* menu.c (grow_menu_items): Check for int overflow.

diff --git a/src/ChangeLog b/src/ChangeLog
index 10b3ef2d6f2187719992a1fe3d87cc5f874b6c17..913dcc05a10ea0b5f7922ee5e6b1a37fc8f091bb 100644 (file)
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,5 +1,7 @@
 2011-05-12  Paul Eggert  <eggert@cs.ucla.edu>
 
+       * menu.c (grow_menu_items): Check for int overflow.
+
        * xmenu.c (set_frame_menubar): Don't mishandle vectors with no nils.
 
 2011-05-11  Paul Eggert  <eggert@cs.ucla.edu>

diff --git a/src/menu.c b/src/menu.c
index 7a3edcb6f4f16d3585a6e7e45f93791660f92044..705100381d50d3b667c8990b670c31cead61dff0 100644 (file)
--- a/src/menu.c
+++ b/src/menu.c
@@ -176,6 +176,8 @@ save_menu_items (void)
 static void
 grow_menu_items (void)
 {
+  if ((INT_MAX - MENU_ITEMS_PANE_LENGTH) / 2 < menu_items_allocated)
+    memory_full ();
   menu_items_allocated *= 2;
   menu_items = larger_vector (menu_items, menu_items_allocated, Qnil);
 }