bug#20156: Emacs 24 stack corruption in fontset.c:fontset_pattern_regexp

[John F Carr]

Emacs crashes on Mac Yosemite (native window system) when I use set-frame-font 
with certain font patterns.  The cause is writing past the end of an alloca 
buffer in fontset.c:fontset_pattern_regexp.  This triggers a stack check 
assertion.  Alloca is used to allocate space for a regexp, but the size 
neglects to consider the ^$ around the regexp.  “+1” should be “+3”.

To reproduce:

(set-frame-font "-adobe-courier-medium-r-normal--24-*-75-75-m-150-iso8859-1”)

without X installed.

Bug in 24.3 and "GNU Emacs 24.4.2 (x86_64-apple-darwin14.1.0, NS 
apple-appkit-1344.72)”.

fontset.diff
Description: fontset.diff