* termcap.c: Integer and memory overflow issues.

[gnu-emacs] / src / termcap.c

diff --git a/src/termcap.c b/src/termcap.c
index 9e64d027640e3f7e0fa1e82219bd0c8fa3fae867..791c593c06faa265ded8302c4c01646911bbeb49 100644 (file)
--- a/src/termcap.c
+++ b/src/termcap.c
@@ -1,6 +1,6 @@
 /* Work-alike for termcap, plus extra features.
    Copyright (C) 1985, 1986, 1993, 1994, 1995, 2000, 2001, 2002, 2003,
-                 2004, 2005, 2006, 2007, 2008 Free Software Foundation, Inc.
+                 2004, 2005, 2006, 2007, 2008, 2011 Free Software Foundation, Inc.
 
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
@@ -25,6 +25,10 @@ Boston, MA 02110-1301, USA.  */
 #include <unistd.h>
 
 #include "lisp.h"
+#include "tparam.h"
+#ifdef MSDOS
+#include "msdos.h"
+#endif
 
 #ifndef NULL
 #define NULL (char *) 0
@@ -65,7 +69,7 @@ static char *tgetst1 (char *ptr, char **area);
    0 if not found.  */
 
 static char *
-find_capability (register char *bp, register char *cap)
+find_capability (register char *bp, register const char *cap)
 {
   for (; *bp; bp++)
     if (bp[0] == ':'
@@ -76,7 +80,7 @@ find_capability (register char *bp, register char *cap)
 }
 
 int
-tgetnum (char *cap)
+tgetnum (const char *cap)
 {
   register char *ptr = find_capability (term_entry, cap);
   if (!ptr || ptr[-1] != '#')
@@ -85,7 +89,7 @@ tgetnum (char *cap)
 }
 
 int
-tgetflag (char *cap)
+tgetflag (const char *cap)
 {
   register char *ptr = find_capability (term_entry, cap);
   return ptr && ptr[-1] == ':';
@@ -97,7 +101,7 @@ tgetflag (char *cap)
    If AREA is null, space is allocated with `malloc'.  */
 
 char *
-tgetstr (char *cap, char **area)
+tgetstr (const char *cap, char **area)
 {
   register char *ptr = find_capability (term_entry, cap);
   if (!ptr || (ptr[-1] != '=' && ptr[-1] != '~'))
@@ -263,12 +267,11 @@ tgetst1 (char *ptr, char **area)
 char PC;
 
 void
-tputs (register char *str, int nlines, register int (*outfun) (/* ??? */))
+tputs (register const char *str, int nlines, int (*outfun) (int))
 {
   register int padcount = 0;
   register int speed;
 
-  extern EMACS_INT baud_rate;
   speed = baud_rate;
   /* For quite high speeds, convert to the smaller
      units to avoid overflow.  */
@@ -320,10 +323,10 @@ tputs (register char *str, int nlines, register int (*outfun) (/* ??? */))
 struct termcap_buffer
   {
     char *beg;
-    int size;
+    ptrdiff_t size;
     char *ptr;
     int ateof;
-    int full;
+    ptrdiff_t full;
   };
 
 /* Forward declarations of static functions.  */
@@ -335,8 +338,7 @@ static int name_match (char *line, char *name);
 
 #ifdef MSDOS /* MW, May 1993 */
 static int
-valid_filename_p (fn)
-     char *fn;
+valid_filename_p (char *fn)
 {
   return *fn == '/' || fn[1] == ':';
 }
@@ -356,7 +358,7 @@ valid_filename_p (fn)
    in it, and some other value otherwise.  */
 
 int
-tgetent (char *bp, char *name)
+tgetent (char *bp, const char *name)
 {
   register char *termcap_name;
   register int fd;
@@ -364,7 +366,7 @@ tgetent (char *bp, char *name)
   register char *bp1;
   char *tc_search_point;
   char *term;
-  int malloc_size = 0;
+  ptrdiff_t malloc_size = 0;
   register int c;
   char *tcenv = NULL;          /* TERMCAP value, if it contains :tc=.  */
   char *indirect = NULL;       /* Terminal type in :tc= in TERMCAP value.  */
@@ -443,7 +445,7 @@ tgetent (char *bp, char *name)
   buf.size = BUFSIZE;
   /* Add 1 to size to ensure room for terminating null.  */
   buf.beg = (char *) xmalloc (buf.size + 1);
-  term = indirect ? indirect : name;
+  term = indirect ? indirect : (char *)name;
 
   if (!bp)
     {
@@ -465,20 +467,20 @@ tgetent (char *bp, char *name)
       if (scan_file (term, fd, &buf) == 0)
        {
          close (fd);
-         free (buf.beg);
+         xfree (buf.beg);
          if (malloc_size)
-           free (bp);
+           xfree (bp);
          return 0;
        }
 
