(w32_wnd_proc, Fw32_reconstruct_hot_key): Range check

before dereferencing array.
(lookup_vk_code): Remove zero comparison.

2 files changed, 10 insertions, 4 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index 87f9894f488..7d2240f7829 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,9 @@
+2007-12-13  Jason Rumney  <jasonr@gnu.org>
+
+        * w32fns.c (w32_wnd_proc, Fw32_reconstruct_hot_key): Range check
+        before dereferencing array.
+        (lookup_vk_code): Remove zero comparison.
+
 2007-12-02  Magnus Henoch  <mange@freemail.hu>
 
         * process.c (make_process): Initialize pty_flag to 0.
diff --git a/src/w32fns.c b/src/w32fns.c
index a006531f2b3..9492989e735 100644
--- a/src/w32fns.c
+++ b/src/w32fns.c
@@ -2956,7 +2956,7 @@ w32_wnd_proc (hwnd, msg, wParam, lParam)
              they don't produce WM_CHAR messages).  This ensures that
              indicator lights are toggled promptly on Windows 9x, for
              example.  */
-          if (lispy_function_keys[wParam] != 0)
+          if (wParam < 256 && lispy_function_keys[wParam])
             {
               windows_translate = 1;
               goto translate;
@@ -3078,7 +3078,7 @@ w32_wnd_proc (hwnd, msg, wParam, lParam)
           break;
         default:
           /* If not defined as a function key, change it to a WM_CHAR message. */
-          if (lispy_function_keys[wParam] == 0)
+          if (wParam > 255 || !lispy_function_keys[wParam])
             {
               DWORD modifiers = construct_console_modifiers ();
 
@@ -8129,7 +8129,7 @@ lookup_vk_code (char *key)
   int i;
 
   for (i = 0; i < 256; i++)
-    if (lispy_function_keys[i] != 0
+    if (lispy_function_keys[i]
         && strcmp (lispy_function_keys[i], key) == 0)
       return i;
 
@@ -8307,7 +8307,7 @@ usage: (w32-reconstruct-hot-key ID)  */)
   vk_code = HOTKEY_VK_CODE (hotkeyid);
   w32_modifiers = HOTKEY_MODIFIERS (hotkeyid);
 
-  if (lispy_function_keys[vk_code])
+  if (vk_code < 256 && lispy_function_keys[vk_code])
     key = intern (lispy_function_keys[vk_code]);
   else
     key = make_number (vk_code);