4 files changed, 16 insertions, 2 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index e22eab5f072..723556414f4 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -787,6 +787,20 @@
         rather than rolling our own approximation.
         (SCROLL_BAR_VEC_SIZE): Remove; not used.
 
+2011-10-13  Dmitry Antipov  <dmantipov@yandex.ru>
+
+        * editfns.c (Fset_time_zone_rule): Replace free with xfree to
+        avoid crash when xmalloc overrun checking is enabled.
+
+2011-10-13  Eli Zaretskii  <eliz@gnu.org>
+
+        * xdisp.c (Fcurrent_bidi_paragraph_direction): Initialize
+        itb.paragraph_dir to NEUTRAL_DIR.  Fixes an occasional incorrect
+        cursor motion with <left> and <right> arrow keys.
+
+        * bidi.c (bidi_init_it): Don't initialize paragraph_dir here, as
+        some callers set that themselves.
+
 2011-10-12  Eli Zaretskii  <eliz@gnu.org>
 
         * xdisp.c (find_row_edges): Handle the case where ROW comes from a
diff --git a/src/bidi.c b/src/bidi.c
index e4965ed59ac..c6d7db96576 100644
--- a/src/bidi.c
+++ b/src/bidi.c
@@ -808,7 +808,6 @@ bidi_init_it (ptrdiff_t charpos, ptrdiff_t bytepos, int frame_window_p,
   bidi_it->nchars = -1; /* to be computed in bidi_resolve_explicit_1 */
   bidi_it->first_elt = 1;
   bidi_set_paragraph_end (bidi_it);
-  bidi_it->paragraph_dir = NEUTRAL_DIR;
   bidi_it->new_paragraph = 1;
   bidi_it->separator_limit = -1;
   bidi_it->type = NEUTRAL_B;
diff --git a/src/editfns.c b/src/editfns.c
index 8489a47649e..48b601860ca 100644
--- a/src/editfns.c
+++ b/src/editfns.c
@@ -2069,7 +2069,7 @@ only the former.  */)
     }
 
   set_time_zone_rule (tzstring);
-  free (environbuf);
+  xfree (environbuf);
   environbuf = environ;
 
   return Qnil;
diff --git a/src/xdisp.c b/src/xdisp.c
index e9e8f8f4206..a264da3892a 100644
--- a/src/xdisp.c
+++ b/src/xdisp.c
@@ -19491,6 +19491,7 @@ See also `bidi-paragraph-direction'.  */)
             bytepos--;
         }
       bidi_init_it (pos, bytepos, FRAME_WINDOW_P (SELECTED_FRAME ()), &itb);
+      itb.paragraph_dir = NEUTRAL_DIR;
       itb.string.s = NULL;
       itb.string.lstring = Qnil;
       itb.string.bufpos = 0;