From: Paul Eggert <eggert@cs.ucla.edu>
Date: Thu, 12 May 2011 06:48:32 +0000 (-0700)
Subject: * menu.c (grow_menu_items): Check for int overflow.
X-Git-Tag: archive/raspbian/1%29.2+1-2+rpi1~1^2~324^2~3780^2~10^2~14
X-Git-Url: https://dgit.raspbian.org/%22http:/www.example.com/cgi/%22https:/www.github.com/%22bookmarks:///%22http:/www.example.com/cgi/%22https:/www.github.com/%22bookmarks:/?a=commitdiff_plain;h=d9f97b284a0c18b722af90077d869699a0830d66;p=emacs.git

* menu.c (grow_menu_items): Check for int overflow.
---

diff --git a/src/ChangeLog b/src/ChangeLog
index 0b58c691459..a5ee2cdcc32 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,5 +1,7 @@
 2011-05-12  Paul Eggert  <eggert@cs.ucla.edu>
 
+	* menu.c (grow_menu_items): Check for int overflow.
+
 	* xmenu.c (set_frame_menubar): Don't mishandle vectors with no nils.
 
 2011-05-11  Paul Eggert  <eggert@cs.ucla.edu>
diff --git a/src/menu.c b/src/menu.c
index 7a3edcb6f4f..705100381d5 100644
--- a/src/menu.c
+++ b/src/menu.c
@@ -176,6 +176,8 @@ save_menu_items (void)
 static void
 grow_menu_items (void)
 {
+  if ((INT_MAX - MENU_ITEMS_PANE_LENGTH) / 2 < menu_items_allocated)
+    memory_full ();
   menu_items_allocated *= 2;
   menu_items = larger_vector (menu_items, menu_items_allocated, Qnil);
 }