From 678bdba55e4a07e3baebad204c9fe5c55c99b3d3 Mon Sep 17 00:00:00 2001 From: Philip Date: Tue, 1 Sep 2015 20:42:44 +0000 Subject: [PATCH] Fix potential race conditions (Bug#21380) * keyboard.c (timer_check): Call `block_input' and turn off atimers around the creation of the temporary timer list copy. * fns.c (concat): Don't assume argument size remains unchanged after call to `Fmake_list'. Return incorrect results (but don't segfault) in that case. --- src/fns.c | 3 +++ src/keyboard.c | 4 ++++ 2 files changed, 7 insertions(+) diff --git a/src/fns.c b/src/fns.c index 26a98ab..15d9e64 100644 --- a/src/fns.c +++ b/src/fns.c @@ -744,6 +744,9 @@ concat (ptrdiff_t nargs, Lisp_Object *args, /* Store this element into the result. */ if (toindex < 0) { + if (NILP (tail)) + break; + XSETCAR (tail, elt); prev = tail; tail = XCDR (tail); diff --git a/src/keyboard.c b/src/keyboard.c index dab32b1..4ce830d 100644 --- a/src/keyboard.c +++ b/src/keyboard.c @@ -4560,6 +4560,8 @@ timer_check (void) Lisp_Object tem = Vinhibit_quit; Vinhibit_quit = Qt; + block_input (); + turn_on_atimers (false); /* We use copies of the timers' lists to allow a timer to add itself again, without locking up Emacs if the newly added timer is @@ -4573,6 +4575,8 @@ timer_check (void) else idle_timers = Qnil; + turn_on_atimers (true); + unblock_input (); Vinhibit_quit = tem; do -- 2.5.0