Adjust in response to jan.h.d's comments.

See, for example <http://debbugs.gnu.org/cgi/bugreport.cgi?bug=9196#26>.

1 files changed, 24 insertions, 45 deletions

diff --git a/src/search.c b/src/search.c
index 79ef8b046df..d892792cbaa 100644
--- a/src/search.c
+++ b/src/search.c
@@ -683,7 +683,7 @@ scan_buffer (register int target, EMACS_INT start, EMACS_INT end,
            to see where we can avoid some scanning.  */
         if (target == '\n' && newline_cache)
           {
-            EMACS_INT next_change;
+            ptrdiff_t next_change;
             immediate_quit = 0;
             while (region_cache_forward
                    (current_buffer, newline_cache, start_byte, &next_change))
@@ -755,7 +755,7 @@ scan_buffer (register int target, EMACS_INT start, EMACS_INT end,
         /* Consult the newline cache, if appropriate.  */
         if (target == '\n' && newline_cache)
           {
-            EMACS_INT next_change;
+            ptrdiff_t next_change;
             immediate_quit = 0;
             while (region_cache_backward
                    (current_buffer, newline_cache, start_byte, &next_change))
@@ -2640,17 +2640,17 @@ since only regular expressions have distinguished subexpressions.  */)
      perform substitution on the replacement string.  */
   if (NILP (literal))
     {
-      EMACS_INT length = SBYTES (newtext);
+      ptrdiff_t length = SBYTES (newtext);
       unsigned char *substed;
-      EMACS_INT substed_alloc_size, substed_len;
+      ptrdiff_t substed_alloc_size, substed_len;
       int buf_multibyte = !NILP (BVAR (current_buffer, enable_multibyte_characters));
       int str_multibyte = STRING_MULTIBYTE (newtext);
       int really_changed = 0;
 
-      substed_alloc_size = length * 2 + 100;
-      if (min (PTRDIFF_MAX, SIZE_MAX) - 1 < substed_alloc_size)
-	memory_full (SIZE_MAX);
-      substed = (unsigned char *) xmalloc (substed_alloc_size + 1);
+      substed_alloc_size = ((STRING_BYTES_BOUND - 100) / 2 < length
+			    ? STRING_BYTES_BOUND
+			    : length * 2 + 100);
+      substed = (unsigned char *) xmalloc (substed_alloc_size);
       substed_len = 0;
 
       /* Go thru NEWTEXT, producing the actual text to insert in
@@ -2661,7 +2661,7 @@ since only regular expressions have distinguished subexpressions.  */)
 	{
 	  unsigned char str[MAX_MULTIBYTE_LENGTH];
 	  const unsigned char *add_stuff = NULL;
-	  EMACS_INT add_len = 0;
+	  ptrdiff_t add_len = 0;
 	  int idx = -1;
 
 	  if (str_multibyte)
@@ -2725,7 +2725,7 @@ since only regular expressions have distinguished subexpressions.  */)
 	     set up ADD_STUFF and ADD_LEN to point to it.  */
 	  if (idx >= 0)
 	    {
-	      EMACS_INT begbyte = CHAR_TO_BYTE (search_regs.start[idx]);
+	      ptrdiff_t begbyte = CHAR_TO_BYTE (search_regs.start[idx]);
 	      add_len = CHAR_TO_BYTE (search_regs.end[idx]) - begbyte;
 	      if (search_regs.start[idx] < GPT && GPT < search_regs.end[idx])
 		move_gap (search_regs.start[idx]);
@@ -2736,19 +2736,11 @@ since only regular expressions have distinguished subexpressions.  */)
 	     is invariably ADD_LEN bytes starting at ADD_STUFF.  */
 
 	  /* Make sure SUBSTED is big enough.  */
-	  if (substed_len + add_len >= substed_alloc_size)
-	    {
-	      ptrdiff_t add_len_max =
-		min (PTRDIFF_MAX, SIZE_MAX) - 1 - 500 - substed_len;
-	      if (add_len_max < add_len)
-		{
-		  xfree (substed);
-		  memory_full (SIZE_MAX);
-		}
-	      substed_alloc_size = substed_len + add_len + 500;
-	      substed = (unsigned char *) xrealloc (substed,
-						    substed_alloc_size + 1);
-	    }
+	  if (substed_alloc_size - substed_len < add_len)
+	    substed =
+	      xpalloc (substed, &substed_alloc_size,
+		       add_len - (substed_alloc_size - substed_len),
+		       STRING_BYTES_BOUND, 1);
 
 	  /* Now add to the end of SUBSTED.  */
 	  if (add_stuff)
@@ -3000,30 +2992,17 @@ If optional arg RESEAT is non-nil, make markers on LIST point nowhere.  */)
 
     if (length > search_regs.num_regs)
       {
-	if (min (PTRDIFF_MAX, SIZE_MAX) / sizeof (regoff_t) < length)
-	  memory_full (SIZE_MAX);
-
-	if (search_regs.num_regs == 0)
-	  {
-	    search_regs.start
-	      = (regoff_t *) xmalloc (length * sizeof (regoff_t));
-	    search_regs.end
-	      = (regoff_t *) xmalloc (length * sizeof (regoff_t));
-	  }
-	else
-	  {
-	    search_regs.start
-	      = (regoff_t *) xrealloc (search_regs.start,
-				       length * sizeof (regoff_t));
-	    search_regs.end
-	      = (regoff_t *) xrealloc (search_regs.end,
-				       length * sizeof (regoff_t));
-	  }
-
-	for (i = search_regs.num_regs; i < length; i++)
+	ptrdiff_t num_regs = search_regs.num_regs;
+	search_regs.start =
+	  xpalloc (search_regs.start, &num_regs, length - num_regs,
+		   min (PTRDIFF_MAX, UINT_MAX), sizeof (regoff_t));
+	search_regs.end =
+	  xrealloc (search_regs.end, num_regs * sizeof (regoff_t));
+
+	for (i = search_regs.num_regs; i < num_regs; i++)
 	  search_regs.start[i] = -1;
 
-	search_regs.num_regs = length;
+	search_regs.num_regs = num_regs;
       }
 
     for (i = 0; CONSP (list); i++)