* font.c (font_unparse_xlfd): Don't blindly alloca long strings.

[bpt/emacs.git] / src / ChangeLog

diff --git a/src/ChangeLog b/src/ChangeLog
index b5ba1d7..f94f9c4 100644 (file)
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,4 +1,55 @@
-2011-08-25  Paul Eggert  <eggert@cs.ucla.edu>
+2011-08-29  Paul Eggert  <eggert@cs.ucla.edu>
+
+       sprintf-related integer and memory overflow issues.
+
+       * doprnt.c (doprnt): Support printing ptrdiff_t and intmax_t values.
+       (esprintf, esnprintf, exprintf, evxprintf): New functions.
+       * keyboard.c (command_loop_level): Now EMACS_INT, not int.
+       (cmd_error): kbd macro iterations count is now EMACS_INT, not int.
+       (modify_event_symbol): Do not assume that the length of
+       name_alist_or_stem is safe to alloca and fits in int.
+       (Fexecute_extended_command): Likewise for function name and binding.
+       (Frecursion_depth): Wrap around reliably on integer overflow.
+       * keymap.c (push_key_description): First arg is now EMACS_INT, not int,
+       since some callers pass EMACS_INT values.
+       (Fsingle_key_description): Don't crash if symbol name contains more
+       than MAX_ALLOCA bytes.
+       * minibuf.c (minibuf_level): Now EMACS_INT, not int.
+       (get_minibuffer): Arg is now EMACS_INT, not int.
+       * lisp.h (get_minibuffer, push_key_description): Reflect API changes.
+       (esprintf, esnprintf, exprintf, evxprintf): New decls.
+       * window.h (command_loop_level, minibuf_level): Reflect API changes.
+
+       * dbusbind.c (xd_signature, Fdbus_register_signal):
+       Do not overrun buffer; instead, report string overflow.
+
+       * dispnew.c (add_window_display_history): Don't overrun buffer.
+       Truncate instead; this is OK since it's just a log.
+
+       * editfns.c (Fcurrent_time_zone): Don't overrun buffer
+       even if the time zone offset is outlandishly large.
+       Don't mishandle offset == INT_MIN.
+
+       * emacs.c (main) [NS_IMPL_COCOA]: Don't overrun buffer
+       when creating daemon; the previous buffer-overflow check was incorrect.
+
+       * eval.c (verror): Simplify by rewriting in terms of evxprintf,
+       which has the guts of the old verror function.
+
+       * filelock.c (lock_file_1, lock_file): Don't blindly alloca long name;
+       use SAFE_ALLOCA instead.  Use esprintf to avoid int-overflow issues.
+
+       * font.c (font_unparse_xlfd): Don't blindly alloca long strings.
+       Don't assume XINT result fits in int, or that XFLOAT_DATA * 10
+       fits in int, when using sprintf.  Use single snprintf to count
+       length of string rather than counting it via multiple sprintfs;
+       that's simpler and more reliable.
+       (APPEND_SPRINTF): New macro.
+       (font_unparse_fcname): Use it to avoid sprintf buffer overrun.
+       (generate_otf_features) [0 && HAVE_LIBOTF]: Use esprintf, not
+       sprintf, in case result does not fit in int.
+
+2011-08-26  Paul Eggert  <eggert@cs.ucla.edu>
 
        Integer and memory overflow issues (Bug#9196).
 
@@ -422,6 +473,11 @@
        (gs_load): Use printmax_t to print the widest integers possible.
        Check for integer overflow when computing image height and width.
 
+2011-08-26  Eli Zaretskii  <eliz@gnu.org>
+
+       * xdisp.c (redisplay_window): Don't force window start if point
+       will be invisible in the resulting window.  (Bug#9324)
+
 2011-08-25  Eli Zaretskii  <eliz@gnu.org>
 
        * xdisp.c (compute_display_string_pos): Return 2 in DISP_PROP when