[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
bug#35576: 27.0.50; Emacs crash when reads an integer with radix > 36
From: |
Tino Calancha |
Subject: |
bug#35576: 27.0.50; Emacs crash when reads an integer with radix > 36 |
Date: |
Sun, 05 May 2019 20:37:08 +0900 |
emacs -Q:
;; Emacs crash when you eval the following form
M-: #37r1
;; Expected: you get the error:
;; Invalid read syntax: "integer, radix 37"
In GNU Emacs 27.0.50 (build 1, x86_64-pc-linux-gnu, GTK+ Version 3.22.11)
of 2019-05-05
Windowing system distributor 'The X.Org Foundation', version 11.0.11902000
System Description: Debian GNU/Linux 9 (stretch)
--8<-----------------------------cut here---------------start------------->8---
commit c5ffba787a10f80d17a0ebc7fc7e1fb0f754843d
Author: Tino Calancha <tino.calancha@gmail.com>
Date: Sun May 5 20:24:03 2019 +0900
src/lread.c (read_integer): Prevent from accessing a null buffer
diff --git a/src/lread.c b/src/lread.c
index 1c97805ca7..810e24d614 100644
--- a/src/lread.c
+++ b/src/lread.c
@@ -2660,19 +2660,17 @@ read_integer (Lisp_Object readcharfun, EMACS_INT radix)
Also, room for invalid syntax diagnostic. */
size_t len = max (1 + 1 + UINTMAX_WIDTH + 1,
sizeof "integer, radix " + INT_STRLEN_BOUND (EMACS_INT));
- char *buf = NULL;
+ char *buf = xmalloc (len);
char *p = buf;
int valid = -1; /* 1 if valid, 0 if not, -1 if incomplete. */
ptrdiff_t count = SPECPDL_INDEX ();
-
if (radix < 2 || radix > 36)
valid = 0;
else
{
int c, digit;
- buf = xmalloc (len);
record_unwind_protect_ptr (free_contents, &buf);
p = buf;
@@ -2718,8 +2716,10 @@ read_integer (Lisp_Object readcharfun, EMACS_INT radix)
if (valid != 1)
{
- sprintf (buf, "integer, radix %"pI"d", radix);
- invalid_syntax (buf);
+ xfree (buf);
+ char str[len];
+ sprintf (str, "integer, radix %"pI"d", radix);
+ invalid_syntax (str);
}
*p = '\0';
--8<-----------------------------cut here---------------end--------------->8---
- bug#35576: 27.0.50; Emacs crash when reads an integer with radix > 36,
Tino Calancha <=