* xdisp.c: Integer overflow fix.

(try_window_id): Check Emacs fixnum range before converting to 'int'.

diff --git a/src/ChangeLog b/src/ChangeLog
index d2f956f..e7dac02 100644 (file)
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,5 +1,8 @@
 2011-09-04  Paul Eggert  <eggert@cs.ucla.edu>
 
+       * xdisp.c: Integer overflow fix.
+       (try_window_id): Check Emacs fixnum range before converting to 'int'.
+
        * window.c: Integer overflow fixes.
        (window_scroll_line_based, Frecenter):
        Check that an Emacs fixnum is in range before assigning it to 'int'.

diff --git a/src/xdisp.c b/src/xdisp.c
index 1716cc8..f11362c 100644 (file)
--- a/src/xdisp.c
+++ b/src/xdisp.c
@@ -16919,8 +16919,8 @@ try_window_id (struct window *w)
   {
     int this_scroll_margin, cursor_height;
 
-    this_scroll_margin = max (0, scroll_margin);
-    this_scroll_margin = min (this_scroll_margin, WINDOW_TOTAL_LINES (w) / 4);
+    this_scroll_margin =
+      max (0, min (scroll_margin, WINDOW_TOTAL_LINES (w) / 4));
     this_scroll_margin *= FRAME_LINE_HEIGHT (it.f);
     cursor_height = MATRIX_ROW (w->desired_matrix, w->cursor.vpos)->height;