* keyboard.c (make_lispy_event): Fix problem in integer overflow.

Don't assume that the difference between two unsigned long values
can fit into an integer.  At this point, we know button_down_time
<= event->timestamp, so the difference must be nonnegative, so
there's no need to cast the result if double-click-time is
nonnegative, as it should be; check that it's nonnegative, just in
case.  This bug is triggered when events are more than 2**31 ms
apart (about 25 days).

2 files changed, 15 insertions, 6 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index 4d6251f6bde..5760bfc2a1c 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,5 +1,14 @@
 2011-05-12  Paul Eggert  <eggert@cs.ucla.edu>
 
+        * keyboard.c (make_lispy_event): Fix problem in integer overflow.
+        Don't assume that the difference between two unsigned long values
+        can fit into an integer.  At this point, we know button_down_time
+        <= event->timestamp, so the difference must be nonnegative, so
+        there's no need to cast the result if double-click-time is
+        nonnegative, as it should be; check that it's nonnegative, just in
+        case.  This bug is triggered when events are more than 2**31 ms
+        apart (about 25 days).
+
         * xselect.c (last_event_timestamp): Remove duplicate decl.
         (x_own_selection): Remove needless cast to unsigned long.
 
diff --git a/src/keyboard.c b/src/keyboard.c
index a94456fce2e..287996ffba9 100644
--- a/src/keyboard.c
+++ b/src/keyboard.c
@@ -5556,9 +5556,9 @@ make_lispy_event (struct input_event *event)
                        && (eabs (XINT (event->y) - last_mouse_y) <= fuzz)
                        && button_down_time != 0
                        && (EQ (Vdouble_click_time, Qt)
-                           || (INTEGERP (Vdouble_click_time)
-                               && ((int)(event->timestamp - button_down_time)
-                                   < XINT (Vdouble_click_time)))));
+                           || (NATNUMP (Vdouble_click_time)
+                               && (event->timestamp - button_down_time
+                                   < XFASTINT (Vdouble_click_time)))));
         }
 
         last_mouse_button = button;
@@ -5742,9 +5742,9 @@ make_lispy_event (struct input_event *event)
                        && (eabs (XINT (event->y) - last_mouse_y) <= fuzz)
                        && button_down_time != 0
                        && (EQ (Vdouble_click_time, Qt)
-                           || (INTEGERP (Vdouble_click_time)
-                               && ((int)(event->timestamp - button_down_time)
-                                   < XINT (Vdouble_click_time)))));
+                           || (NATNUMP (Vdouble_click_time)
+                               && (event->timestamp - button_down_time
+                                   < XFASTINT (Vdouble_click_time)))));
           if (is_double)
             {
               double_click_count++;