Attempt to fix crashes due to accesses beyond glyph matrix end

* src/xdisp.c (x_produce_glyphs): When it->ascent and it->descent
are determined from per-character metrics, don't let the
max_ascent and max_descent become smaller than values returned by
normal_char_ascent_descent, to avoid unpleasant dynamic resizing
of screen line heights when text changes.

* src/xterm.c (x_new_font)
* src/w32term.c (x_new_font): Call get_font_ascent_descent to
obtain a reasonable value for FRAME_LINE_HEIGHT, even when a font
claims very large value for its height.

* src/font.c (font_open_entity): Call get_font_ascent_descent to
obtain a reasonable value for FRAME_SMALLEST_FONT_HEIGHT, even
when a font claims very large value for its height.

4 files changed, 28 insertions, 5 deletions

diff --git a/src/font.c b/src/font.c
index 2ccfd15d436..903a0a6984b 100644
--- a/src/font.c
+++ b/src/font.c
@@ -2908,7 +2908,12 @@ font_open_entity (struct frame *f, Lisp_Object entity, int pixel_size)
                : font->average_width ? font->average_width
                : font->space_width ? font->space_width
                : 1);
-  height = (font->height ? font->height : 1);
+
+  int font_ascent, font_descent;
+  get_font_ascent_descent (font, &font_ascent, &font_descent);
+  height = font_ascent + font_descent;
+  if (height <= 0)
+    height = 1;
 #ifdef HAVE_WINDOW_SYSTEM
   FRAME_DISPLAY_INFO (f)->n_fonts++;
   if (FRAME_DISPLAY_INFO (f)->n_fonts == 1)
diff --git a/src/w32term.c b/src/w32term.c
index 9c4f28fa2d4..b7c6e13c8a8 100644
--- a/src/w32term.c
+++ b/src/w32term.c
@@ -5832,7 +5832,7 @@ Lisp_Object
 x_new_font (struct frame *f, Lisp_Object font_object, int fontset)
 {
   struct font *font = XFONT_OBJECT (font_object);
-  int unit;
+  int unit, font_ascent, font_descent;
 
   if (fontset < 0)
     fontset = fontset_from_font (font_object);
@@ -5845,7 +5845,8 @@ x_new_font (struct frame *f, Lisp_Object font_object, int fontset)
   FRAME_FONT (f) = font;
   FRAME_BASELINE_OFFSET (f) = font->baseline_offset;
   FRAME_COLUMN_WIDTH (f) = unit = font->average_width;
-  FRAME_LINE_HEIGHT (f) = font->height;
+  get_font_ascent_descent (font, &font_ascent, &font_descent);
+  FRAME_LINE_HEIGHT (f) = font_ascent + font_descent;
 
   /* Compute number of scrollbar columns.  */
   unit = FRAME_COLUMN_WIDTH (f);
diff --git a/src/xdisp.c b/src/xdisp.c
index 53303272e60..ea9b05eabc4 100644
--- a/src/xdisp.c
+++ b/src/xdisp.c
@@ -26763,6 +26763,22 @@ x_produce_glyphs (struct it *it)
               it->nglyphs = 1;
             }
         }
+
+      if (FONT_TOO_HIGH (font))
+        {
+          int font_ascent, font_descent;
+
+          /* For very large fonts, where we ignore the declared font
+             dimensions, and go by per-character metrics instead,
+             don't let the row ascent and descent values (and the row
+             height computed from them) be smaller than the "normal"
+             character metrics.  This avoids unpleasant effects
+             whereby lines on display would change their heigh
+             depending on which characters are shown.  */
+          normal_char_ascent_descent (font, -1, &font_ascent, &font_descent);
+          it->max_ascent = max (it->max_ascent, font_ascent);
+          it->max_descent = max (it->max_descent, font_descent);
+        }
     }
   else if (it->what == IT_COMPOSITION && it->cmp_it.ch < 0)
     {
diff --git a/src/xterm.c b/src/xterm.c
index 58563ff35d0..ac77d8083e0 100644
--- a/src/xterm.c
+++ b/src/xterm.c
@@ -9410,7 +9410,7 @@ Lisp_Object
 x_new_font (struct frame *f, Lisp_Object font_object, int fontset)
 {
   struct font *font = XFONT_OBJECT (font_object);
-  int unit;
+  int unit, font_ascent, font_descent;
 
   if (fontset < 0)
     fontset = fontset_from_font (font_object);
@@ -9423,7 +9423,8 @@ x_new_font (struct frame *f, Lisp_Object font_object, int fontset)
   FRAME_FONT (f) = font;
   FRAME_BASELINE_OFFSET (f) = font->baseline_offset;
   FRAME_COLUMN_WIDTH (f) = font->average_width;
-  FRAME_LINE_HEIGHT (f) = FONT_HEIGHT (font);
+  get_font_ascent_descent (font, &font_ascent, &font_descent);
+  FRAME_LINE_HEIGHT (f) = font_ascent + font_descent;
 
 #ifndef USE_X_TOOLKIT
   FRAME_MENU_BAR_HEIGHT (f) = FRAME_MENU_BAR_LINES (f) * FRAME_LINE_HEIGHT (f);