2 files changed, 56 insertions, 46 deletions

diff --git a/src/editfns.c b/src/editfns.c
index 98187df5d97..1dbae8f5d4b 100644
--- a/src/editfns.c
+++ b/src/editfns.c
@@ -3851,6 +3851,23 @@ usage: (propertize STRING &rest PROPERTIES)  */)
   return string;
 }
 
+/* Convert the prefix of STR from ASCII decimal digits to a number.
+   Set *STR_END to the address of the first non-digit.  Return the
+   number, or PTRDIFF_MAX on overflow.  Return 0 if there is no number.
+   This is like strtol for ptrdiff_t and base 10 and C locale,
+   except without negative numbers or errno.  */
+
+static ptrdiff_t
+str2num (char *str, char **str_end)
+{
+  ptrdiff_t n = 0;
+  for (; c_isdigit (*str); str++)
+    if (INT_MULTIPLY_WRAPV (n, 10, &n) || INT_ADD_WRAPV (n, *str - '0', &n))
+      n = PTRDIFF_MAX;
+  *str_end = str;
+  return n;
+}
+
 DEFUN ("format", Fformat, Sformat, 1, MANY, 0,
        doc: /* Format a string out of a format-string and arguments.
 The first argument is a format control string.
@@ -4057,17 +4074,16 @@ styled_format (ptrdiff_t nargs, Lisp_Object *args, bool message)
              digits to print after the '.' for floats, or the max.
              number of chars to print from a string.  */
 
-          uintmax_t num;
+          ptrdiff_t num;
           char *num_end;
           if (c_isdigit (*format))
             {
-              num = strtoumax (format, &num_end, 10);
+              num = str2num (format, &num_end);
               if (*num_end == '$')
                 {
                   if (num == 0)
                     error ("Invalid format field number 0");
-                  n = min (num, PTRDIFF_MAX);
-                  n--;
+                  n = num - 1;
                   format = num_end + 1;
                 }
             }
@@ -4095,15 +4111,15 @@ styled_format (ptrdiff_t nargs, Lisp_Object *args, bool message)
           space_flag &= ! plus_flag;
           zero_flag &= ! minus_flag;
 
-          num = strtoumax (format, &num_end, 10);
+          num = str2num (format, &num_end);
           if (max_bufsize <= num)
             string_overflow ();
           ptrdiff_t field_width = num;
 
           bool precision_given = *num_end == '.';
-          uintmax_t precision = (precision_given
-                                 ? strtoumax (num_end + 1, &num_end, 10)
-                                 : UINTMAX_MAX);
+          ptrdiff_t precision = (precision_given
+                                 ? str2num (num_end + 1, &num_end)
+                                 : PTRDIFF_MAX);
           format = num_end;
 
           if (format == end)
@@ -4176,7 +4192,7 @@ styled_format (ptrdiff_t nargs, Lisp_Object *args, bool message)
               /* handle case (precision[n] >= 0) */
 
               ptrdiff_t prec = -1;
-              if (precision_given && precision <= TYPE_MAXIMUM (ptrdiff_t))
+              if (precision_given)
                 prec = precision;
 
               /* lisp_string_width ignores a precision of 0, but GNU
@@ -4424,8 +4440,9 @@ styled_format (ptrdiff_t nargs, Lisp_Object *args, bool message)
                  padding and excess precision.  Deal with excess precision
                  first.  This happens only when the format specifies
                  ridiculously large precision.  */
-              uintmax_t excess_precision = precision - prec;
-              uintmax_t leading_zeros = 0, trailing_zeros = 0;
+              ptrdiff_t excess_precision
+                = precision_given ? precision - prec : 0;
+              ptrdiff_t leading_zeros = 0, trailing_zeros = 0;
               if (excess_precision)
                 {
                   if (float_conversion)
@@ -4451,7 +4468,9 @@ styled_format (ptrdiff_t nargs, Lisp_Object *args, bool message)
 
               /* Compute the total bytes needed for this item, including
                  excess precision and padding.  */
-              uintmax_t numwidth = sprintf_bytes + excess_precision;
+              ptrdiff_t numwidth;
+              if (INT_ADD_WRAPV (sprintf_bytes, excess_precision, &numwidth))
+                numwidth = PTRDIFF_MAX;
               ptrdiff_t padding
                 = numwidth < field_width ? field_width - numwidth : 0;
               if (max_bufsize - sprintf_bytes <= excess_precision
diff --git a/src/lread.c b/src/lread.c
index 368b86e8189..f8493982c67 100644
--- a/src/lread.c
+++ b/src/lread.c
@@ -3495,25 +3495,18 @@ substitute_in_interval (INTERVAL interval, Lisp_Object arg)
 }
 
