Avoid crashes due to insanely large columns in tabulated-list-format

[gnu-emacs] / src / term.c

diff --git a/src/term.c b/src/term.c
index 8ebb620dd9b26ef04ecb4bfee779315f94cd72c9..43972109655ca360dfc3f8c32e95ee0b4ac680b2 100644 (file)
--- a/src/term.c
+++ b/src/term.c
@@ -1,13 +1,13 @@
 /* Terminal control module for terminals described by TERMCAP
-   Copyright (C) 1985-1987, 1993-1995, 1998, 2000-2015 Free Software
+   Copyright (C) 1985-1987, 1993-1995, 1998, 2000-2016 Free Software
    Foundation, Inc.
 
 This file is part of GNU Emacs.
 
 GNU Emacs is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
-the Free Software Foundation, either version 3 of the License, or
-(at your option) any later version.
+the Free Software Foundation, either version 3 of the License, or (at
+your option) any later version.
 
 GNU Emacs is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -44,8 +44,6 @@ along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
 #include "keymap.h"
 #include "blockinput.h"
 #include "syssignal.h"
-#include "systty.h"
-#include "intervals.h"
 #ifdef MSDOS
 #include "msdos.h"
 static int been_here = -1;
@@ -56,10 +54,6 @@ static int been_here = -1;
 #endif
 
 #include "cm.h"
-#ifdef HAVE_X_WINDOWS
-#include "xterm.h"
-#endif
-
 #include "menu.h"
 
 /* The name of the default console device.  */
@@ -538,15 +532,13 @@ encode_terminal_code (struct glyph *src, int src_len,
      multibyte-form.  But, it may be enlarged on demand if
      Vglyph_table contains a string or a composite glyph is
      encountered.  */
-  if (min (PTRDIFF_MAX, SIZE_MAX) / MAX_MULTIBYTE_LENGTH < src_len)
+  if (INT_MULTIPLY_WRAPV (src_len, MAX_MULTIBYTE_LENGTH, &required))
     memory_full (SIZE_MAX);
-  required = src_len;
-  required *= MAX_MULTIBYTE_LENGTH;
   if (encode_terminal_src_size < required)
-    {
-      encode_terminal_src = xrealloc (encode_terminal_src, required);
-      encode_terminal_src_size = required;
-    }
+    encode_terminal_src = xpalloc (encode_terminal_src,
+                                  &encode_terminal_src_size,
+                                  required - encode_terminal_src_size,
+                                  -1, sizeof *encode_terminal_src);
 
   charset_list = coding_charset_list (coding);
 
@@ -1684,6 +1676,7 @@ append_composite_glyph (struct it *it)
          glyph = it->glyph_row->glyphs[it->area];
        }
       glyph->type = COMPOSITE_GLYPH;
+      eassert (it->pixel_width <= SHRT_MAX);
       glyph->pixel_width = it->pixel_width;
       glyph->u.cmp.id = it->cmp_it.id;
       if (it->cmp_it.ch < 0)
@@ -3117,6 +3110,7 @@ tty_menu_activate (tty_menu *menu, int *pane, int *selidx,
   Lisp_Object selectface;
   int first_item = 0;
   int col, row;
+  Lisp_Object prev_inhibit_redisplay = Vinhibit_redisplay;
   USE_SAFE_ALLOCA;
 
   /* Don't allow non-positive x0 and y0, lest the menu will wrap
@@ -3159,6 +3153,11 @@ tty_menu_activate (tty_menu *menu, int *pane, int *selidx,
       buffers_num_deleted = 1;
     }
 
+  /* Inhibit redisplay for as long as the menu is active, to avoid
+     messing the screen if some timer calls sit-for or a similar
+     function.  */
+  Vinhibit_redisplay = Qt;
+
   /* Force update of the current frame, so that the desired and the
      current matrices are identical.  */
   update_frame_with_menu (sf, -1, -1);
@@ -3349,6 +3348,7 @@ tty_menu_activate (tty_menu *menu, int *pane, int *selidx,
   if (!kbd_buffer_events_waiting ())
     clear_input_pending ();
   SAFE_FREE ();
+  Vinhibit_redisplay = prev_inhibit_redisplay;
   return result;
 }
 
@@ -3403,9 +3403,11 @@ static void
 tty_pop_down_menu (Lisp_Object arg)
 {
   tty_menu *menu = XSAVE_POINTER (arg, 0);
+  struct buffer *orig_buffer = XSAVE_POINTER (arg, 1);
 
   block_input ();
   tty_menu_destroy (menu);
+  set_buffer_internal (orig_buffer);
   unblock_input ();
 }
 
@@ -3684,7 +3686,10 @@ tty_menu_show (struct frame *f, int x, int y, int menuflags,
 
   pane = selidx = 0;
 
-  record_unwind_protect (tty_pop_down_menu, make_save_ptr (menu));
+  /* We save and restore the current buffer because tty_menu_activate
+     triggers redisplay, which switches buffers at will.  */
+  record_unwind_protect (tty_pop_down_menu,
+                        make_save_ptr_ptr (menu, current_buffer));
 
   specbind (Qoverriding_terminal_local_map,
            Fsymbol_value (Qtty_menu_navigation_map));