emacs-diffs
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Emacs-diffs] /srv/bzr/emacs/trunk r104674: Merge: Integer overflow and


From: Paul Eggert
Subject: [Emacs-diffs] /srv/bzr/emacs/trunk r104674: Merge: Integer overflow and signedness fixes (Bug#8873).
Date: Wed, 22 Jun 2011 09:15:41 -0700
User-agent: Bazaar (2.3.1)

------------------------------------------------------------
revno: 104674 [merge]
committer: Paul Eggert <address@hidden>
branch nick: trunk
timestamp: Wed 2011-06-22 09:15:41 -0700
message:
  Merge: Integer overflow and signedness fixes (Bug#8873).
  
  A few related buffer overrun fixes, too.
modified:
  src/ChangeLog
  src/alloc.c
  src/buffer.c
  src/buffer.h
  src/callproc.c
  src/category.h
  src/coding.c
  src/composite.c
  src/data.c
  src/dbusbind.c
  src/dispextern.h
  src/editfns.c
  src/emacs.c
  src/fileio.c
  src/filelock.c
  src/fns.c
  src/font.c
  src/font.h
  src/ftfont.c
  src/gtkutil.c
  src/image.c
  src/indent.c
  src/insdel.c
  src/keyboard.c
  src/lisp.h
  src/lread.c
  src/minibuf.c
  src/nsterm.h
  src/process.c
  src/termcap.c
  src/textprop.c
  src/w32term.h
  src/xdisp.c
  src/xfaces.c
  src/xfns.c
  src/xfont.c
  src/xrdb.c
  src/xselect.c
  src/xsettings.c
  src/xsmfns.c
  src/xterm.c
  src/xterm.h
=== modified file 'src/ChangeLog'
--- a/src/ChangeLog     2011-06-22 12:23:17 +0000
+++ b/src/ChangeLog     2011-06-22 16:15:41 +0000
@@ -1,3 +1,205 @@
+2011-06-22  Paul Eggert  <address@hidden>
+
+       Integer overflow and signedness fixes (Bug#8873).
+       A few related buffer overrun fixes, too.
+
+       * font.c (font_score): Use EMACS_INT, not int, to store XINT value.
+
+       * dispextern.h (struct face.stipple):
+       * image.c (x_bitmap_height, x_bitmap_width, x_bitmap_pixmap)
+       (x_bitmap_mask, x_allocate_bitmap_record)
+       (x_create_bitmap_from_data, x_create_bitmap_from_file)
+       (x_destroy_bitmap, x_destroy_all_bitmaps, x_create_bitmap_mask)
+       (x_create_bitmap_from_xpm_data):
+       * nsterm.h (struct ns_display_info.bitmaps_size, .bitmaps_last):
+       * w32term.h (struct w32_display_info.icon_bitmap_id, .bitmaps_size)
+       (.bitmaps_last):
+       * xfaces.c (load_pixmap):
+       * xterm.c (x_bitmap_icon, x_wm_set_icon_pixmap):
+       * xterm.h (struct x_display_info.icon_bitmap_id, .bitmaps_size)
+       (.bitmaps_last, struct x_output.icon_bitmap):
+       Use ptrdiff_t, not int, for bitmap indexes.
+       (x_allocate_bitmap_record): Check for size overflow.
+       * dispextern.h, lisp.h: Adjust to API changes elsewhere.
+
+       Use ptrdiff_t, not int, for overlay counts.
+       * buffer.h (overlays_at, sort_overlays, GET_OVERLAYS_AT):
+       * editfns.c (overlays_around, get_pos_property):
+       * textprop.c (get_char_property_and_overlay):
+       * xdisp.c (next_overlay_change, note_mouse_highlight):
+       * xfaces.c (face_at_buffer_position):
+       * buffer.c (OVERLAY_COUNT_MAX): New macro.
+       (overlays_at, overlays_in, sort_overlays, Foverlays_at)
+       (Fnext_overlay_change, Fprevious_overlay_change)
+       (mouse_face_overlay_overlaps, Foverlays_in):
+       Use ptrdiff_t, not int, for sizes.
+       (overlays_at, overlays_in): Check for size-calculation overflow.
+
+       * xterm.c (xim_initialize, same_x_server): Strlen may not fit in int.
+
+       * xsmfns.c (smc_save_yourself_CB, x_session_initialize): Avoid strlen.
+       (x_session_initialize): Do not assume string length fits in int.
+
+       * xsettings.c (apply_xft_settings): Fix potential buffer overrun.
+       This is unlikely, but can occur if DPI is outlandish.
+
+       * xsettings.c (Ffont_get_system_normal_font, Ffont_get_system_font):
+       * xselect.c (Fx_get_atom_name): Avoid need for strlen.
+
+       * xrdb.c: Don't assume strlen fits in int; avoid some strlens.
+       * xrdb.c (magic_file_p, search_magic_path):
+       Omit last arg SUFFIX; it was always 0.  All callers changed.
