[Emacs-diffs] /srv/bzr/emacs/trunk r111560: Fix crashes with lots of overlays.

[Eli Zaretskii]

------------------------------------------------------------
revno: 111560
committer: Eli Zaretskii <address@hidden>
branch nick: trunk
timestamp: Sat 2013-01-19 22:04:33 +0200
message:
  Fix crashes with lots of overlays.
  
   src/editfns.c (get_pos_property): Use SAFE_ALLOCA_LISP, to avoid
   segfault when there are lots of overlays.
   src/buffer.c (sort_overlays): Use SAFE_NALLOCA, to avoid segfault
   when there are lots of overlays.  See
   http://lists.gnu.org/archive/html/emacs-devel/2013-01/msg00421.html
   for the details and a way to reproduce.
modified:
  src/ChangeLog
  src/buffer.c
  src/editfns.c

=== modified file 'src/ChangeLog'
--- a/src/ChangeLog     2013-01-19 18:58:40 +0000
+++ b/src/ChangeLog     2013-01-19 20:04:33 +0000
@@ -1,3 +1,13 @@
+2013-01-19  Eli Zaretskii  <address@hidden>
+
+       * editfns.c (get_pos_property): Use SAFE_ALLOCA_LISP, to avoid
+       segfault when there are lots of overlays.
+
+       * buffer.c (sort_overlays): Use SAFE_NALLOCA, to avoid segfault
+       when there are lots of overlays.  See
+       http://lists.gnu.org/archive/html/emacs-devel/2013-01/msg00421.html
+       for the details and a way to reproduce.
+
 2013-01-19  Paul Eggert  <address@hidden>
 
        * fileio.c: Use O_APPEND to append.

=== modified file 'src/buffer.c'
--- a/src/buffer.c      2013-01-17 05:52:13 +0000
+++ b/src/buffer.c      2013-01-19 20:04:33 +0000
@@ -3151,7 +3151,10 @@
 sort_overlays (Lisp_Object *overlay_vec, ptrdiff_t noverlays, struct window *w)
 {
   ptrdiff_t i, j;
-  struct sortvec *sortvec = alloca (noverlays * sizeof *sortvec);
+  USE_SAFE_ALLOCA;
+  struct sortvec *sortvec;
+
+  SAFE_NALLOCA (sortvec, 1, noverlays);
 
   /* Put the valid and relevant overlays into sortvec.  */
 
@@ -3197,6 +3200,8 @@
 
   for (i = 0; i < noverlays; i++)
     overlay_vec[i] = sortvec[i].overlay;
+
+  SAFE_FREE ();
   return (noverlays);
 }
 

=== modified file 'src/editfns.c'
--- a/src/editfns.c     2013-01-17 06:29:40 +0000
+++ b/src/editfns.c     2013-01-19 20:04:33 +0000
@@ -386,6 +386,7 @@
       ptrdiff_t noverlays;
       Lisp_Object *overlay_vec, tem;
       struct buffer *obuf = current_buffer;
+      USE_SAFE_ALLOCA;
 
       set_buffer_temp (XBUFFER (object));
 
@@ -398,7 +399,7 @@
         make enough space for all, and try again.  */
       if (noverlays > 40)
        {
-         overlay_vec = alloca (noverlays * sizeof *overlay_vec);
+         SAFE_ALLOCA_LISP (overlay_vec, noverlays);
          noverlays = overlays_around (posn, overlay_vec, noverlays);
        }
       noverlays = sort_overlays (overlay_vec, noverlays, NULL);
@@ -421,10 +422,12 @@
                ; /* The overlay will not cover a char inserted at point.  */
              else
                {
+                 SAFE_FREE ();
                  return tem;
                }
            }
        }
+      SAFE_FREE ();
 
       { /* Now check the text properties.  */
        int stickiness = text_property_stickiness (prop, position, object);