* editfns.c (Fformat): Fix off-by-1 bug for "%%b" (Bug#9514).

This occurs when processing a multibyte format, which can happen
when using 'eval'.  Problem reported by Wolfgang Jenker.

2 files changed, 9 insertions, 2 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index 83dc66a1720..895e3e587b3 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,9 @@
+2011-09-15  Paul Eggert  <eggert@cs.ucla.edu>
+
+        * editfns.c (Fformat): Fix off-by-1 bug for "%%b" (Bug#9514).
+        This occurs when processing a multibyte format, which can happen
+        when using 'eval'.  Problem reported by Wolfgang Jenker.
+
 2011-09-15  Johan Bockgård  <bojohan@gnu.org>
 
         * xdisp.c (try_cursor_movement): Only check for exact match if
diff --git a/src/editfns.c b/src/editfns.c
index 596765d899e..f62efc30790 100644
--- a/src/editfns.c
+++ b/src/editfns.c
@@ -4137,8 +4137,9 @@ usage: (format STRING &rest OBJECTS)  */)
                 format++;
               while (! CHAR_HEAD_P (*format));
 
-              convbytes = format - format0;
-              memset (&discarded[format0 + 1 - format_start], 2, convbytes - 1);
+              convbytes = format - src;
+              memset (&discarded[format0 + 1 - format_start], 2,
+                      format - (format0 + 1));
             }
           else
             {