[Emacs-diffs] trunk r114623: Fix bug #15575 with crashes in TTY menus.

[Eli Zaretskii]

------------------------------------------------------------
revno: 114623
revision-id: address@hidden
parent: address@hidden
fixes bug: http://debbugs.gnu.org/15575
committer: Eli Zaretskii <address@hidden>
branch nick: trunk
timestamp: Fri 2013-10-11 14:01:48 +0300
message:
  Fix bug #15575 with crashes in TTY menus.
  
   src/xdisp.c (display_tty_menu_item): Make sure we never write beyond
   the end of the frame's glyph matrix.
   src/term.c (tty_menu_display): Don't move cursor while overwriting
   frame's glyphs with menu items.  Limit the number of items
   displayed to what can be shown on the available screen lines,
   excluding the echo area.
   (tty_menu_activate): Limit the Y coordinate allowed by
   read_menu_input to the last screen line used for menu display.
modified:
  src/ChangeLog                  changelog-20091113204419-o5vbwnq5f7feedwu-1438
  src/term.c                     term.c-20091113204419-o5vbwnq5f7feedwu-220
  src/xdisp.c                    xdisp.c-20091113204419-o5vbwnq5f7feedwu-240

=== modified file 'src/ChangeLog'
--- a/src/ChangeLog     2013-10-11 06:32:29 +0000
+++ b/src/ChangeLog     2013-10-11 11:01:48 +0000
@@ -1,3 +1,15 @@
+2013-10-11  Eli Zaretskii  <address@hidden>
+
+       * xdisp.c (display_tty_menu_item): Make sure we never write beyond
+       the end of the frame's glyph matrix.  (Bug#15575)
+
+       * term.c (tty_menu_display): Don't move cursor while overwriting
+       frame's glyphs with menu items.  Limit the number of items
+       displayed to what can be shown on the available screen lines,
+       excluding the echo area.
+       (tty_menu_activate): Limit the Y coordinate allowed by
+       read_menu_input to the last screen line used for menu display.
+
 2013-10-11  Paul Eggert  <address@hidden>
 
        * lisp.h (eassume): New macro.

=== modified file 'src/term.c'
--- a/src/term.c        2013-10-10 19:26:13 +0000
+++ b/src/term.c        2013-10-11 11:01:48 +0000
@@ -2919,17 +2919,20 @@
   int i, face, width, enabled, mousehere, row, col;
   struct frame *sf = SELECTED_FRAME ();
   struct tty_display_info *tty = FRAME_TTY (sf);
+  /* Don't try to display more menu items than the console can display
+     using the available screen lines.  Exclude the echo area line, as
+     it will be overwritten by the help-echo anyway.  */
+  int max_items = min (menu->count, FRAME_LINES (sf) - 1);
 
   menu_help_message = NULL;
 
   width = menu->width;
   col = cursorX (tty);
   row = cursorY (tty);
-  for (i = 0; i < menu->count; i++)
+  for (i = 0; i < max_items; i++)
     {
       int max_width = width + 2; /* +2 for padding blanks on each side */
 
-      cursor_to (sf, y + i, x);
       if (menu->submenu[i])
        max_width += 2; /* for displaying " >" after the item */
       enabled
@@ -3285,7 +3288,8 @@
   while (!leave)
     {
       int input_status;
-      int min_y = state[0].y, max_y = min_y + state[0].menu->count - 1;
+      int min_y = state[0].y;
+      int max_y = min (min_y + state[0].menu->count, FRAME_LINES (sf)) - 1;
 
       input_status = read_menu_input (sf, &x, &y, min_y, max_y, &first_time);
       if (input_status)

=== modified file 'src/xdisp.c'
--- a/src/xdisp.c       2013-10-11 03:55:26 +0000
+++ b/src/xdisp.c       2013-10-11 11:01:48 +0000
@@ -20640,6 +20640,14 @@
 
   eassert (FRAME_TERMCAP_P (f));
 
+  /* Don't write beyond the matrix's last row.  This can happen for
+     TTY screens that are not high enough to show the entire menu.
+     (This is actually a bit of defensive programming, as
+     tty_menu_display already limits the number of menu items to one
+     less than the number of screen lines.)  */
+  if (y >= f->desired_matrix->nrows)
+    return;
+
   init_iterator (&it, w, -1, -1, f->desired_matrix->rows + y, MENU_FACE_ID);
   it.first_visible_x = 0;
   it.last_visible_x = FRAME_COLS (f) - 1;
@@ -20654,6 +20662,7 @@
 
   /* Arrange for the menu item glyphs to start at (X,Y) and have the
      desired face.  */
+  eassert (x < f->desired_matrix->matrix_w);
   it.current_x = it.hpos = x;
   it.current_y = it.vpos = y;
   saved_used = row->used[TEXT_AREA];