* xdisp.c: Integer overflow fix.

(try_window_id): Check Emacs fixnum range before converting to 'int'.

2 files changed, 5 insertions, 2 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index d2f956fe66f..e7dac0204a0 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,5 +1,8 @@
 2011-09-04  Paul Eggert  <eggert@cs.ucla.edu>
 
+        * xdisp.c: Integer overflow fix.
+        (try_window_id): Check Emacs fixnum range before converting to 'int'.
+
         * window.c: Integer overflow fixes.
         (window_scroll_line_based, Frecenter):
         Check that an Emacs fixnum is in range before assigning it to 'int'.
diff --git a/src/xdisp.c b/src/xdisp.c
index 1716cc82188..f11362c1ae6 100644
--- a/src/xdisp.c
+++ b/src/xdisp.c
@@ -16919,8 +16919,8 @@ try_window_id (struct window *w)
   {
     int this_scroll_margin, cursor_height;
 
-    this_scroll_margin = max (0, scroll_margin);
-    this_scroll_margin = min (this_scroll_margin, WINDOW_TOTAL_LINES (w) / 4);
+    this_scroll_margin =
+      max (0, min (scroll_margin, WINDOW_TOTAL_LINES (w) / 4));
     this_scroll_margin *= FRAME_LINE_HEIGHT (it.f);
     cursor_height = MATRIX_ROW (w->desired_matrix, w->cursor.vpos)->height;