[Emacs-diffs] /srv/bzr/emacs/trunk r99286: Fix bounds checking for text properties in `format' (Bug#5306).

[Chong Yidong]

------------------------------------------------------------
revno: 99286
committer: Chong Yidong <address@hidden>
branch nick: trunk
timestamp: Sat 2010-01-09 17:32:47 -0500
message:
  Fix bounds checking for text properties in `format' (Bug#5306).
  
  * intervals.h, textprop.c (extend_property_ranges): Return value
  and args changed.  Discard properties that begin at or after the
  new end (Bug#5306).
  
  * editfns.c (Fformat): Caller changed.
modified:
  src/ChangeLog
  src/editfns.c
  src/intervals.h
  src/textprop.c

=== modified file 'src/ChangeLog'
--- a/src/ChangeLog     2010-01-09 20:31:26 +0000
+++ b/src/ChangeLog     2010-01-09 22:32:47 +0000
@@ -1,5 +1,11 @@
 2010-01-09  Chong Yidong  <address@hidden>
 
+       * intervals.h, textprop.c (extend_property_ranges): Return value
+       and args changed.  Discard properties that begin at or after the
+       new end (Bug#5306).
+
+       * editfns.c (Fformat): Caller changed.
+
        * nsterm.m (ns_set_default_prefs): Delete function.
        (syms_of_nsterm): Initialize ns_command_modifier,
        ns_control_modifier, ns_function_modifier, ns_antialias_text, and

=== modified file 'src/editfns.c'
--- a/src/editfns.c     2010-01-09 14:16:10 +0000
+++ b/src/editfns.c     2010-01-09 22:32:47 +0000
@@ -4177,8 +4177,8 @@
              len = make_number (SCHARS (args[n]));
              new_len = make_number (info[n].end - info[n].start);
              props = text_property_list (args[n], make_number (0), len, Qnil);
-             extend_property_ranges (props, len, new_len);
-             /* If successive arguments have properites, be sure that
+             props = extend_property_ranges (props, new_len);
+             /* If successive arguments have properties, be sure that
                 the value of `composition' property be the copy.  */
              if (n > 1 && info[n - 1].end)
                make_composition_value_copy (props);

=== modified file 'src/intervals.h'
--- a/src/intervals.h   2010-01-04 05:35:18 +0000
+++ b/src/intervals.h   2010-01-09 22:32:47 +0000
@@ -335,7 +335,7 @@
 Lisp_Object text_property_list P_ ((Lisp_Object, Lisp_Object, Lisp_Object,
                                    Lisp_Object));
 int add_text_properties_from_list P_ ((Lisp_Object, Lisp_Object, Lisp_Object));
-void extend_property_ranges P_ ((Lisp_Object, Lisp_Object, Lisp_Object));
+Lisp_Object extend_property_ranges P_ ((Lisp_Object, Lisp_Object));
 Lisp_Object get_char_property_and_overlay P_ ((Lisp_Object, Lisp_Object,
                                               Lisp_Object, Lisp_Object*));
 extern int text_property_stickiness P_ ((Lisp_Object prop, Lisp_Object pos,

=== modified file 'src/textprop.c'
--- a/src/textprop.c    2010-01-04 05:35:18 +0000
+++ b/src/textprop.c    2010-01-09 22:32:47 +0000
@@ -2028,24 +2028,41 @@
 
 
 
-/* Modify end-points of ranges in LIST destructively.  LIST is a list
-   as returned from text_property_list.  Change end-points equal to
-   OLD_END to NEW_END.  */
+/* Modify end-points of ranges in LIST destructively, and return the
+   new list.  LIST is a list as returned from text_property_list.
+   Discard properties that begin at or after NEW_END, and limit
+   end-points to NEW_END.  */
 
-void
-extend_property_ranges (list, old_end, new_end)
-     Lisp_Object list, old_end, new_end;
+Lisp_Object
+extend_property_ranges (list, new_end)
+     Lisp_Object list, new_end;
 {
-  for (; CONSP (list); list = XCDR (list))
+  Lisp_Object prev = Qnil, head = list;
+  int max = XINT (new_end);
+
+  for (; CONSP (list); prev = list, list = XCDR (list))
     {
-      Lisp_Object item, end;
+      Lisp_Object item, beg, end;
 
       item = XCAR (list);
+      beg = XCAR (item);
       end = XCAR (XCDR (item));
 
-      if (EQ (end, old_end))
+      if (XINT (beg) >= max)
+       {
+         /* The start-point is past the end of the new string.
+            Discard this property.  */
+         if (EQ (head, list))
+           head = XCDR (list);
+         else
+           XSETCDR (prev, XCDR (list));
+       }
+      else if (XINT (end) > max)
+       /* The end-point is past the end of the new string.  */
        XSETCAR (XCDR (item), new_end);
     }
+
+  return head;
 }