Fix integer overflow in internal_self_insert

* src/cmds.c (internal_self_insert): Avoid undefined behavior
on integer overflow by using saturated add.

diff --git a/src/cmds.c b/src/cmds.c
index 5b98a09fda9865918fc6818fbc004bb36c675bfb..c342cd88bd8c2154d2cc0f13fa04593fc71858a2 100644 (file)
--- a/src/cmds.c
+++ b/src/cmds.c
@@ -451,7 +451,10 @@ internal_self_insert (int c, EMACS_INT n)
          string = concat2 (string, tem);
        }
 
-      replace_range (PT, PT + chars_to_delete, string, 1, 1, 1, 0);
+      ptrdiff_t to;
+      if (INT_ADD_WRAPV (PT, chars_to_delete, &to))
+       to = PTRDIFF_MAX;
+      replace_range (PT, to, string, 1, 1, 1, 0);
       Fforward_char (make_fixnum (n));
     }
   else if (n > 1)