Fix kbd_buffer iteration loop in readable_events

* src/keyboard.c (readable_events): Wrap the event pointer back to the
start of the kbd_buffer array inside the top of the loop instead of
right before checking the loop condition, since kbd_fetch_ptr and
kbd_store_ptr point past the end of the array to mean that element 0
is next. (bug#21935)

1 files changed, 3 insertions, 7 deletions

diff --git a/src/keyboard.c b/src/keyboard.c
index 849066c3c26..c9e58e7a086 100644
--- a/src/keyboard.c
+++ b/src/keyboard.c
@@ -3313,14 +3313,12 @@ readable_events (int flags)
 #endif
                    ))
         {
-          union buffered_input_event *event;
-
-          event = ((kbd_fetch_ptr < kbd_buffer + KBD_BUFFER_SIZE)
-                   ? kbd_fetch_ptr
-                   : kbd_buffer);
+          union buffered_input_event *event = kbd_fetch_ptr;
 
           do
             {
+              if (event == kbd_buffer + KBD_BUFFER_SIZE)
+                event = kbd_buffer;
               if (!(
 #ifdef USE_TOOLKIT_SCROLL_BARS
                     (flags & READABLE_EVENTS_FILTER_EVENTS) &&
@@ -3337,8 +3335,6 @@ readable_events (int flags)
                        && event->kind == BUFFER_SWITCH_EVENT))
                 return 1;
               event++;
-              if (event == kbd_buffer + KBD_BUFFER_SIZE)
-                event = kbd_buffer;
             }
           while (event != kbd_store_ptr);
         }