2 files changed, 28 insertions, 11 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index f1f4aa24b35..4837d8ecb06 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,9 @@
+2010-02-06  Chong Yidong  <cyd@stupidchicken.com>
+
+        * charset.c (load_charset_map_from_file)
+        (load_charset_map_from_vector): Fix last change to use SAFE_ALLOCA
+        instead of xmalloc (Bug#5526).  Suggested by Vivek Dasmohapatra.
+
 2010-02-05  Chong Yidong  <cyd@stupidchicken.com>
 
         * charset.c (load_charset_map_from_file): Allocate large
diff --git a/src/charset.c b/src/charset.c
index 9e8ff1d59c9..1db9ec17ae7 100644
--- a/src/charset.c
+++ b/src/charset.c
@@ -512,12 +512,13 @@ load_charset_map_from_file (charset, mapfile, control_flag)
   int eof;
   Lisp_Object suffixes;
   struct charset_map_entries *head, *entries;
-  int n_entries;
-  int count = SPECPDL_INDEX ();
+  int n_entries, count;
+  USE_SAFE_ALLOCA;
 
   suffixes = Fcons (build_string (".map"),
                     Fcons (build_string (".TXT"), Qnil));
 
+  count = SPECPDL_INDEX ();
   specbind (Qfile_name_handler_alist, Qnil);
   fd = openp (Vcharset_map_path, mapfile, suffixes, NULL, Qnil);
   unbind_to (count, Qnil);
@@ -525,8 +526,12 @@ load_charset_map_from_file (charset, mapfile, control_flag)
       || ! (fp = fdopen (fd, "r")))
     error ("Failure in loading charset map: %S", SDATA (mapfile));
 
-  head = entries = ((struct charset_map_entries *)
-                    xmalloc (sizeof (struct charset_map_entries)));
+  /* Use SAFE_ALLOCA instead of alloca, as `charset_map_entries' is
+     large (larger than MAX_ALLOCA).  */
+  SAFE_ALLOCA (head, struct charset_map_entries *,
+               sizeof (struct charset_map_entries));
+  entries = head;
+
   n_entries = 0;
   eof = 0;
   while (1)
@@ -549,8 +554,8 @@ load_charset_map_from_file (charset, mapfile, control_flag)
 
       if (n_entries > 0 && (n_entries % 0x10000) == 0)
         {
-          entries->next = ((struct charset_map_entries *)
-                           alloca (sizeof (struct charset_map_entries)));
+          SAFE_ALLOCA (entries->next, struct charset_map_entries *,
+                       sizeof (struct charset_map_entries));
           entries = entries->next;
         }
       idx = n_entries % 0x10000;
@@ -563,7 +568,7 @@ load_charset_map_from_file (charset, mapfile, control_flag)
   close (fd);
 
   load_charset_map (charset, head, n_entries, control_flag);
-  xfree (head);
+  SAFE_FREE ();
 }
 
 static void
@@ -578,6 +583,7 @@ load_charset_map_from_vector (charset, vec, control_flag)
   int n_entries;
   int len = ASIZE (vec);
   int i;
+  USE_SAFE_ALLOCA;
 
   if (len % 2 == 1)
     {
@@ -585,8 +591,12 @@ load_charset_map_from_vector (charset, vec, control_flag)
       return;
     }
 
-  head = entries = ((struct charset_map_entries *)
-                    alloca (sizeof (struct charset_map_entries)));
+  /* Use SAFE_ALLOCA instead of alloca, as `charset_map_entries' is
+     large (larger than MAX_ALLOCA).  */
+  SAFE_ALLOCA (head, struct charset_map_entries *,
+               sizeof (struct charset_map_entries));
+  entries = head;
+
   n_entries = 0;
   for (i = 0; i < len; i += 2)
     {
@@ -619,8 +629,8 @@ load_charset_map_from_vector (charset, vec, control_flag)
 
       if (n_entries > 0 && (n_entries % 0x10000) == 0)
         {
-          entries->next = ((struct charset_map_entries *)
-                           alloca (sizeof (struct charset_map_entries)));
+          SAFE_ALLOCA (entries->next, struct charset_map_entries *,
+                       sizeof (struct charset_map_entries));
           entries = entries->next;
         }
       idx = n_entries % 0x10000;
@@ -631,6 +641,7 @@ load_charset_map_from_vector (charset, vec, control_flag)
     }
 
   load_charset_map (charset, head, n_entries, control_flag);
+  SAFE_FREE ();
 }