* alloc.c (allocate_string_data): Update next_free immediately, to

	reduce risk of memory clobberage.

2 files changed, 7 insertions, 1 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index 5f3e1322395..4ee94dff693 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,8 @@
+2006-01-24  Chong Yidong  <cyd@stupidchicken.com>
+
+        * alloc.c (allocate_string_data): Update next_free immediately, to
+        reduce risk of memory clobberage.
+
 2006-01-24  L$,1 q(Brentey K,Aa(Broly  <lorentey@elte.hu>
 
         * xdisp.c (handle_invisible_prop): Set it->position to fix cursor
diff --git a/src/alloc.c b/src/alloc.c
index d81a9bf853b..f0c77a26710 100644
--- a/src/alloc.c
+++ b/src/alloc.c
@@ -1978,6 +1978,8 @@ allocate_string_data (s, nchars, nbytes)
   old_nbytes = GC_STRING_BYTES (s);
 
   data = b->next_free;
+  b->next_free = (struct sdata *) ((char *) data + needed + GC_STRING_EXTRA);
+
   data->string = s;
   s->data = SDATA_DATA (data);
 #ifdef GC_CHECK_STRING_BYTES
@@ -1990,7 +1992,6 @@ allocate_string_data (s, nchars, nbytes)
   bcopy (string_overrun_cookie, (char *) data + needed,
          GC_STRING_OVERRUN_COOKIE_SIZE);
 #endif
-  b->next_free = (struct sdata *) ((char *) data + needed + GC_STRING_EXTRA);
 
   /* If S had already data assigned, mark that as free by setting its
      string back-pointer to null, and recording the size of the data