diff options
| author | Paul Eggert <eggert@cs.ucla.edu> | 2011-06-16 10:25:16 -0700 |
|---|---|---|
| committer | Paul Eggert <eggert@cs.ucla.edu> | 2011-06-16 10:25:16 -0700 |
| commit | 2e6813b0a503b14034783e12f704f7f70a47bae0 (patch) | |
| tree | b1b0cacb62d8c942352740dc36819060f5e5bc10 | |
| parent | 599a9e4f7cec752078570160fe5498fe5799863a (diff) | |
* editfns.c (Finsert_char): Don't dump core with very negative counts.
| -rw-r--r-- | src/ChangeLog | 2 | ||||
| -rw-r--r-- | src/editfns.c | 4 |
2 files changed, 4 insertions, 2 deletions
diff --git a/src/ChangeLog b/src/ChangeLog index e7ca102421..d53817369c 100644 --- a/src/ChangeLog +++ b/src/ChangeLog @@ -1,5 +1,7 @@ 2011-06-16 Paul Eggert <eggert@cs.ucla.edu> + * editfns.c (Finsert_char): Don't dump core with very negative counts. + * insdel.c (replace_range): Fix buf overflow when insbytes < outgoing. * insdel.c, lisp.h (buffer_overflow): New function. diff --git a/src/editfns.c b/src/editfns.c index dec0133951..ab17eda86a 100644 --- a/src/editfns.c +++ b/src/editfns.c @@ -2343,11 +2343,11 @@ from adjoining text, if those properties are sticky. */) len = CHAR_STRING (c, str); else str[0] = c, len = 1; + if (XINT (count) <= 0) + return Qnil; if (BUF_BYTES_MAX / len < XINT (count)) buffer_overflow (); n = XINT (count) * len; - if (n <= 0) - return Qnil; stringlen = min (n, 256 * len); string = (char *) alloca (stringlen); for (i = 0; i < stringlen; i++) |