1 files changed, 39 insertions, 24 deletions

diff --git a/src/keymap.c b/src/keymap.c
index 4485080db21..2d2f36d91c3 100644
--- a/src/keymap.c
+++ b/src/keymap.c
@@ -1117,12 +1117,12 @@ binding is altered.  If there is no binding for KEY, the new pair
 binding KEY to DEF is added at the front of KEYMAP.  */)
   (Lisp_Object keymap, Lisp_Object key, Lisp_Object def)
 {
-  register int idx;
+  register ptrdiff_t idx;
   register Lisp_Object c;
   register Lisp_Object cmd;
   int metized = 0;
   int meta_bit;
-  int length;
+  ptrdiff_t length;
   struct gcpro gcpro1, gcpro2, gcpro3;
 
   GCPRO3 (keymap, key, def);
@@ -1274,10 +1274,10 @@ third optional argument ACCEPT-DEFAULT is non-nil, `lookup-key' will
 recognize the default bindings, just as `read-key-sequence' does.  */)
   (Lisp_Object keymap, Lisp_Object key, Lisp_Object accept_default)
 {
-  register int idx;
+  register ptrdiff_t idx;
   register Lisp_Object cmd;
   register Lisp_Object c;
-  int length;
+  ptrdiff_t length;
   int t_ok = !NILP (accept_default);
   struct gcpro gcpro1, gcpro2;
 
@@ -1527,6 +1527,19 @@ current_minor_maps (Lisp_Object **modeptr, Lisp_Object **mapptr)
   return i;
 }
 
+/* Return the offset of POSITION, a click position, in the style of
+   the respective argument of Fkey_binding.  */
+static ptrdiff_t
+click_position (Lisp_Object position)
+{
+  EMACS_INT pos = (INTEGERP (position) ? XINT (position)
+                   : MARKERP (position) ? marker_position (position)
+                   : PT);
+  if (! (BEGV <= pos && pos <= ZV))
+    args_out_of_range (Fcurrent_buffer (), position);
+  return pos;
+}
+
 DEFUN ("current-active-maps", Fcurrent_active_maps, Scurrent_active_maps,
        0, 2, 0,
        doc: /* Return a list of the currently active keymaps.
@@ -1535,7 +1548,7 @@ OLP if non-nil indicates that we should obey `overriding-local-map' and
 like in the respective argument of `key-binding'. */)
   (Lisp_Object olp, Lisp_Object position)
 {
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
 
   Lisp_Object keymaps = Fcons (current_global_map, Qnil);
 
@@ -1582,10 +1595,7 @@ like in the respective argument of `key-binding'. */)
     {
       Lisp_Object *maps;
       int nmaps, i;
-      EMACS_INT pt
-        = INTEGERP (position) ? XINT (position)
-        : MARKERP (position) ? marker_position (position)
-        : PT;
+      ptrdiff_t pt = click_position (position);
       /* This usually returns the buffer's local map,
          but that can be overridden by a `local-map' property.  */
       Lisp_Object local_map = get_local_map (pt, current_buffer, Qlocal_map);
@@ -1904,10 +1914,10 @@ accessible_keymaps_1 (Lisp_Object key, Lisp_Object cmd, Lisp_Object args, void *
   while (!NILP (tem = Frassq (cmd, maps)))
     {
       Lisp_Object prefix = XCAR (tem);
-      int lim = XINT (Flength (XCAR (tem)));
+      ptrdiff_t lim = XINT (Flength (XCAR (tem)));
       if (lim <= XINT (Flength (thisseq)))
         { /* This keymap was already seen with a smaller prefix.  */
-          int i = 0;
+          ptrdiff_t i = 0;
           while (i < lim && EQ (Faref (prefix, make_number (i)),
                                 Faref (thisseq, make_number (i))))
             i++;
@@ -1960,7 +1970,7 @@ then the value includes only maps for prefixes that start with PREFIX.  */)
   (Lisp_Object keymap, Lisp_Object prefix)
 {
   Lisp_Object maps, tail;
-  int prefixlen = XINT (Flength (prefix));
+  EMACS_INT prefixlen = XFASTINT (Flength (prefix));
 
   /* no need for gcpro because we don't autoload any keymaps.  */
 
@@ -2047,20 +2057,25 @@ Control characters turn into "C-foo" sequences, meta into "M-foo",
 spaces are put between sequence elements, etc.  */)
   (Lisp_Object keys, Lisp_Object prefix)
 {
-  int len = 0;
-  int i, i_byte;
+  ptrdiff_t len = 0;
+  EMACS_INT i;
+  ptrdiff_t i_byte;
   Lisp_Object *args;
-  int size = XINT (Flength (keys));
+  EMACS_INT size = XINT (Flength (keys));
   Lisp_Object list;
   Lisp_Object sep = build_string (" ");
   Lisp_Object key;
+  Lisp_Object result;
   int add_meta = 0;
+  USE_SAFE_ALLOCA;
 
   if (!NILP (prefix))
     size += XINT (Flength (prefix));
 
   /* This has one extra element at the end that we don't pass to Fconcat.  */
-  args = (Lisp_Object *) alloca (size * 4 * sizeof (Lisp_Object));
+  if (min (PTRDIFF_MAX, SIZE_MAX) / sizeof (Lisp_Object) / 4 < size)
+    memory_full (SIZE_MAX);
+  SAFE_ALLOCA_LISP (args, size * 4);
 
   /* In effect, this computes
      (mapconcat 'single-key-description keys " ")
@@ -2078,9 +2093,9 @@ spaces are put between sequence elements, etc.  */)
           args[len] = Fsingle_key_description (meta_prefix_char, Qnil);
           len += 2;
         }
-      else if (len == 0)
-        return empty_unibyte_string;
-      return Fconcat (len - 1, args);
+      result = len == 0 ? empty_unibyte_string : Fconcat (len - 1, args);
+      SAFE_FREE ();
+      return result;
     }
 
   if (STRINGP (list))
@@ -2342,7 +2357,7 @@ See Info node `(elisp)Describing Characters' for examples.  */)
   char str[6];
   int c;
 
-  CHECK_NUMBER (character);
+  CHECK_CHARACTER (character);
 
   c = XINT (character);
   if (!ASCII_CHAR_P (c))
@@ -2365,8 +2380,8 @@ static int where_is_preferred_modifier;
 static int
 preferred_sequence_p (Lisp_Object seq)
 {
-  int i;
-  int len = XINT (Flength (seq));
+  EMACS_INT i;
+  EMACS_INT len = XFASTINT (Flength (seq));
   int result = 1;
 
   for (i = 0; i < len; i++)
@@ -3083,7 +3098,7 @@ static void
 describe_command (Lisp_Object definition, Lisp_Object args)
 {
   register Lisp_Object tem1;
-  EMACS_INT column = current_column ();
+  ptrdiff_t column = current_column ();
   int description_column;
 
   /* If column 16 is no good, go to col 32;
@@ -3366,7 +3381,7 @@ This is text showing the elements of vector matched against indices.
 DESCRIBER is the output function used; nil means use `princ'.  */)
   (Lisp_Object vector, Lisp_Object describer)
 {
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   if (NILP (describer))
     describer = intern ("princ");
   specbind (Qstandard_output, Fcurrent_buffer ());