From d3411f89d34bd1009cae738f917abf477be09882 Mon Sep 17 00:00:00 2001
From: Paul Eggert
Date: Mon, 18 Jul 2011 23:07:07 -0700
Subject: Use ptrdiff_t for hash table indexes.

* category.c (hash_get_category_set):
* ccl.c (ccl_driver):
* charset.h (struct charset.hash_index, CHECK_CHARSET_GET_ID):
* coding.c (coding_system_charset_list, detect_coding_system):
* coding.h (struct coding_system.id):
* composite.c (get_composition_id, gstring_lookup_cache):
* fns.c (hash_lookup, hash_put, Fgethash, Fputhash):
* image.c (xpm_get_color_table_h):
* lisp.h (hash_lookup, hash_put):
* minibuf.c (Ftest_completion):
Use ptrdiff_t for hash table indexes, not int (which is too
narrow, on 64-bit hosts) or EMACS_INT (which is too wide, on
32-bit --with-wide-int hosts).
---
 src/coding.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'src/coding.c')

diff --git a/src/coding.c b/src/coding.c
index 65c8a767c2b..73a4bbc5e25 100644
--- a/src/coding.c
+++ b/src/coding.c
@@ -5838,7 +5838,7 @@ coding_charset_list (struct coding_system *coding)
 Lisp_Object
 coding_system_charset_list (Lisp_Object coding_system)
 {
-  int id;
+  ptrdiff_t id;
   Lisp_Object attrs, charset_list;
 
   CHECK_CODING_SYSTEM_GET_ID (coding_system, id);
@@ -8076,7 +8076,7 @@ detect_coding_system (const unsigned char *src,
   Lisp_Object attrs, eol_type;
   Lisp_Object val = Qnil;
   struct coding_system coding;
-  int id;
+  ptrdiff_t id;
   struct coding_detection_info detect_info;
   enum coding_category base_category;
   int null_byte_found = 0, eight_bit_found = 0;
-- 
cgit v1.2.1


From 5d009b3a6a39627db04094e8164df6bb6231b991 Mon Sep 17 00:00:00 2001
From: Paul Eggert
Date: Thu, 28 Jul 2011 13:31:29 -0700
Subject: * coding.c: Integer and memory overflow fixes.

(produce_chars): Redo buffer-overflow calculations to avoid
unnecessary integer overflow.  Check for size overflow.
(encode_coding_object): Don't update size until xmalloc succeeds.
---
 src/coding.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

(limited to 'src/coding.c')

diff --git a/src/coding.c b/src/coding.c
index 73a4bbc5e25..5fd59d394d9 100644
--- a/src/coding.c
+++ b/src/coding.c
@@ -6683,8 +6683,12 @@ produce_chars (struct coding_system *coding, Lisp_Object translation_table,
 		    break;
 		}
 
-	      if (dst + MAX_MULTIBYTE_LENGTH * to_nchars > dst_end)
+	      if ((dst_end - dst) / MAX_MULTIBYTE_LENGTH < to_nchars)
 		{
+		  if (((min (PTRDIFF_MAX, SIZE_MAX) - (buf_end - buf))
+		       / MAX_MULTIBYTE_LENGTH)
+		      < to_nchars)
+		    memory_full (SIZE_MAX);
 		  dst = alloc_destination (coding,
 					   buf_end - buf
 					   + MAX_MULTIBYTE_LENGTH * to_nchars,
@@ -7888,11 +7892,10 @@ encode_coding_object (struct coding_system *coding,
     }
   else if (EQ (dst_object, Qt))
     {
+      ptrdiff_t dst_bytes = max (1, coding->src_chars);
       coding->dst_object = Qnil;
-      coding->dst_bytes = coding->src_chars;
-      if (coding->dst_bytes == 0)
-	coding->dst_bytes = 1;
-      coding->destination = (unsigned char *) xmalloc (coding->dst_bytes);
+      coding->destination = (unsigned char *) xmalloc (dst_bytes);
+      coding->dst_bytes = dst_bytes;
       coding->dst_multibyte = 0;
     }
   else
-- 
cgit v1.2.1