+       (magic_file_p): Use ptrdiff_t, not int.  Check for size overflow.
+
+       * xfont.c (xfont_match): Avoid need for strlen.
+
+       * xfns.c: Don't assume strlen fits in int.
+       (xic_create_fontsetname, x_window): Use ptrdiff_t, not int.
+
+       * xdisp.c (message_log_check_duplicate): Return intmax_t,
+       not unsigned long, as we prefer signed integers.  All callers changed.
+       Detect integer overflow in repeat count.
+       (message_dolog): Don't assume print length fits in 39 bytes.
+       (display_mode_element): Don't assume strlen fits in int.
+
+       * termcap.c: Don't assume sizes fit in int and never overflow.
+       (struct termcap_buffer, tgetent): Use ptrdiff_t, not int, for sizes.
+       (gobble_line): Check for size-calculation overflow.
+
+       * minibuf.c (Fread_buffer):
+       * lread.c (intern, intern_c_string):
+       * image.c (xpm_scan) [HAVE_NS && !HAVE_XPM]:
+       Don't assume string length fits in int.
+
+       * keyboard.c (parse_tool_bar_item):
+       * gtkutil.c (style_changed_cb): Avoid need for strlen.
+
+       * font.c: Don't assume string length fits in int.
+       (font_parse_xlfd, font_parse_fcname, font_unparse_fcname):
+       Use ptrdiff_t, not int.
+       (font_intern_prop): Don't assume string length fits in int.
+       Don't assume integer property fits in fixnum.
+       * font.h (font_intern_prop): 2nd arg is now ptrdiff_t, not int.
+
+       * filelock.c: Fix some buffer overrun and integer overflow issues.
+       (get_boot_time): Don't assume gzip command string fits in 100 bytes.
+       Reformulate so as not to need the command string.
+       Invoke gzip -cd rather than gunzip, as it's more portable.
+       (lock_info_type, lock_file_1, lock_file):
+       Don't assume pid_t and time_t fit in unsigned long.
+       (LOCK_PID_MAX): Remove; we now use more-reliable bounds.
+       (current_lock_owner): Prefer signed type for sizes.
+       Use memcpy, not strncpy, where memcpy is what is really wanted.
+       Don't assume (via atoi) that time_t and pid_t fit in int.
+       Check for time_t and/or pid_t out of range, e.g., via a network share.
+       Don't alloca where an auto var works fine.
+
+       * fileio.c: Fix some integer overflow issues.
+       (file_name_as_directory, Fexpand_file_name, Fsubstitute_in_file_name):
+       Don't assume string length fits in int.
+       (directory_file_name): Don't assume string length fits in long.
+       (make_temp_name): Don't assume pid fits in int, or that its print
+       length is less than 20.
+
+       * data.c (Fsubr_name): Rewrite to avoid a strlen call.
+
+       * coding.c (make_subsidiaries): Don't assume string length fits in int.
+
+       * callproc.c (child_setup): Rewrite to avoid two strlen calls.
+
+       * process.c (Fformat_network_address): Use EMACS_INT, not EMACS_UINT.
+       We prefer signed integers, even for size calculations.
+
+       * emacs.c: Don't assume string length fits in 'int'.
+       (DEFINE_DUMMY_FUNCTION, sort_args): Use ptrdiff_t, not int.
+       (main): Don't invoke strlen when not needed.
+
+       * dbusbind.c (XD_ERROR): Don't arbitrarily truncate string.
+       (XD_DEBUG_MESSAGE): Don't waste a byte.
+
+       * callproc.c (getenv_internal_1, getenv_internal)
+       (Fgetenv_internal):
+       * buffer.c (init_buffer): Don't assume string length fits in 'int'.
+
+       * lread.c (invalid_syntax): Omit length argument.
+       All uses changed.  This doesn't fix a bug, but it simplifies the
+       code away from its former Hollerith-constant appearance, and it's
+       one less 'int' to worry about when looking at integer-overflow issues.
+       (string_to_number): Simplify 2011-04-26 change by invoking xsignal1.
+
+       * lisp.h (DEFUN): Remove bogus use of sizeof (struct Lisp_Subr).
+       This didn't break anything, but it didn't help either.
+       It's confusing to put a bogus integer in a place where the actual
