[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
bug#24118: 25.1; [PATCH] Fix a possible crash caused by mapcar1
From: |
Chris Feng |
Subject: |
bug#24118: 25.1; [PATCH] Fix a possible crash caused by mapcar1 |
Date: |
Sun, 31 Jul 2016 20:46:50 +0800 |
Processing a list with `mapcar' or `mapconcat' can be terminated early
when the list is tampered (as shown in the following example), and as a
result we'll be dealing with uninitialized memory which will likely
trigger a crash.
(setq a (make-list 10 0))
(mapcar (lambda (_)
(setcdr a nil))
a)
Chris
---
* src/fns.c (mapcar1): Check and reset uninitialized list elements.
---
src/fns.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/src/fns.c b/src/fns.c
index d5a1f74..1804bce 100644
--- a/src/fns.c
+++ b/src/fns.c
@@ -2524,6 +2524,10 @@ mapcar1 (EMACS_INT leni, Lisp_Object *vals, Lisp_Object
fn, Lisp_Object seq)
vals[i] = dummy;
tail = XCDR (tail);
}
+
+ /* In case the list was tampered and the loop terminated early. */
+ if (i < leni)
+ memclear (vals + i, (leni - i) * word_size);
}
}
--
2.8.1
- bug#24118: 25.1; [PATCH] Fix a possible crash caused by mapcar1,
Chris Feng <=