* print.c (printchar, strout): Check for string overflow.

[bpt/emacs.git] / src / print.c

diff --git a/src/print.c b/src/print.c
index 803e3a1..009bea3 100644 (file)
--- a/src/print.c
+++ b/src/print.c
@@ -159,8 +159,9 @@ int print_output_debug_flag EXTERNALLY_VISIBLE = 1;
         }                                                              \
        else                                                            \
         {                                                              \
-           print_buffer_size = 1000;                                   \
-           print_buffer = (char *) xmalloc (print_buffer_size);                \
+          ptrdiff_t new_size = 1000;                                   \
+          print_buffer = (char *) xmalloc (new_size);                  \
+          print_buffer_size = new_size;                                \
           free_print_buffer = 1;                                       \
         }                                                              \
        print_buffer_pos = 0;                                           \
@@ -235,9 +236,15 @@ printchar (unsigned int ch, Lisp_Object fun)
 
       if (NILP (fun))
        {
-         if (print_buffer_pos_byte + len >= print_buffer_size)
-           print_buffer = (char *) xrealloc (print_buffer,
-                                             print_buffer_size *= 2);
+         if (print_buffer_size - len <= print_buffer_pos_byte)
+           {
+             ptrdiff_t new_size;
+             if (STRING_BYTES_BOUND / 2 < print_buffer_size)
+               string_overflow ();
+             new_size = print_buffer_size * 2;
+             print_buffer = (char *) xrealloc (print_buffer, new_size);
+             print_buffer_size = new_size;
+           }
          memcpy (print_buffer + print_buffer_pos_byte, str, len);
          print_buffer_pos += 1;
          print_buffer_pos_byte += len;
@@ -280,11 +287,14 @@ strout (const char *ptr, EMACS_INT size, EMACS_INT size_byte,
 
   if (NILP (printcharfun))
     {
-      if (print_buffer_pos_byte + size_byte > print_buffer_size)
+      if (print_buffer_size - size_byte < print_buffer_pos_byte)
        {
-         print_buffer_size = print_buffer_size * 2 + size_byte;
-         print_buffer = (char *) xrealloc (print_buffer,
-                                           print_buffer_size);
+         ptrdiff_t new_size;
+         if (STRING_BYTES_BOUND / 2 - size_byte < print_buffer_size)
+           string_overflow ();
+         new_size = print_buffer_size * 2 + size_byte;
+         print_buffer = (char *) xrealloc (print_buffer, new_size);
+         print_buffer_size = new_size;
        }
       memcpy (print_buffer + print_buffer_pos_byte, ptr, size_byte);
       print_buffer_pos += size;
@@ -2004,7 +2014,7 @@ print_object (Lisp_Object obj, register Lisp_Object printcharfun, int escapeflag
 
        case Lisp_Misc_Save_Value:
          strout ("#<save_value ", -1, -1, printcharfun);
-         sprintf(buf, "ptr=%p int=%d",
+         sprintf(buf, "ptr=%p int=%"pD"d",
                  XSAVE_VALUE (obj)->pointer,
                  XSAVE_VALUE (obj)->integer);
          strout (buf, -1, -1, printcharfun);