Avoid crashes due to insanely large columns in tabulated-list-format

[gnu-emacs] / src / term.c

diff --git a/src/term.c b/src/term.c
index 6ab611d51e20e6fc326180e1b8572259be07bf4d..43972109655ca360dfc3f8c32e95ee0b4ac680b2 100644 (file)
--- a/src/term.c
+++ b/src/term.c
@@ -1,13 +1,13 @@
 /* Terminal control module for terminals described by TERMCAP
-   Copyright (C) 1985-1987, 1993-1995, 1998, 2000-2015 Free Software
+   Copyright (C) 1985-1987, 1993-1995, 1998, 2000-2016 Free Software
    Foundation, Inc.
 
 This file is part of GNU Emacs.
 
 GNU Emacs is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
-the Free Software Foundation, either version 3 of the License, or
-(at your option) any later version.
+the Free Software Foundation, either version 3 of the License, or (at
+your option) any later version.
 
 GNU Emacs is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -1676,6 +1676,7 @@ append_composite_glyph (struct it *it)
          glyph = it->glyph_row->glyphs[it->area];
        }
       glyph->type = COMPOSITE_GLYPH;
+      eassert (it->pixel_width <= SHRT_MAX);
       glyph->pixel_width = it->pixel_width;
       glyph->u.cmp.id = it->cmp_it.id;
       if (it->cmp_it.ch < 0)
@@ -3402,9 +3403,11 @@ static void
 tty_pop_down_menu (Lisp_Object arg)
 {
   tty_menu *menu = XSAVE_POINTER (arg, 0);
+  struct buffer *orig_buffer = XSAVE_POINTER (arg, 1);
 
   block_input ();
   tty_menu_destroy (menu);
+  set_buffer_internal (orig_buffer);
   unblock_input ();
 }
 
@@ -3683,7 +3686,10 @@ tty_menu_show (struct frame *f, int x, int y, int menuflags,
 
   pane = selidx = 0;
 
-  record_unwind_protect (tty_pop_down_menu, make_save_ptr (menu));
+  /* We save and restore the current buffer because tty_menu_activate
+     triggers redisplay, which switches buffers at will.  */
+  record_unwind_protect (tty_pop_down_menu,
+                        make_save_ptr_ptr (menu, current_buffer));
 
   specbind (Qoverriding_terminal_local_map,
            Fsymbol_value (Qtty_menu_navigation_map));