# HG changeset patch
# User Chong Yidong <cyd@stupidchicken.com>
# Date 1263076367 18000
# Node ID 85fd976607be117f44263811145085d65d4870de
# Parent  57e095b90f5be1364c1664ee7ac4f24f4a759004
Fix bounds checking for text properties in `format' (Bug#5306).

* intervals.h, textprop.c (extend_property_ranges): Return value
and args changed.  Discard properties that begin at or after the
new end (Bug#5306).

* editfns.c (Fformat): Caller changed.

diff -r 57e095b90f5b -r 85fd976607be src/ChangeLog
--- a/src/ChangeLog	Sat Jan 09 16:14:50 2010 -0500
+++ b/src/ChangeLog	Sat Jan 09 17:32:47 2010 -0500
@@ -1,5 +1,11 @@
 2010-01-09  Chong Yidong  <cyd@stupidchicken.com>
 
+	* intervals.h, textprop.c (extend_property_ranges): Return value
+	and args changed.  Discard properties that begin at or after the
+	new end (Bug#5306).
+
+	* editfns.c (Fformat): Caller changed.
+
 	* nsterm.m (ns_set_default_prefs): Delete function.
 	(syms_of_nsterm): Initialize ns_command_modifier,
 	ns_control_modifier, ns_function_modifier, ns_antialias_text, and
diff -r 57e095b90f5b -r 85fd976607be src/editfns.c
--- a/src/editfns.c	Sat Jan 09 16:14:50 2010 -0500
+++ b/src/editfns.c	Sat Jan 09 17:32:47 2010 -0500
@@ -4177,8 +4177,8 @@
 	      len = make_number (SCHARS (args[n]));
 	      new_len = make_number (info[n].end - info[n].start);
 	      props = text_property_list (args[n], make_number (0), len, Qnil);
-	      extend_property_ranges (props, len, new_len);
-	      /* If successive arguments have properites, be sure that
+	      props = extend_property_ranges (props, new_len);
+	      /* If successive arguments have properties, be sure that
 		 the value of `composition' property be the copy.  */
 	      if (n > 1 && info[n - 1].end)
 		make_composition_value_copy (props);
diff -r 57e095b90f5b -r 85fd976607be src/intervals.h
--- a/src/intervals.h	Sat Jan 09 16:14:50 2010 -0500
+++ b/src/intervals.h	Sat Jan 09 17:32:47 2010 -0500
@@ -335,7 +335,7 @@
 Lisp_Object text_property_list P_ ((Lisp_Object, Lisp_Object, Lisp_Object,
 				    Lisp_Object));
 int add_text_properties_from_list P_ ((Lisp_Object, Lisp_Object, Lisp_Object));
-void extend_property_ranges P_ ((Lisp_Object, Lisp_Object, Lisp_Object));
+Lisp_Object extend_property_ranges P_ ((Lisp_Object, Lisp_Object));
 Lisp_Object get_char_property_and_overlay P_ ((Lisp_Object, Lisp_Object,
 					       Lisp_Object, Lisp_Object*));
 extern int text_property_stickiness P_ ((Lisp_Object prop, Lisp_Object pos,
diff -r 57e095b90f5b -r 85fd976607be src/textprop.c
--- a/src/textprop.c	Sat Jan 09 16:14:50 2010 -0500
+++ b/src/textprop.c	Sat Jan 09 17:32:47 2010 -0500
@@ -2028,24 +2028,41 @@
 
 
 
-/* Modify end-points of ranges in LIST destructively.  LIST is a list
-   as returned from text_property_list.  Change end-points equal to
-   OLD_END to NEW_END.  */
+/* Modify end-points of ranges in LIST destructively, and return the
+   new list.  LIST is a list as returned from text_property_list.
+   Discard properties that begin at or after NEW_END, and limit
+   end-points to NEW_END.  */
 
-void
-extend_property_ranges (list, old_end, new_end)
-     Lisp_Object list, old_end, new_end;
+Lisp_Object
+extend_property_ranges (list, new_end)
+     Lisp_Object list, new_end;
 {
-  for (; CONSP (list); list = XCDR (list))
+  Lisp_Object prev = Qnil, head = list;
+  int max = XINT (new_end);
+
+  for (; CONSP (list); prev = list, list = XCDR (list))
     {
-      Lisp_Object item, end;
+      Lisp_Object item, beg, end;
 
       item = XCAR (list);
+      beg = XCAR (item);
       end = XCAR (XCDR (item));
 
-      if (EQ (end, old_end))
+      if (XINT (beg) >= max)
+	{
+	  /* The start-point is past the end of the new string.
+	     Discard this property.  */
+	  if (EQ (head, list))
+	    head = XCDR (list);
+	  else
+	    XSETCDR (prev, XCDR (list));
+	}
+      else if (XINT (end) > max)
+	/* The end-point is past the end of the new string.  */
 	XSETCAR (XCDR (item), new_end);
     }
+
+  return head;
 }