[!SYSTEM_MALLOC] (MEMMOVE_MISSING): Defined.

[gnu-emacs] / src / doprnt.c

diff --git a/src/doprnt.c b/src/doprnt.c
index 731afe400cc4054e9d5fbc3bac996600c10398d5..7abe5fa3a6b004aab3687999777b40f8b506dad2 100644 (file)
--- a/src/doprnt.c
+++ b/src/doprnt.c
@@ -20,6 +20,7 @@ along with GNU Emacs; see the file COPYING.  If not, write to
 the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.  */
 
 
+#include <config.h>
 #include <stdio.h>
 #include <ctype.h>
 
@@ -42,45 +43,63 @@ doprnt (buffer, bufsize, format, format_end, nargs, args)
   int cnt = 0;                 /* Number of arg to gobble next */
   register char *fmt = format; /* Pointer into format string */
   register char *bufptr = buffer; /* Pointer into output buffer.. */
+
   /* Use this for sprintf unless we need something really big.  */
   char tembuf[100];
+
   /* Size of sprintf_buffer.  */
   int size_allocated = 100;
+
   /* Buffer to use for sprintf.  Either tembuf or same as BIG_BUFFER.  */
   char *sprintf_buffer = tembuf;
+
   /* Buffer we have got with malloc.  */
   char *big_buffer = 0;
+
   register int tem;
   char *string;
-  char fmtcpy[20];
+  char fixed_buffer[20];       /* Default buffer for small formatting. */
+  char *fmtcpy;
   int minlen;
   int size;                    /* Field width factor; e.g., %90d */
 
   if (format_end == 0)
     format_end = format + strlen (format);
 
+  if ((format_end - format + 1) < sizeof (fixed_buffer))
+    fmtcpy = fixed_buffer;
+  else
+    fmtcpy = (char *) alloca (format_end - format + 1);
+
   bufsize--;
-  while (fmt != format_end && bufsize > 0)     /* Loop until end of format
-                                                  string or buffer full */
+
+  /* Loop until end of format string or buffer full. */
+  while (fmt != format_end && bufsize > 0)
     {
       if (*fmt == '%') /* Check for a '%' character */
        {
          int size_bound;
 
          fmt++;
-         /* Copy this one %-spec into fmtcopy.  */
+         /* Copy this one %-spec into fmtcpy.  */
          string = fmtcpy;
          *string++ = '%';
          while (1)
            {
              *string++ = *fmt;
-             if (! (*fmt >= '0' && *fmt <= '9') && *fmt != '-' && *fmt != ' ')
+             if (! (*fmt >= '0' && *fmt <= '9')
+                 && *fmt != '-' && *fmt != ' '&& *fmt != '.')
                break;
              fmt++;
            }
          *string = 0;
          /* Get an idea of how much space we might need.  */
          size_bound = atoi (&fmtcpy[1]) + 50;
+
+         /* Avoid pitfall of negative "size" parameter ("%-200d"). */
+         if (size_bound < 0)
+           size_bound = -size_bound;
+
          /* Make sure we have that much.  */
          if (size_bound > size_allocated)
            {
@@ -178,7 +197,7 @@ doprnt (buffer, bufsize, format, format_end, nargs, args)
 
   /* If we had to malloc something, free it.  */
   if (big_buffer)
-    free (big_buffer);
+    xfree (big_buffer);
 
   *bufptr = 0;         /* Make sure our string end with a '\0' */
   return bufptr - buffer;