Adjust drag-and-drop fix when window is above top.

* xselect.c (x_fill_property_data): Don't let sign bit of negative
XCDR bleed into XCAR's encoded value.  Improve checks for
out-of-range data while we're at it.

Fixes: debbugs:18383

2 files changed, 16 insertions, 11 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index ef130f8217e..777dcd81af2 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,10 @@
+2014-09-07  Paul Eggert  <eggert@cs.ucla.edu>
+
+        Adjust drag-and-drop fix when window is above top (Bug#18303).
+        * xselect.c (x_fill_property_data): Don't let sign bit of negative
+        XCDR bleed into XCAR's encoded value.  Improve checks for
+        out-of-range data while we're at it.
+
 2014-09-07  Jan Djärv  <jan.h.d@swipnet.se>
 
         * xselect.c (x_fill_property_data): Handle negative XCDR when data
diff --git a/src/xselect.c b/src/xselect.c
index ed359849be4..6a54b397626 100644
--- a/src/xselect.c
+++ b/src/xselect.c
@@ -2300,22 +2300,20 @@ x_fill_property_data (Display *dpy, Lisp_Object data, void *ret, int format)
 
       if (INTEGERP (o) || FLOATP (o) || CONSP (o))
         {
-          if (CONSP (o) && INTEGERP (XCAR (o)) && INTEGERP (XCDR (o)))
+          if (CONSP (o)
+              && RANGED_INTEGERP (X_LONG_MIN >> 16, XCAR (o), X_LONG_MAX >> 16)
+              && RANGED_INTEGERP (- (1 << 15), XCDR (o), -1))
             {
-              intmax_t v1 = XINT (XCAR (o));
-              intmax_t v2 = XINT (XCDR (o));
+              long v1 = XINT (XCAR (o));
+              long v2 = XINT (XCDR (o));
               /* cons_to_signed does not handle negative values for v2.
                  For XDnd, v2 might be y of a window, and can be negative.
                  The XDnd spec. is not explicit about negative values,
-                 but lets do what it says.
-              */
-              if (v1 < 0 || v2 < 0)
-                val = (v1 << 16) | v2;
-              else
-                val = cons_to_signed (o, LONG_MIN, LONG_MAX);
+                 but let's assume negative v2 is sent modulo 2**16.  */
+              val = (v1 << 16) | (v2 & 0xffff);
             }
           else
-            val = cons_to_signed (o, LONG_MIN, LONG_MAX);
+            val = cons_to_signed (o, X_LONG_MIN, X_LONG_MAX);
         }
       else if (STRINGP (o))
         {
@@ -2335,7 +2333,7 @@ x_fill_property_data (Display *dpy, Lisp_Object data, void *ret, int format)
         }
       else if (format == 16)
         {
-          if (SHRT_MIN <= val && val <= SHRT_MAX)
+          if (X_SHRT_MIN <= val && val <= X_SHRT_MAX)
             *d16++ = val;
           else
             error ("Out of 'short' range");