From e20bb24948dd53afe77a5987c5408c715d1f388f Mon Sep 17 00:00:00 2001 From: Paul Eggert Date: Wed, 9 Oct 2013 15:39:57 -0700 Subject: [PATCH] * fns.c (sxhash_bool_vector): Fix buffer read overrun. --- src/ChangeLog | 4 ++++ src/fns.c | 4 +++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/src/ChangeLog b/src/ChangeLog index 0597c5d9f21..f46733d1ebe 100644 --- a/src/ChangeLog +++ b/src/ChangeLog @@ -1,3 +1,7 @@ +2013-10-09 Paul Eggert + + * fns.c (sxhash_bool_vector): Fix buffer read overrun. + 2013-10-09 Eli Zaretskii * term.c (tty_menu_activate): Flush the output stream after diff --git a/src/fns.c b/src/fns.c index e991711b871..1ee0a758fc2 100644 --- a/src/fns.c +++ b/src/fns.c @@ -4191,7 +4191,9 @@ sxhash_bool_vector (Lisp_Object vec) EMACS_UINT hash = XBOOL_VECTOR (vec)->size; int i, n; - n = min (SXHASH_MAX_LEN, XBOOL_VECTOR (vec)->header.size); + n = min (SXHASH_MAX_LEN, + ((XBOOL_VECTOR (vec)->size + BOOL_VECTOR_BITS_PER_CHAR - 1) + / BOOL_VECTOR_BITS_PER_CHAR)); for (i = 0; i < n; ++i) hash = sxhash_combine (hash, XBOOL_VECTOR (vec)->data[i]); -- 2.11.4.GIT