bug-gnu-emacs
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

bug#24064: 24.5; NULL pointer dereference in compute_motion(), indent.c


From: Sergei Litvin
Subject: bug#24064: 24.5; NULL pointer dereference in compute_motion(), indent.c
Date: Mon, 25 Jul 2016 02:51:40 +0300
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0

Package: emacs

Version: 24.5

struct position *
compute_motion (ptrdiff_t from, ptrdiff_t frombyte, EMACS_INT fromvpos,
        EMACS_INT fromhpos, bool did_motion, ptrdiff_t to,
        EMACS_INT tovpos, EMACS_INT tohpos, EMACS_INT width,
        ptrdiff_t hscroll, int tab_offset, struct window *win)
{

...

  if (dp == buffer_display_table ())
    width_table = (VECTORP (BVAR (current_buffer, width_table))
                   ? XVECTOR (BVAR (current_buffer, width_table))->contents
                   : 0);
  else
    /* If the window has its own display table, we can't use the width
       run cache, because that's based on the buffer's display table.  */
    width_table = 0; // initialize it with 0 (current buffer has no display table)

...

      if (width_cache)
        {
          /* Is this character part of the current run?  If so, extend
         the run.  */
          if (pos - 1 == width_run_end
          && XFASTINT (width_table[c]) == width_run_width) // dereference width_table here, and crash
        width_run_end = pos;
...


Sergei Litvin


reply via email to

[Prev in Thread] Current Thread [Next in Thread]