bug#30004: 27.0.50; call-interactively reads uninitialized memory

[Eli Zaretskii]

> From: Philipp <p.stephani2@gmail.com>
> Date: Sat, 06 Jan 2018 12:31:51 +0100
> 
> When passing a byte that would start a multibyte sequence,
> `call-interactively` uses STRING_CHAR without checking whether the
> entire multibyte sequence is actually part of the string.  For example:
> 
> $ emacs -batch -nw -Q -eval '(call-interactively (lambda () (interactive 
> "\xFF")))'
> Invalid control letter ‘𿯾’ (#o775776, #x3fbfe) in interactive calling string

Thanks for catching this.  Does the patch below fix this?

diff --git a/src/callint.c b/src/callint.c
index ef22851..ede9a02 100644
--- a/src/callint.c
+++ b/src/callint.c
@@ -774,10 +774,18 @@ invoke it.  If KEYS is omitted or nil, the return value of
             if anyone tries to define one here.  */
        case '+':
        default:
-         error ("Invalid control letter `%c' (#o%03o, #x%04x) in interactive 
calling string",
-                STRING_CHAR ((unsigned char *) tem),
-                (unsigned) STRING_CHAR ((unsigned char *) tem),
-                (unsigned) STRING_CHAR ((unsigned char *) tem));
+         {
+           ptrdiff_t bytes_left = SBYTES (specs) - (tem - string);
+           unsigned letter;
+
+           if (bytes_left >= BYTES_BY_CHAR_HEAD (*((unsigned char *) tem)))
+             letter = STRING_CHAR ((unsigned char *) tem);
+           else
+             letter = *((unsigned char *) tem);
+
+           error ("Invalid control letter `%c' (#o%03o, #x%04x) in interactive 
calling string",
+                  (int) letter, letter, letter);
+         }
        }
 
       if (varies[i] == 0)