Merge from origin/emacs-25

96ac0c3 Yet another fix for using pointers into buffer text
1047496 Another fix for using pointer to buffer text
3121992 Fix Bug#24478

1 files changed, 15 insertions, 3 deletions

diff --git a/src/search.c b/src/search.c
index 127a57ab1db..92bfa88eb82 100644
--- a/src/search.c
+++ b/src/search.c
@@ -2007,13 +2007,20 @@ boyer_moore (EMACS_INT n, unsigned char *base_pat,
               cursor += dirlen - i - direction; /* fix cursor */
               if (i + direction == 0)
                 {
-                  ptrdiff_t position, start, end;
+                  ptrdiff_t position, start, end, cursor_off;
 
                   cursor -= direction;
 
                   position = pos_byte + cursor - p2 + ((direction > 0)
                                                        ? 1 - len_byte : 0);
+                  /* set_search_regs might call malloc, which could
+                     cause ralloc.c relocate buffer text.  We need to
+                     update pointers into buffer text due to that.  */
+                  cursor_off = cursor - p2;
                   set_search_regs (position, len_byte);
+                  p_limit = BYTE_POS_ADDR (limit);
+                  p2 = BYTE_POS_ADDR (pos_byte);
+                  cursor = p2 + cursor_off;
 
                   if (NILP (Vinhibit_changing_match_data))
                     {
@@ -2633,6 +2640,7 @@ since only regular expressions have distinguished subexpressions.  */)
           const unsigned char *add_stuff = NULL;
           ptrdiff_t add_len = 0;
           ptrdiff_t idx = -1;
+          ptrdiff_t begbyte;
 
           if (str_multibyte)
             {
@@ -2695,11 +2703,10 @@ since only regular expressions have distinguished subexpressions.  */)
              set up ADD_STUFF and ADD_LEN to point to it.  */
           if (idx >= 0)
             {
-              ptrdiff_t begbyte = CHAR_TO_BYTE (search_regs.start[idx]);
+              begbyte = CHAR_TO_BYTE (search_regs.start[idx]);
               add_len = CHAR_TO_BYTE (search_regs.end[idx]) - begbyte;
               if (search_regs.start[idx] < GPT && GPT < search_regs.end[idx])
                 move_gap_both (search_regs.start[idx], begbyte);
-              add_stuff = BYTE_POS_ADDR (begbyte);
             }
 
           /* Now the stuff we want to add to SUBSTED
@@ -2712,6 +2719,11 @@ since only regular expressions have distinguished subexpressions.  */)
                        add_len - (substed_alloc_size - substed_len),
                        STRING_BYTES_BOUND, 1);
 
+          /* We compute this after the call to xpalloc, because that
+             could cause buffer text be relocated when ralloc.c is used.  */
+          if (idx >= 0)
+            add_stuff = BYTE_POS_ADDR (begbyte);
+
           /* Now add to the end of SUBSTED.  */
           if (add_stuff)
             {