Merge from mainline.

7 files changed, 83 insertions, 28 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index 0a9c3d88ca5..310d32a6432 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -12,8 +12,6 @@
         (xd_remove_watch, Fdbus_init_bus, xd_read_queued_messages): Use
         SYMBOLP-guarded XSYMBOL, not XPNTR.
 
-2011-04-29  Paul Eggert  <eggert@cs.ucla.edu>
-
         * lisp.h (EMACS_INTPTR): Remove.  All uses changed to intptr_t.
         (EMACS_UINTPTR): Likewise, with uintptr_t.
 
@@ -54,8 +52,6 @@
         Use a local to convert to proper width without a cast.
         * xmenu.c (dialog_selection_callback): Likewise.
 
-2011-04-28  Paul Eggert  <eggert@cs.ucla.edu>
-
         * sysdep.c (get_random): Don't assume EMACS_INT is no wider than long.
         Also, don't assume VALBITS / RAND_BITS is less than 5,
         and don't rely on undefined behavior when shifting a 1 left into
@@ -79,6 +75,42 @@
 
         * fns.c (Frandom): Let EMACS_UINT be wider than unsigned long.
 
+2011-04-30  Eli Zaretskii  <eliz@gnu.org>
+
+        * dosfns.c (Fint86, Fdos_memget, Fdos_memput): Use `ASIZE (FOO)'
+        rather than `XVECTOR (FOO)->size'.
+
+        * process.c: Remove HAVE_INTTYPES_H condition from inclusion of
+        inttypes.h, as a gnulib replacement is used if it not available in
+        system headers.
+
+2011-04-21  Eli Zaretskii  <eliz@gnu.org>
+
+        Lift the MOST_POSITIVE_FIXNUM/4 limitation on visited files.
+        * fileio.c (Finsert_file_contents): Don't limit file size to 1/4
+        of MOST_POSITIVE_FIXNUM.  (Bug#8528)
+
+        * coding.c (coding_alloc_by_realloc): Error out if destination
+        will grow beyond MOST_POSITIVE_FIXNUM.
+        (decode_coding_emacs_mule): Abort if there isn't enough place in
+        charbuf for the composition carryover bytes.  Reserve an extra
+        space for up to 2 characters produced in a loop.
+        (decode_coding_iso_2022): Abort if there isn't enough place in
+        charbuf for the composition carryover bytes.
+
+2011-04-21  Eli Zaretskii  <eliz@gnu.org>
+
+        * doprnt.c (doprnt) [!HAVE_LONG_LONG_INT]: Error out instead of
+        aborting when %lld or %lll format is passed.
+        [!HAVE_UNSIGNED_LONG_LONG_INT]: Error out instead of aborting when
+        %llo or %llx format is passed.  (Bug#8545)
+
+        * window.c (window_scroll_line_based): Use a marker instead of
+        simple variables to record original value of point.  (Bug#7952)
+
+        * doprnt.c (doprnt): Fix the case where a multibyte sequence
+        produced by %s or %c overflows available buffer space.  (Bug#8545)
+
 2011-04-28  Paul Eggert  <eggert@cs.ucla.edu>
 
         * doprnt.c (doprnt): Omit useless test; int overflow check (Bug#8545).
diff --git a/src/coding.c b/src/coding.c
index c129c94203c..d17346efdcb 100644
--- a/src/coding.c
+++ b/src/coding.c
@@ -1071,6 +1071,8 @@ coding_set_destination (struct coding_system *coding)
 static void
 coding_alloc_by_realloc (struct coding_system *coding, EMACS_INT bytes)
 {
+  if (coding->dst_bytes >= MOST_POSITIVE_FIXNUM - bytes)
+    error ("Maximum size of buffer or string exceeded");
   coding->destination = (unsigned char *) xrealloc (coding->destination,
                                                     coding->dst_bytes + bytes);
   coding->dst_bytes += bytes;
@@ -2333,7 +2335,9 @@ decode_coding_emacs_mule (struct coding_system *coding)
   /* We may produce two annotations (charset and composition) in one
      loop and one more charset annotation at the end.  */
   int *charbuf_end
-    = coding->charbuf + coding->charbuf_size - (MAX_ANNOTATION_LENGTH * 3);
+    = coding->charbuf + coding->charbuf_size - (MAX_ANNOTATION_LENGTH * 3)
+      /* We can produce up to 2 characters in a loop.  */
+      - 1;
   EMACS_INT consumed_chars = 0, consumed_chars_base;
   int multibytep = coding->src_multibyte;
   EMACS_INT char_offset = coding->produced_char;
@@ -2348,6 +2352,8 @@ decode_coding_emacs_mule (struct coding_system *coding)
     {
       int i;
 
