_offset)
     coding->cmp_data->next = cmp_data;
   coding->cmp_data = cmp_data;
   coding->cmp_data_start = 0;
+  coding->composing = COMPOSITION_NO;
 }
 
 /* Handle composition start sequence ESC 0, ESC 2, ESC 3, or ESC 4.
@@ -5440,6 +5441,10 @@ coding_restore_composition (coding, obj)
           enum composition_method method = (enum composition_method) data[3];
           Lisp_Object components;
 
+          if (data[0] < 0 || i + data[0] > cmp_data->used)
+            /* Invalid composition data.  */
+            break;
+
           if (method == COMPOSITION_RELATIVE)
             components = Qnil;
           else
@@ -5453,7 +5458,8 @@ coding_restore_composition (coding, obj)
               for (j = 0; j < len; j++)
                 args[j] = make_number (data[4 + j]);
               components = (method == COMPOSITION_WITH_ALTCHARS
-                            ? Fstring (len, args) : Fvector (len, args));
+                            ? Fstring (make_number (len), args)
+                            : Fvector (make_number (len), args));
             }
           compose_text (data[1], data[2], components, Qnil, obj);
         }