[Emacs-diffs] trunk r114598: * fns.c (sxhash_bool_vector): Fix buffer read overrun.

[Paul Eggert]

------------------------------------------------------------
revno: 114598
revision-id: address@hidden
parent: address@hidden
committer: Paul Eggert <address@hidden>
branch nick: trunk
timestamp: Wed 2013-10-09 15:39:57 -0700
message:
  * fns.c (sxhash_bool_vector): Fix buffer read overrun.
modified:
  src/ChangeLog                  changelog-20091113204419-o5vbwnq5f7feedwu-1438
  src/fns.c                      fns.c-20091113204419-o5vbwnq5f7feedwu-203

=== modified file 'src/ChangeLog'
--- a/src/ChangeLog     2013-10-09 20:18:38 +0000
+++ b/src/ChangeLog     2013-10-09 22:39:57 +0000
@@ -1,3 +1,7 @@
+2013-10-09  Paul Eggert  <address@hidden>
+
+       * fns.c (sxhash_bool_vector): Fix buffer read overrun.
+
 2013-10-09  Eli Zaretskii  <address@hidden>
 
        * term.c (tty_menu_activate): Flush the output stream after

=== modified file 'src/fns.c'
--- a/src/fns.c 2013-10-09 03:32:35 +0000
+++ b/src/fns.c 2013-10-09 22:39:57 +0000
@@ -4191,7 +4191,9 @@
   EMACS_UINT hash = XBOOL_VECTOR (vec)->size;
   int i, n;
 
-  n = min (SXHASH_MAX_LEN, XBOOL_VECTOR (vec)->header.size);
+  n = min (SXHASH_MAX_LEN,
+          ((XBOOL_VECTOR (vec)->size + BOOL_VECTOR_BITS_PER_CHAR - 1)
+           / BOOL_VECTOR_BITS_PER_CHAR));
   for (i = 0; i < n; ++i)
     hash = sxhash_combine (hash, XBOOL_VECTOR (vec)->data[i]);