2 files changed, 8 insertions, 0 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index 769b4ca6e64..994ea2d3de5 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,8 @@
+2013-11-22  Eli Zaretskii  <eliz@gnu.org>
+
+        * bidi.c (bidi_find_paragraph_start): Limit the returned positions
+        to BEGV_BYTE..ZV_BYTE range.  (Bug#15951)
+
 2013-11-21  Paul Eggert  <eggert@cs.ucla.edu>
 
         Fix some dependency problems that cause unnecessary recompiles.
diff --git a/src/bidi.c b/src/bidi.c
index dc905cd9e5f..98c3c17b78f 100644
--- a/src/bidi.c
+++ b/src/bidi.c
@@ -1148,6 +1148,9 @@ bidi_find_paragraph_start (ptrdiff_t pos, ptrdiff_t pos_byte)
     pos = BEGV, pos_byte = BEGV_BYTE;
   if (bpc)
     know_region_cache (current_buffer, bpc, pos, oldpos);
+  /* Positions returned by the region cache are not limited to
+     BEGV..ZV range, so we limit them here.  */
+  pos_byte = clip_to_bounds (BEGV_BYTE, pos_byte, ZV_BYTE);
   return pos_byte;
 }