+      if (charbuf_end - charbuf < cmp_status->length)
+        abort ();
       for (i = 0; i < cmp_status->length; i++)
         *charbuf++ = cmp_status->carryover[i];
       coding->annotated = 1;
@@ -3479,6 +3485,8 @@ decode_coding_iso_2022 (struct coding_system *coding)
 
   if (cmp_status->state != COMPOSING_NO)
     {
+      if (charbuf_end - charbuf < cmp_status->length)
+        abort ();
       for (i = 0; i < cmp_status->length; i++)
         *charbuf++ = cmp_status->carryover[i];
       coding->annotated = 1;
diff --git a/src/doprnt.c b/src/doprnt.c
index e9a68f9d219..7b4bd35d5b1 100644
--- a/src/doprnt.c
+++ b/src/doprnt.c
@@ -269,7 +269,7 @@ doprnt (char *buffer, register size_t bufsize, const char *format,
                     long long ll = va_arg (ap, long long);
                     sprintf (sprintf_buffer, fmtcpy, ll);
 #else
-                    abort ();
+                    error ("Invalid format operation %%ll%c", fmt[-1]);
 #endif
                   }
                 else if (long_flag)
@@ -299,7 +299,7 @@ doprnt (char *buffer, register size_t bufsize, const char *format,
                     unsigned long long ull = va_arg (ap, unsigned long long);
                     sprintf (sprintf_buffer, fmtcpy, ull);
 #else
-                    abort ();
+                    error ("Invalid format operation %%ll%c", fmt[-1]);
 #endif
                   }
                 else if (long_flag)
@@ -367,9 +367,21 @@ doprnt (char *buffer, register size_t bufsize, const char *format,
                   /* Truncate the string at character boundary.  */
                   tem = bufsize;
                   while (!CHAR_HEAD_P (string[tem - 1])) tem--;
-                  memcpy (bufptr, string, tem);
-                  /* We must calculate WIDTH again.  */
-                  width = strwidth (bufptr, tem);
+                  /* If the multibyte sequence of this character is
+                     too long for the space we have left in the
+                     buffer, truncate before it.  */
+                  if (tem > 0
+                      && BYTES_BY_CHAR_HEAD (string[tem - 1]) > bufsize)
+                    tem--;
+                  if (tem > 0)
+                    memcpy (bufptr, string, tem);
+                  bufptr[tem] = 0;
+                  /* Trigger exit from the loop, but make sure we
+                     return to the caller a value which will indicate
+                     that the buffer was too small.  */
+                  bufptr += bufsize;
+                  bufsize = 0;
+                  continue;
                 }
               else
                 memcpy (bufptr, string, tem);
diff --git a/src/dosfns.c b/src/dosfns.c
index 3b9b2dbc038..e903ef20af0 100644
--- a/src/dosfns.c
+++ b/src/dosfns.c
@@ -62,7 +62,7 @@ REGISTERS should be a vector produced by `make-register' and
   CHECK_NUMBER (interrupt);
   no = (unsigned long) XINT (interrupt);
   CHECK_VECTOR (registers);
-  if (no < 0 || no > 0xff || XVECTOR (registers)-> size != 8)
+  if (no < 0 || no > 0xff || ASIZE (registers) != 8)
     return Qnil;
   for (i = 0; i < 8; i++)
     CHECK_NUMBER (XVECTOR (registers)->contents[i]);
@@ -102,7 +102,7 @@ Return the updated VECTOR.  */)
   CHECK_NUMBER (address);
   offs = (unsigned long) XINT (address);
   CHECK_VECTOR (vector);
-  len = XVECTOR (vector)-> size;
+  len = ASIZE (vector);
   if (len < 1 || len > 2048 || offs < 0 || offs > 0xfffff - len)
     return Qnil;
   buf = alloca (len);
@@ -125,7 +125,7 @@ DEFUN ("msdos-memput", Fdos_memput, Sdos_memput, 2, 2, 0,
   CHECK_NUMBER (address);
   offs = (unsigned long) XINT (address);
   CHECK_VECTOR (vector);
-  len = XVECTOR (vector)-> size;
+  len = ASIZE (vector);
   if (len < 1 || len > 2048 || offs < 0 || offs > 0xfffff - len)
     return Qnil;
   buf = alloca (len);
diff --git a/src/eval.c b/src/eval.c
index 88b8572a33e..0187cf96705 100644
--- a/src/eval.c
+++ b/src/eval.c
@@ -1994,7 +1994,7 @@ verror (const char *m, va_list ap)
 {
   char buf[4000];
   size_t size = sizeof buf;
-  size_t size_max =    min (MOST_POSITIVE_FIXNUM, SIZE_MAX);
+  size_t size_max = min (MOST_POSITIVE_FIXNUM, SIZE_MAX);
   size_t mlen = strlen (m);
   char *buffer = buf;
   size_t used;
diff --git a/src/fileio.c b/src/fileio.c
index dcba6b6c0ae..7e6fd8c82a8 100644
--- a/src/fileio.c
+++ b/src/fileio.c
@@ -3245,15 +3245,10 @@ variable `last-coding-system-used' to the coding system actually used.  */)
   record_unwind_protect (close_file_unwind, make_number (fd));
 
