* alloc.c (Fgc_status): Do not access beyond zombies array

boundary if nzombies > MAX_ZOMBIES.
* alloc.c (dump_zombies): Add missing format specifier.

2 files changed, 8 insertions, 2 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index 8b4f56dd8c2..5dc440d0430 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,9 @@
+2011-10-12  Dmitry Antipov  <dmantipov@yandex.ru>
+
+        * alloc.c (Fgc_status): Do not access beyond zombies array
+        boundary if nzombies > MAX_ZOMBIES.
+        * alloc.c (dump_zombies): Add missing format specifier.
+
 2011-10-12  Paul Eggert  <eggert@cs.ucla.edu>
 
         * xdisp.c (set_cursor_from_row): Simplify conditionals,
diff --git a/src/alloc.c b/src/alloc.c
index 09ef4b085df..6e999a0ba6d 100644
--- a/src/alloc.c
+++ b/src/alloc.c
@@ -4071,7 +4071,7 @@ DEFUN ("gc-status", Fgc_status, Sgc_status, 0, 0, "",
 {
   Lisp_Object args[8], zombie_list = Qnil;
   EMACS_INT i;
-  for (i = 0; i < nzombies; i++)
+  for (i = 0; i < min (MAX_ZOMBIES, nzombies); i++)
     zombie_list = Fcons (zombies[i], zombie_list);
   args[0] = build_string ("%d GCs, avg live/zombies = %.2f/%.2f (%f%%), max %d/%d\nzombies: %S");
   args[1] = make_number (ngcs);
@@ -4410,7 +4410,7 @@ dump_zombies (void)
 {
   int i;
 
-  fprintf (stderr, "\nZombies kept alive = %"pI":\n", nzombies);
+  fprintf (stderr, "\nZombies kept alive = %"pI"d:\n", nzombies);
   for (i = 0; i < min (MAX_ZOMBIES, nzombies); ++i)
     {
       fprintf (stderr, "  %d = ", i);