editfns.c (Fformat): fix for segfault

[Jim Meyering]

I tried using a snapshot from today's CVS repository with Gnus.
I got a segfault within a minute or two:

  pi$ gdb --args  /p/bin/emacs -f gnus-no-server
  (gdb) r
  Starting program: /u/p/bin/emacs -f gnus-no-server

  Program received signal SIGSEGV, Segmentation fault.
  0x081718e2 in Fformat (nargs=4, args=0xbfffe194)
      at /mirror/d/emacs/src/editfns.c:3486
  3486              discarded[format - format_start] = 1;
  (gdb) p format
  $1 = (unsigned char *) 0x91788b4 "%S %d %d y\n"
  (gdb) p format_start
  $2 = (unsigned char *) 0x90cff34 "%s %d %d y\n"
  (gdb) p discarded
  $3 = 0xbfffdff0 ""
  (gdb) l
  3481            {
  3482              int minlen;
  3483              int negative = 0;
  3484              unsigned char *this_format_start = format;
  3485
  3486              discarded[format - format_start] = 1;
  3487              format++;
  3488
  3489              /* Process a numeric arg and skip it.  */
  3490              /* NOTE atoi is the wrong thing to use here; will be fixed 
*/
  (gdb) p format - format_start
  $4 = 690560

This patch seems to have fixed it, at least to the extent
that with it, I can no longer reproduce the problem.

2003-04-27  Jim Meyering  <address@hidden>

        * editfns.c (Fformat): Initialize `start_format' and `end' to go with
        possibly-new `format' before scanning the format a second time.

Index: src/editfns.c
===================================================================
RCS file: /cvsroot/emacs/emacs/src/editfns.c,v
retrieving revision 1.355
diff -u -p -u -p -r1.355 editfns.c
--- src/editfns.c       11 Apr 2003 23:17:42 -0000      1.355
+++ src/editfns.c       27 Apr 2003 13:41:59 -0000
@@ -1,5 +1,5 @@
 /* Lisp functions pertaining to editing.
-   Copyright (C) 1985,86,87,89,93,94,95,96,97,98, 1999, 2000, 2001, 2002
+   Copyright (C) 1985,86,87,89,93,94,95,96,97,98, 1999, 2000, 2001, 2002, 2003
        Free Software Foundation, Inc.
 
 This file is part of GNU Emacs.
@@ -3474,6 +3474,8 @@ usage: (format STRING &rest OBJECTS)  */
 
   /* Scan the format and store result in BUF.  */
   format = SDATA (args[0]);
+  format_start = format;
+  end = format + SBYTES (args[0]);
   maybe_combine_byte = 0;
   while (format != end)
     {