1 files changed, 21 insertions, 3 deletions

diff --git a/src/character.h b/src/character.h
index 063b5147dc9..5ae6cb8c49c 100644
--- a/src/character.h
+++ b/src/character.h
@@ -556,6 +556,16 @@ along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
   } while (0)
 
 
+/* Return a non-outlandish value for the tab width.  */
+
+#define SANE_TAB_WIDTH(buf) \
+  sanitize_tab_width (XFASTINT (BVAR (buf, tab_width)))
+static inline int
+sanitize_tab_width (EMACS_INT width)
+{
+  return 0 < width && width <= 1000 ? width : 8;
+}
+
 /* Return the width of ASCII character C.  The width is measured by
    how many columns C will occupy on the screen when displayed in the
    current buffer.  */
@@ -563,12 +573,20 @@ along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
 #define ASCII_CHAR_WIDTH(c)                                             \
   (c < 0x20                                                             \
    ? (c == '\t'                                                         \
-      ? XFASTINT (BVAR (current_buffer, tab_width))                             \
+      ? SANE_TAB_WIDTH (current_buffer)                                 \
       : (c == '\n' ? 0 : (NILP (BVAR (current_buffer, ctl_arrow)) ? 4 : 2)))    \
    : (c < 0x7f                                                          \
       ? 1                                                               \
       : ((NILP (BVAR (current_buffer, ctl_arrow)) ? 4 : 2))))
 
+/* Return a non-outlandish value for a character width.  */
+
+static inline int
+sanitize_char_width (EMACS_INT width)
+{
+  return 0 <= width && width <= 1000 ? width : 1000;
+}
+
 /* Return the width of character C.  The width is measured by how many
    columns C will occupy on the screen when displayed in the current
    buffer.  */
@@ -576,9 +594,9 @@ along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
 #define CHAR_WIDTH(c)           \
   (ASCII_CHAR_P (c)             \
    ? ASCII_CHAR_WIDTH (c)       \
-   : XINT (CHAR_TABLE_REF (Vchar_width_table, c)))
+   : sanitize_char_width (XINT (CHAR_TABLE_REF (Vchar_width_table, c))))
 
-/* If C is a variation selector, return the index numnber of the
+/* If C is a variation selector, return the index of the
    variation selector (1..256).  Otherwise, return 0.  */
 
 #define CHAR_VARIATION_SELECTOR_P(c)            \