 
-  /* Arithmetic overflow can occur if an Emacs integer cannot represent the
-     file size, or if the calculations below overflow.  The calculations below
-     double the file size twice, so check that it can be multiplied by 4
-     safely.
-
-     Also check whether the size is negative, which can happen on a platform
-     that allows file sizes greater than the maximum off_t value.  */
+  /* Check whether the size is too large or negative, which can happen on a
+     platform that allows file sizes greater than the maximum off_t value.  */
   if (! not_regular
-      && ! (0 <= st.st_size && st.st_size <= MOST_POSITIVE_FIXNUM / 4))
+      && ! (0 <= st.st_size && st.st_size <= MOST_POSITIVE_FIXNUM))
     error ("Maximum buffer size exceeded");
 
   /* Prevent redisplay optimizations.  */
diff --git a/src/window.c b/src/window.c
index b56ed84bc61..4dbee41c5f4 100644
--- a/src/window.c
+++ b/src/window.c
@@ -5076,7 +5076,12 @@ static void
 window_scroll_line_based (Lisp_Object window, int n, int whole, int noerror)
 {
   register struct window *w = XWINDOW (window);
-  register EMACS_INT opoint = PT, opoint_byte = PT_BYTE;
+  /* Fvertical_motion enters redisplay, which can trigger
+     fontification, which in turn can modify buffer text (e.g., if the
+     fontification functions replace escape sequences with faces, as
+     in `grep-mode-font-lock-keywords').  So we use a marker to record
+     the old point position, to prevent crashes in SET_PT_BOTH.  */
+  Lisp_Object opoint_marker = Fpoint_marker ();
   register EMACS_INT pos, pos_byte;
   register int ht = window_internal_height (w);
   register Lisp_Object tem;
@@ -5126,7 +5131,8 @@ window_scroll_line_based (Lisp_Object window, int n, int whole, int noerror)
   pos = PT;
   pos_byte = PT_BYTE;
   bolp = Fbolp ();
-  SET_PT_BOTH (opoint, opoint_byte);
+  SET_PT_BOTH (marker_position (opoint_marker),
+               marker_byte_position (opoint_marker));
 
   if (lose)
     {
@@ -5177,8 +5183,9 @@ window_scroll_line_based (Lisp_Object window, int n, int whole, int noerror)
           else
             top_margin = pos;
 
-          if (top_margin <= opoint)
-            SET_PT_BOTH (opoint, opoint_byte);
+          if (top_margin <= marker_position (opoint_marker))
+            SET_PT_BOTH (marker_position (opoint_marker),
+                         marker_byte_position (opoint_marker));
           else if (!NILP (Vscroll_preserve_screen_position))
             {
               SET_PT_BOTH (pos, pos_byte);
@@ -5200,8 +5207,9 @@ window_scroll_line_based (Lisp_Object window, int n, int whole, int noerror)
           else
             bottom_margin = PT + 1;
 
-          if (bottom_margin > opoint)
-            SET_PT_BOTH (opoint, opoint_byte);
+          if (bottom_margin > marker_position (opoint_marker))
+            SET_PT_BOTH (marker_position (opoint_marker),
+                         marker_byte_position (opoint_marker));
           else
             {
               if (!NILP (Vscroll_preserve_screen_position))