* font.c (font_style_to_value, font_style_symbolic)

(font_prop_validate_style): Add type checks for values in
font_style_table.

2 files changed, 40 insertions, 11 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index fe66f77fc43..ce817c19894 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,5 +1,9 @@
 2012-06-30  Andreas Schwab  <schwab@linux-m68k.org>
 
+        * font.c (font_style_to_value, font_style_symbolic)
+        (font_prop_validate_style): Add type checks for values in
+        font_style_table.
+
         * lisp.h (CHECK_RANGED_INTEGER): Make value to check the first
         argument.
         * character.c, charset.c, menu.c, process.c, window.c: Adjust all
diff --git a/src/font.c b/src/font.c
index f9e0e5bdcc0..555c76c73c8 100644
--- a/src/font.c
+++ b/src/font.c
@@ -326,7 +326,10 @@ int
 font_style_to_value (enum font_property_index prop, Lisp_Object val, int noerror)
 {
   Lisp_Object table = AREF (font_style_table, prop - FONT_WEIGHT_INDEX);
-  int len = ASIZE (table);
+  int len;
+
+  CHECK_VECTOR (table);
+  len = ASIZE (table);
 
   if (SYMBOLP (val))
     {
@@ -336,10 +339,16 @@ font_style_to_value (enum font_property_index prop, Lisp_Object val, int noerror
 
       /* At first try exact match.  */
       for (i = 0; i < len; i++)
-        for (j = 1; j < ASIZE (AREF (table, i)); j++)
-          if (EQ (val, AREF (AREF (table, i), j)))
-            return ((XINT (AREF (AREF (table, i), 0)) << 8)
-                    | (i << 4) | (j - 1));
+        {
+          CHECK_VECTOR (AREF (table, i));
+          for (j = 1; j < ASIZE (AREF (table, i)); j++)
+            if (EQ (val, AREF (AREF (table, i), j)))
+              {
+                CHECK_NUMBER (AREF (AREF (table, i), 0));
+                return ((XINT (AREF (AREF (table, i), 0)) << 8)
+                        | (i << 4) | (j - 1));
+              }
+        }
       /* Try also with case-folding match.  */
       s = SSDATA (SYMBOL_NAME (val));
       for (i = 0; i < len; i++)
@@ -347,8 +356,11 @@ font_style_to_value (enum font_property_index prop, Lisp_Object val, int noerror
           {
             elt = AREF (AREF (table, i), j);
             if (xstrcasecmp (s, SSDATA (SYMBOL_NAME (elt))) == 0)
-              return ((XINT (AREF (AREF (table, i), 0)) << 8)
-                      | (i << 4) | (j - 1));
+              {
+                CHECK_NUMBER (AREF (AREF (table, i), 0));
+                return ((XINT (AREF (AREF (table, i), 0)) << 8)
+                        | (i << 4) | (j - 1));
+              }
           }
       if (! noerror)
         return -1;
@@ -368,8 +380,11 @@ font_style_to_value (enum font_property_index prop, Lisp_Object val, int noerror
 
       for (i = 0, last_n = -1; i < len; i++)
         {
-          int n = XINT (AREF (AREF (table, i), 0));
+          int n;
 
+          CHECK_VECTOR (AREF (table, i));
+          CHECK_NUMBER (AREF (AREF (table, i), 0));
+          n = XINT (AREF (AREF (table, i), 0));
           if (numeric == n)
             return (n << 8) | (i << 4);
           if (numeric < n)
@@ -397,11 +412,15 @@ font_style_symbolic (Lisp_Object font, enum font_property_index prop, int for_fa
   if (NILP (val))
     return Qnil;
   table = AREF (font_style_table, prop - FONT_WEIGHT_INDEX);
+  CHECK_VECTOR (table);
   i = XINT (val) & 0xFF;
   font_assert (((i >> 4) & 0xF) < ASIZE (table));
   elt = AREF (table, ((i >> 4) & 0xF));
+  CHECK_VECTOR (elt);
   font_assert ((i & 0xF) + 1 < ASIZE (elt));
-  return (for_face ? AREF (elt, 1) : AREF (elt, (i & 0xF) + 1));
+  elt = (for_face ? AREF (elt, 1) : AREF (elt, (i & 0xF) + 1));
+  CHECK_SYMBOL (elt);
+  return elt;
 }
 
 /* Return ENCODING or a cons of ENCODING and REPERTORY of the font
@@ -519,6 +538,7 @@ font_prop_validate_style (Lisp_Object style, Lisp_Object val)
   if (INTEGERP (val))
     {
       EMACS_INT n = XINT (val);
+      CHECK_VECTOR (AREF (font_style_table, prop - FONT_WEIGHT_INDEX));
       if (((n >> 4) & 0xF)
           >= ASIZE (AREF (font_style_table, prop - FONT_WEIGHT_INDEX)))
         val = Qerror;
@@ -526,10 +546,15 @@ font_prop_validate_style (Lisp_Object style, Lisp_Object val)
         {
           Lisp_Object elt = AREF (AREF (font_style_table, prop - FONT_WEIGHT_INDEX), (n >> 4) & 0xF);
 
+          CHECK_VECTOR (elt);
           if ((n & 0xF) + 1 >= ASIZE (elt))
             val = Qerror;
-          else if (XINT (AREF (elt, 0)) != (n >> 8))
-            val = Qerror;
+          else
+            {
+              CHECK_NUMBER (AREF (elt, 0));
+              if (XINT (AREF (elt, 0)) != (n >> 8))
+                val = Qerror;
+            }
         }
     }
   else if (SYMBOLP (val))