infloop in skeleton-insert

[Lawrence Mitchell]

skeleton-internal-1 can enter an infinite loop if the ELEMENT argument
is a negative integer.  To reproduce:

emacs -Q

M-x auto-insert-mode RET

C-x C-f ~/tmp/test.tex

Answer yes when asked to perform auto insertion for latex mode.

Hit RET repeatedly.

This bug is due to skeleton-internal-1 relying on char-or-string-p to
return non-nil if its argument is an integer, while in fact,
char-or-string-p returns nil if its argument is a negative integer.

The following patch fixes this problem, and also stresses that an
integer only maps to a character if it is non-negative in the
docstring of char-or-string-p.

Cheers,

Lawrence

ChangeLog entry:

2007-04-10  Lawrence Mitchell  <address@hidden>

        * skeleton.el (skeleton-internal-1): Check if `element' is an
        integer using integerp rather than relying on char-or-string-p: it
        may be negative.


2007-04-10  Lawrence Mitchell  <address@hidden>

        * data.c (Fchar_or_string_p): Doc fix, a character is a
        non-negative integer.


Index: lisp/skeleton.el
===================================================================
RCS file: /sources/emacs/emacs/lisp/skeleton.el,v
retrieving revision 1.39.2.10
diff -u -r1.39.2.10 skeleton.el
--- lisp/skeleton.el    26 Jan 2007 06:15:09 -0000      1.39.2.10
+++ lisp/skeleton.el    10 Apr 2007 11:37:59 -0000
@@ -355,7 +355,8 @@
 
 (defun skeleton-internal-1 (element &optional literal recursive)
   (cond
-   ((char-or-string-p element)
+   (;; Negative integers are not `char-or-string-p'.
+    (or (integerp element) (char-or-string-p element))
     (if (and (integerp element)                ; -num
             (< element 0))
        (if skeleton-untabify


Index: src/data.c
===================================================================
RCS file: /sources/emacs/emacs/src/data.c,v
retrieving revision 1.224.4.27
diff -u -r1.224.4.27 data.c
--- src/data.c  26 Jan 2007 06:15:07 -0000      1.224.4.27
+++ src/data.c  10 Apr 2007 11:38:00 -0000
@@ -435,7 +435,7 @@
 }
 
 DEFUN ("char-or-string-p", Fchar_or_string_p, Schar_or_string_p, 1, 1, 0,
-       doc: /* Return t if OBJECT is a character (an integer) or a string.  */)
+       doc: /* Return t if OBJECT is a character (a non-negative integer) or a 
string.  */)
      (object)
      register Lisp_Object object;
 {


In GNU Emacs 23.0.0.3 (i686-pc-linux-gnu, X toolkit, Xaw3d scroll bars)
 of 2007-04-02 on lamacq.ph.ed.ac.uk
Windowing system distributor `The X.Org Foundation', version 11.0.60802000
configured using `configure  '--enable-font-backend' '--with-xft' 
'--prefix=/scratch/s0198183/applications/emacs-unicode''