diff options
| author | Paul Eggert <eggert@cs.ucla.edu> | 2013-10-09 15:39:57 -0700 |
|---|---|---|
| committer | Paul Eggert <eggert@cs.ucla.edu> | 2013-10-09 15:39:57 -0700 |
| commit | e20bb24948dd53afe77a5987c5408c715d1f388f (patch) | |
| tree | 97f95731023324d83dbf629120aa73d1cbf45849 | |
| parent | 9f6a18d27ebab2f41edb60cc5c45af0222f8210f (diff) | |
| download | emacs-e20bb24948dd53afe77a5987c5408c715d1f388f.tar.gz | |
* fns.c (sxhash_bool_vector): Fix buffer read overrun.
| -rw-r--r-- | src/ChangeLog | 4 | ||||
| -rw-r--r-- | src/fns.c | 4 |
2 files changed, 7 insertions, 1 deletions
diff --git a/src/ChangeLog b/src/ChangeLog index 0597c5d9f21..f46733d1ebe 100644 --- a/src/ChangeLog +++ b/src/ChangeLog @@ -1,3 +1,7 @@ +2013-10-09 Paul Eggert <eggert@cs.ucla.edu> + + * fns.c (sxhash_bool_vector): Fix buffer read overrun. + 2013-10-09 Eli Zaretskii <eliz@gnu.org> * term.c (tty_menu_activate): Flush the output stream after diff --git a/src/fns.c b/src/fns.c index e991711b871..1ee0a758fc2 100644 --- a/src/fns.c +++ b/src/fns.c @@ -4191,7 +4191,9 @@ sxhash_bool_vector (Lisp_Object vec) EMACS_UINT hash = XBOOL_VECTOR (vec)->size; int i, n; - n = min (SXHASH_MAX_LEN, XBOOL_VECTOR (vec)->header.size); + n = min (SXHASH_MAX_LEN, + ((XBOOL_VECTOR (vec)->size + BOOL_VECTOR_BITS_PER_CHAR - 1) + / BOOL_VECTOR_BITS_PER_CHAR)); for (i = 0; i < n; ++i) hash = sxhash_combine (hash, XBOOL_VECTOR (vec)->data[i]); |