* fns.c (sxhash_bool_vector): Fix buffer read overrun.

2 files changed, 7 insertions, 1 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index 0597c5d9f21..f46733d1ebe 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,7 @@
+2013-10-09  Paul Eggert  <eggert@cs.ucla.edu>
+
+        * fns.c (sxhash_bool_vector): Fix buffer read overrun.
+
 2013-10-09  Eli Zaretskii  <eliz@gnu.org>
 
         * term.c (tty_menu_activate): Flush the output stream after
diff --git a/src/fns.c b/src/fns.c
index e991711b871..1ee0a758fc2 100644
--- a/src/fns.c
+++ b/src/fns.c
@@ -4191,7 +4191,9 @@ sxhash_bool_vector (Lisp_Object vec)
   EMACS_UINT hash = XBOOL_VECTOR (vec)->size;
   int i, n;
 
-  n = min (SXHASH_MAX_LEN, XBOOL_VECTOR (vec)->header.size);
+  n = min (SXHASH_MAX_LEN,
+           ((XBOOL_VECTOR (vec)->size + BOOL_VECTOR_BITS_PER_CHAR - 1)
+            / BOOL_VECTOR_BITS_PER_CHAR));
   for (i = 0; i < n; ++i)
     hash = sxhash_combine (hash, XBOOL_VECTOR (vec)->data[i]);