comparison src/textprop.c @ 106780:85fd976607be

Fix bounds checking for text properties in `format' (Bug#5306). * intervals.h, textprop.c (extend_property_ranges): Return value and args changed. Discard properties that begin at or after the new end (Bug#5306). * editfns.c (Fformat): Caller changed.
author Chong Yidong <cyd@stupidchicken.com>
date Sat, 09 Jan 2010 17:32:47 -0500
parents 21bdda3ded62
children 1d1d5d9bd884
comparison
equal deleted inserted replaced
106779:57e095b90f5b 106780:85fd976607be
2026 return modified_p; 2026 return modified_p;
2027 } 2027 }
2028 2028
2029 2029
2030 2030
2031 /* Modify end-points of ranges in LIST destructively. LIST is a list 2031 /* Modify end-points of ranges in LIST destructively, and return the
2032 as returned from text_property_list. Change end-points equal to 2032 new list. LIST is a list as returned from text_property_list.
2033 OLD_END to NEW_END. */ 2033 Discard properties that begin at or after NEW_END, and limit
2034 2034 end-points to NEW_END. */
2035 void 2035
2036 extend_property_ranges (list, old_end, new_end) 2036 Lisp_Object
2037 Lisp_Object list, old_end, new_end; 2037 extend_property_ranges (list, new_end)
2038 { 2038 Lisp_Object list, new_end;
2039 for (; CONSP (list); list = XCDR (list)) 2039 {
2040 { 2040 Lisp_Object prev = Qnil, head = list;
2041 Lisp_Object item, end; 2041 int max = XINT (new_end);
2042
2043 for (; CONSP (list); prev = list, list = XCDR (list))
2044 {
2045 Lisp_Object item, beg, end;
2042 2046
2043 item = XCAR (list); 2047 item = XCAR (list);
2048 beg = XCAR (item);
2044 end = XCAR (XCDR (item)); 2049 end = XCAR (XCDR (item));
2045 2050
2046 if (EQ (end, old_end)) 2051 if (XINT (beg) >= max)
2052 {
2053 /* The start-point is past the end of the new string.
2054 Discard this property. */
2055 if (EQ (head, list))
2056 head = XCDR (list);
2057 else
2058 XSETCDR (prev, XCDR (list));
2059 }
2060 else if (XINT (end) > max)
2061 /* The end-point is past the end of the new string. */
2047 XSETCAR (XCDR (item), new_end); 2062 XSETCAR (XCDR (item), new_end);
2048 } 2063 }
2064
2065 return head;
2049 } 2066 }
2050 2067
2051 2068
2052 2069
2053 /* Call the modification hook functions in LIST, each with START and END. */ 2070 /* Call the modification hook functions in LIST, each with START and END. */