2 files changed, 13 insertions, 9 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index d491d089514..a9f3e3a5b70 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,5 +1,10 @@
 2011-03-22  Paul Eggert  <eggert@cs.ucla.edu>
 
+        * xdisp.c (message_log_check_duplicate): Return unsigned long, not int.
+        This is less likely to overflow, and avoids undefined behavior if
+        overflow does occur.  All callers changed.  Use strtoul to scan
+        for the unsigned long integer.
+
         * scroll.c (do_scrolling): Work around GCC bug 48228.
         See <http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48228>.
 
diff --git a/src/xdisp.c b/src/xdisp.c
index a7955f41e0c..93bc8c9479e 100644
--- a/src/xdisp.c
+++ b/src/xdisp.c
@@ -802,8 +802,8 @@ static int cursor_row_fully_visible_p (struct window *, int, int);
 static int try_scrolling (Lisp_Object, int, EMACS_INT, EMACS_INT, int, int);
 static int try_cursor_movement (Lisp_Object, struct text_pos, int *);
 static int trailing_whitespace_p (EMACS_INT);
-static int message_log_check_duplicate (EMACS_INT, EMACS_INT,
-                                        EMACS_INT, EMACS_INT);
+static unsigned long int message_log_check_duplicate (EMACS_INT, EMACS_INT,
+                                                      EMACS_INT, EMACS_INT);
 static void push_it (struct it *);
 static void pop_it (struct it *);
 static void sync_frame_with_window_matrix_rows (struct window *);
@@ -7973,7 +7973,7 @@ message_dolog (const char *m, EMACS_INT nbytes, int nlflag, int multibyte)
       if (nlflag)
         {
           EMACS_INT this_bol, this_bol_byte, prev_bol, prev_bol_byte;
-          int dups;
+          unsigned long int dups;
           insert_1 ("\n", 1, 1, 0, 0);
 
           scan_newline (Z, Z_BYTE, BEG, BEG_BYTE, -2, 0);
@@ -8001,7 +8001,7 @@ message_dolog (const char *m, EMACS_INT nbytes, int nlflag, int multibyte)
 
                       /* If you change this format, don't forget to also
                          change message_log_check_duplicate.  */
-                      sprintf (dupstr, " [%d times]", dups);
+                      sprintf (dupstr, " [%lu times]", dups);
                       duplen = strlen (dupstr);
                       TEMP_SET_PT_BOTH (Z - 1, Z_BYTE - 1);
                       insert_1 (dupstr, duplen, 1, 0, 1);
@@ -8063,7 +8063,7 @@ message_dolog (const char *m, EMACS_INT nbytes, int nlflag, int multibyte)
    Return 0 if different, 1 if the new one should just replace it, or a
    value N > 1 if we should also append " [N times]".  */
 
-static int
+static unsigned long int
 message_log_check_duplicate (EMACS_INT prev_bol, EMACS_INT prev_bol_byte,
                              EMACS_INT this_bol, EMACS_INT this_bol_byte)
 {
@@ -8085,10 +8085,9 @@ message_log_check_duplicate (EMACS_INT prev_bol, EMACS_INT prev_bol_byte,
     return 2;
   if (*p1++ == ' ' && *p1++ == '[')
     {
-      int n = 0;
-      while (*p1 >= '0' && *p1 <= '9')
-        n = n * 10 + *p1++ - '0';
-      if (strncmp ((char *) p1, " times]\n", 8) == 0)
+      char *pend;
+      unsigned long int n = strtoul ((char *) p1, &pend, 10);
+      if (strncmp (pend, " times]\n", 8) == 0)
         return n+1;
     }
   return 0;