Fix out-of-bounds access in xdisp.c

* src/xdisp.c (produce_stretch_glyph): Avoid indexing it->stack
with a negative index.  Reported by Po Lu <luangruo@yahoo.com>.

diff --git a/src/xdisp.c b/src/xdisp.c
index b2eeb1105b1d50b4b2525228d32cd8f71ba0e348..45b502590d11374a16c713ba6e377c45dc0a827a 100644 (file)
--- a/src/xdisp.c
+++ b/src/xdisp.c
@@ -30391,7 +30391,8 @@ produce_stretch_glyph (struct it *it)
   if (width > 0 && height > 0 && it->glyph_row)
     {
       Lisp_Object o_object = it->object;
-      Lisp_Object object = it->stack[it->sp - 1].string;
+      Lisp_Object object =
+       it->sp > 0 ? it->stack[it->sp - 1].string : it->string;
       int n = width;
 
       if (!STRINGP (object))