Fix crashes when restoring sub-char-tables from desktop file

 src/lread.c (substitute_object_recurse): For sub-char-tables, start
 the recursive SUBSTITUTE loop from index of 2, to skip the
 non-Lisp members of the sub-char-table.  See the discussion at
 http://lists.gnu.org/archive/html/emacs-devel/2015-03/msg00520.html
 for the details.

2 files changed, 10 insertions, 2 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index c003e4454db..98037e851a4 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,5 +1,11 @@
 2015-03-27  Eli Zaretskii  <eliz@gnu.org>
 
+        * lread.c (substitute_object_recurse): For sub-char-tables, start
+        the recursive SUBSTITUTE loop from index of 2, to skip the
+        non-Lisp members of the sub-char-table.  See the discussion at
+        http://lists.gnu.org/archive/html/emacs-devel/2015-03/msg00520.html
+        for the details.
+
         Support non-blocking connect on MS-Windows.
         Based on ideas from Kim F. Storm <storm@cua.dk>, see
         http://lists.gnu.org/archive/html/emacs-devel/2006-12/msg00873.html.
diff --git a/src/lread.c b/src/lread.c
index ae175296ddb..050e43e2d08 100644
--- a/src/lread.c
+++ b/src/lread.c
@@ -3280,7 +3280,7 @@ substitute_object_recurse (Lisp_Object object, Lisp_Object placeholder, Lisp_Obj
     {
     case Lisp_Vectorlike:
       {
-        ptrdiff_t i, length = 0;
+        ptrdiff_t i = 0, length = 0;
         if (BOOL_VECTOR_P (subtree))
           return subtree;               /* No sub-objects anyway.  */
         else if (CHAR_TABLE_P (subtree) || SUB_CHAR_TABLE_P (subtree)
@@ -3295,7 +3295,9 @@ substitute_object_recurse (Lisp_Object object, Lisp_Object placeholder, Lisp_Obj
              behavior.  */
           wrong_type_argument (Qsequencep, subtree);
 
-        for (i = 0; i < length; i++)
+        if (SUB_CHAR_TABLE_P (subtree))
+          i = 2;
+        for ( ; i < length; i++)
           SUBSTITUTE (AREF (subtree, i),
                       ASET (subtree, i, true_value));
         return subtree;