       /* Free old `term' if appropriate.  */
       if (term != name)
-       free (term);
+       xfree (term);
 
       /* If BP is malloc'd by us, make sure it is big enough.  */
       if (malloc_size)
        {
-         int offset1 = bp1 - bp, offset2 = tc_search_point - bp;
+         ptrdiff_t offset1 = bp1 - bp, offset2 = tc_search_point - bp;
          malloc_size = offset1 + buf.size;
          bp = termcap_name = (char *) xrealloc (bp, malloc_size);
          bp1 = termcap_name + offset1;
@@ -503,7 +505,7 @@ tgetent (char *bp, char *name)
     }
 
   close (fd);
-  free (buf.beg);
+  xfree (buf.beg);
 
   if (malloc_size)
     bp = (char *) xrealloc (bp, bp1 - bp + 1);
@@ -617,7 +619,6 @@ gobble_line (int fd, register struct termcap_buffer *bufp, char *append_end)
   register char *end;
   register int nread;
   register char *buf = bufp->beg;
-  register char *tem;
 
   if (!append_end)
     append_end = bufp->ptr;
@@ -634,12 +635,17 @@ gobble_line (int fd, register struct termcap_buffer *bufp, char *append_end)
        {
          if (bufp->full == bufp->size)
            {
-             bufp->size *= 2;
+             ptrdiff_t ptr_offset = bufp->ptr - buf;
+             ptrdiff_t append_end_offset = append_end - buf;
+             ptrdiff_t size;
+             if ((min (PTRDIFF_MAX, SIZE_MAX) - 1) / 2 < bufp->size)
+               memory_full (SIZE_MAX);
+             size = 2 * bufp->size;
              /* Add 1 to size to ensure room for terminating null.  */
-             tem = (char *) xrealloc (buf, bufp->size + 1);
-             bufp->ptr = (bufp->ptr - buf) + tem;
-             append_end = (append_end - buf) + tem;
-             bufp->beg = buf = tem;
+             bufp->beg = buf = (char *) xrealloc (buf, size + 1);
+             bufp->size = size;
+             bufp->ptr = buf + ptr_offset;
+             append_end = buf + append_end_offset;
            }
        }
       else
@@ -664,9 +670,29 @@ gobble_line (int fd, register struct termcap_buffer *bufp, char *append_end)
 
 #include <stdio.h>
 
-main (argc, argv)
-     int argc;
-     char **argv;
+static void
+tprint (char *cap)
+{
+  char *x = tgetstr (cap, 0);
+  register char *y;
+
+  printf ("%s: ", cap);
+  if (x)
+    {
+      for (y = x; *y; y++)
+       if (*y <= ' ' || *y == 0177)
+         printf ("\\%0o", *y);
+       else
+         putchar (*y);
+      free (x);
+    }
+  else
+    printf ("none");
+  putchar ('\n');
+}
+
+int
+main (int argc, char **argv)
 {
   char *term;
   char *buf;
@@ -688,28 +714,8 @@ main (argc, argv)
 
   printf ("co: %d\n", tgetnum ("co"));
   printf ("am: %d\n", tgetflag ("am"));
-}
-
-tprint (cap)
-     char *cap;
-{
-  char *x = tgetstr (cap, 0);
-  register char *y;
 
-  printf ("%s: ", cap);
-  if (x)
-    {
-      for (y = x; *y; y++)
-       if (*y <= ' ' || *y == 0177)
-         printf ("\\%0o", *y);
-       else
-         putchar (*y);
-      free (x);
-    }
-  else
-    printf ("none");
-  putchar ('\n');
+  return 0;
 }
 
 #endif /* TEST */
-