diff options
| author | Eli Zaretskii <eliz@gnu.org> | 2019-05-05 17:06:01 +0300 |
|---|---|---|
| committer | Eli Zaretskii <eliz@gnu.org> | 2019-05-05 17:06:01 +0300 |
| commit | 708d117a85107331c8a06a9a4887abffcc18ec24 (patch) | |
| tree | 0127bf17b68c25150421835112e097868c9ad11b /src | |
| parent | 64f95e4011242110fb51ae52d3c19a70000de1e6 (diff) | |
| download | emacs-708d117a85107331c8a06a9a4887abffcc18ec24.tar.gz | |
Avoid crashes in read_integer
* src/lread.c (read_integer): Always allocate a buffer, since
we need to use it even when the radix is invalid. (Bug#35576)
Diffstat (limited to 'src')
| -rw-r--r-- | src/lread.c | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/src/lread.c b/src/lread.c index 1c97805ca7a..c37719e0d24 100644 --- a/src/lread.c +++ b/src/lread.c @@ -2660,11 +2660,12 @@ read_integer (Lisp_Object readcharfun, EMACS_INT radix) Also, room for invalid syntax diagnostic. */ size_t len = max (1 + 1 + UINTMAX_WIDTH + 1, sizeof "integer, radix " + INT_STRLEN_BOUND (EMACS_INT)); - char *buf = NULL; + char *buf = xmalloc (len); char *p = buf; int valid = -1; /* 1 if valid, 0 if not, -1 if incomplete. */ ptrdiff_t count = SPECPDL_INDEX (); + record_unwind_protect_ptr (free_contents, &buf); if (radix < 2 || radix > 36) valid = 0; @@ -2672,8 +2673,6 @@ read_integer (Lisp_Object readcharfun, EMACS_INT radix) { int c, digit; - buf = xmalloc (len); - record_unwind_protect_ptr (free_contents, &buf); p = buf; c = READCHAR; |