Fix kbd_buffer iteration loop in readable_events

* src/keyboard.c (readable_events): Wrap the event pointer back to the
start of the kbd_buffer array inside the top of the loop instead of
right before checking the loop condition, since kbd_fetch_ptr and
kbd_store_ptr point past the end of the array to mean that element 0
is next. (bug#21935)

diff --git a/src/keyboard.c b/src/keyboard.c
index 849066c3c26e2cfaaced5ac9fa6b1a242f23f999..c9e58e7a0865c9dd904cdf7e942add08008d0100 100644 (file)
--- a/src/keyboard.c
+++ b/src/keyboard.c
@@ -3313,14 +3313,12 @@ readable_events (int flags)
 #endif
                   ))
         {
-          union buffered_input_event *event;
-
-          event = ((kbd_fetch_ptr < kbd_buffer + KBD_BUFFER_SIZE)
-                   ? kbd_fetch_ptr
-                   : kbd_buffer);
+          union buffered_input_event *event = kbd_fetch_ptr;
 
          do
            {
+              if (event == kbd_buffer + KBD_BUFFER_SIZE)
+                event = kbd_buffer;
              if (!(
 #ifdef USE_TOOLKIT_SCROLL_BARS
                    (flags & READABLE_EVENTS_FILTER_EVENTS) &&
@@ -3337,8 +3335,6 @@ readable_events (int flags)
                       && event->kind == BUFFER_SWITCH_EVENT))
                return 1;
              event++;
-              if (event == kbd_buffer + KBD_BUFFER_SIZE)
-                event = kbd_buffer;
            }
          while (event != kbd_store_ptr);
         }