[Emacs-diffs] /srv/bzr/emacs/trunk r104050: Fix doprnt when buffer is too small for multibyte sequences.

[Eli Zaretskii]

------------------------------------------------------------
revno: 104050
fixes bug(s): http://debbugs.gnu.org/8545
committer: Eli Zaretskii <address@hidden>
branch nick: trunk
timestamp: Fri 2011-04-29 14:01:11 +0300
message:
  Fix doprnt when buffer is too small for multibyte sequences.
  
   src/doprnt.c (doprnt): Fix the case where a multibyte sequence
   produced by %s or %c overflows available buffer space.  (Bug#8545)
modified:
  src/ChangeLog
  src/doprnt.c
  src/eval.c

=== modified file 'src/ChangeLog'
--- a/src/ChangeLog     2011-04-28 20:11:17 +0000
+++ b/src/ChangeLog     2011-04-29 11:01:11 +0000
@@ -1,3 +1,8 @@
+2011-04-29  Eli Zaretskii  <address@hidden>
+
+       * doprnt.c (doprnt): Fix the case where a multibyte sequence
+       produced by %s or %c overflows available buffer space.  (Bug#8545)
+
 2011-04-28  Paul Eggert  <address@hidden>
 
        * doprnt.c (doprnt): Omit useless test; int overflow check (Bug#8545).

=== modified file 'src/doprnt.c'
--- a/src/doprnt.c      2011-04-28 22:02:15 +0000
+++ b/src/doprnt.c      2011-04-29 11:01:11 +0000
@@ -367,9 +367,21 @@
                  /* Truncate the string at character boundary.  */
                  tem = bufsize;
                  while (!CHAR_HEAD_P (string[tem - 1])) tem--;
-                 memcpy (bufptr, string, tem);
-                 /* We must calculate WIDTH again.  */
-                 width = strwidth (bufptr, tem);
+                 /* If the multibyte sequence of this character is
+                    too long for the space we have left in the
+                    buffer, truncate before it.  */
+                 if (tem > 0
+                     && BYTES_BY_CHAR_HEAD (string[tem - 1]) > bufsize)
+                   tem--;
+                 if (tem > 0)
+                   memcpy (bufptr, string, tem);
+                 bufptr[tem] = 0;
+                 /* Trigger exit from the loop, but make sure we
+                    return to the caller a value which will indicate
+                    that the buffer was too small.  */
+                 bufptr += bufsize;
+                 bufsize = 0;
+                 continue;
                }
              else
                memcpy (bufptr, string, tem);

=== modified file 'src/eval.c'
--- a/src/eval.c        2011-04-27 18:15:29 +0000
+++ b/src/eval.c        2011-04-29 11:01:11 +0000
@@ -1994,7 +1994,7 @@
 {
   char buf[4000];
   size_t size = sizeof buf;
-  size_t size_max =    min (MOST_POSITIVE_FIXNUM, SIZE_MAX);
+  size_t size_max = min (MOST_POSITIVE_FIXNUM, SIZE_MAX);
   size_t mlen = strlen (m);
   char *buffer = buf;
   size_t used;