 
-#define LEAD_INT 1
-#define DOT_CHAR 2
-#define TRAIL_INT 4
-#define E_EXP 16
-
-
-/* Convert STRING to a number, assuming base BASE.  Return a fixnum if CP has
-   integer syntax and fits in a fixnum, else return the nearest float if CP has
-   either floating point or integer syntax and BASE is 10, else return nil.  If
-   IGNORE_TRAILING, consider just the longest prefix of CP that has
-   valid floating point syntax.  Signal an overflow if BASE is not 10 and the
-   number has integer syntax but does not fit.  */
+/* Convert STRING to a number, assuming base BASE.  Return a fixnum if
+   STRING has integer syntax and fits in a fixnum, else return the
+   nearest float if STRING has either floating point or integer syntax
+   and BASE is 10, else return nil.  If IGNORE_TRAILING, consider just
+   the longest prefix of STRING that has valid floating point syntax.
+   Signal an overflow if BASE is not 10 and the number has integer
+   syntax but does not fit.  */
 
 Lisp_Object
 string_to_number (char const *string, int base, bool ignore_trailing)
 {
-  int state;
   char const *cp = string;
-  int leading_digit;
   bool float_syntax = 0;
   double value = 0;
 
@@ -3525,15 +3518,23 @@ string_to_number (char const *string, int base, bool ignore_trailing)
   bool signedp = negative || *cp == '+';
   cp += signedp;
 
-  state = 0;
-
-  leading_digit = digit_to_number (*cp, base);
+  enum { INTOVERFLOW = 1, LEAD_INT = 2, DOT_CHAR = 4, TRAIL_INT = 8,
+         E_EXP = 16 };
+  int state = 0;
+  int leading_digit = digit_to_number (*cp, base);
+  uintmax_t n = leading_digit;
   if (leading_digit >= 0)
     {
       state |= LEAD_INT;
-      do
-        ++cp;
-      while (digit_to_number (*cp, base) >= 0);
+      for (int digit; 0 <= (digit = digit_to_number (*++cp, base)); )
+        {
+          if (INT_MULTIPLY_OVERFLOW (n, base))
+            state |= INTOVERFLOW;
+          n *= base;
+          if (INT_ADD_OVERFLOW (n, digit))
+            state |= INTOVERFLOW;
+          n += digit;
+        }
     }
   if (*cp == '.')
     {
@@ -3583,32 +3584,22 @@ string_to_number (char const *string, int base, bool ignore_trailing)
         }
 
       float_syntax = ((state & (DOT_CHAR|TRAIL_INT)) == (DOT_CHAR|TRAIL_INT)
-                      || state == (LEAD_INT|E_EXP));
+                      || (state & ~INTOVERFLOW) == (LEAD_INT|E_EXP));
     }
 
   /* Return nil if the number uses invalid syntax.  If IGNORE_TRAILING, accept
      any prefix that matches.  Otherwise, the entire string must match.  */
   if (! (ignore_trailing
          ? ((state & LEAD_INT) != 0 || float_syntax)
-         : (!*cp && ((state & ~DOT_CHAR) == LEAD_INT || float_syntax))))
+         : (!*cp && ((state & ~(INTOVERFLOW | DOT_CHAR)) == LEAD_INT
+                     || float_syntax))))
     return Qnil;
 
   /* If the number uses integer and not float syntax, and is in C-language
      range, use its value, preferably as a fixnum.  */
   if (leading_digit >= 0 && ! float_syntax)
     {
-      uintmax_t n;
-
-      /* Fast special case for single-digit integers.  This also avoids a
-         glitch when BASE is 16 and IGNORE_TRAILING, because in that
-         case some versions of strtoumax accept numbers like "0x1" that Emacs
-         does not allow.  */
-      if (digit_to_number (string[signedp + 1], base) < 0)
-        return make_number (negative ? -leading_digit : leading_digit);
-
-      errno = 0;
-      n = strtoumax (string + signedp, NULL, base);
-      if (errno == ERANGE)
+      if (state & INTOVERFLOW)
         {
           /* Unfortunately there's no simple and accurate way to convert
              non-base-10 numbers that are out of C-language range.  */