+       value does not matter.
+       (LIST_END_P): Remove unused macro and its bogus comment.
+       (make_fixnum_or_float): Remove unnecessary cast to EMACS_INT.
+
+       * lisp.h (union Lisp_Object.i): EMACS_INT, not EMACS_UINT.
+       This is for consistency with the ordinary, non-USE_LISP_UNION_TYPE,
+       implementation.
+       (struct Lisp_Bool_Vector.size): EMACS_INT, not EMACS_UINT.
+       We prefer signed types, and the value cannot exceed the EMACS_INT
+       range anyway (because otherwise the length would not be representable).
+       (XSET) [USE_LISP_UNION_TYPE]: Use uintptr_t and intptr_t,
+       not EMACS_UINT and EMACS_INT, when converting pointer to integer.
+       This avoids a GCC warning when WIDE_EMACS_INT.
+
+       * indent.c (sane_tab_width): New function.
+       (current_column, scan_for_column, Findent_to, position_indentation)
+       (compute_motion): Use it.  This is just for clarity.
+       (Fcompute_motion): Don't assume hscroll and tab offset fit in int.
+
+       * image.c (xbm_image_p): Don't assume stated width, height fit in int.
+
+       * lisp.h (lint_assume): New macro.
+       * composite.c (composition_gstring_put_cache):
+       * ftfont.c (ftfont_shape_by_flt): Use it to pacify GCC 4.6.0.
+
+       * editfns.c, insdel.c:
+       Omit unnecessary forward decls, to simplify future changes.
+
+       * ftfont.c (ftfont_shape_by_flt): Use signed integers for lengths.
+
+       * font.c (Ffont_shape_gstring): Don't assume glyph len fits in 'int'.
+
+       * fns.c (Ffillarray): Don't assume bool vector size fits in 'int'.
+       Use much-faster test for byte-length change.
+       Don't assume string byte-length fits in 'int'.
+       Check that character arg fits in 'int'.
+       (mapcar1): Declare byte as byte, for clarity.
+
+       * alloc.c (Fmake_bool_vector): Avoid unnecessary multiplication.
+
+       * fns.c (concat): Catch string overflow earlier.
+       Do not rely on integer wraparound.
+
+       * dispextern.h (struct it.overlay_strings_charpos)
+       (struct it.selective): Now EMACS_INT, not int.
+       * xdisp.c (forward_to_next_line_start)
+       (back_to_previous_visible_line_start)
+       (reseat_at_next_visible_line_start, next_element_from_buffer):
+       Don't arbitrarily truncate the value of 'selective' to int.
+
+       * xdisp.c (init_iterator): Use XINT, not XFASTINT; it might be < 0.
+
+       * composite.c: Don't truncate sizes to 'int'.
+       (composition_gstring_p, composition_reseat_it)
+       (composition_adjust_point): Use EMACS_INT, not int.
+       (get_composition_id, composition_gstring_put_cache): Use EMACS_INT,
+       not EMACS_UINT, for indexes.
+
+       * category.h (CATEGORY_SET_P): Remove unnecessary cast to EMACS_INT.
+
+       * buffer.c: Include <verify.h>.
+       (struct sortvec.priority, struct sortstr.priority):
+       Now EMACS_INT, not int.
+       (compare_overlays, cmp_for_strings): Avoid subtraction overflow.
+       (struct sortstr.size, record_overlay_string)
+       (struct sortstrlist.size, struct sortlist.used):
+       Don't truncate size to int.
+       (record_overlay_string): Check for size-calculation overflow.
+       (init_buffer_once): Check at compile-time, not run-time.
+
 2011-06-22  Jim Meyering  <address@hidden>
 
        don't leak an XBM-image-sized buffer

=== modified file 'src/alloc.c'
--- a/src/alloc.c       2011-06-14 21:30:16 +0000
+++ b/src/alloc.c       2011-06-18 15:39:24 +0000
@@ -2257,12 +2257,14 @@
   p = XBOOL_VECTOR (val);
   p->size = XFASTINT (length);
 
-  memset (p->data, NILP (init) ? 0 : -1, length_in_chars);
+  if (length_in_chars)
+    {
+      memset (p->data, ! NILP (init) ? -1 : 0, length_in_chars);
 
-  /* Clear the extraneous bits in the last byte.  */
-  if (XINT (length) != length_in_chars * BOOL_VECTOR_BITS_PER_CHAR)
-    p->data[length_in_chars - 1]
-      &= (1 << (XINT (length) % BOOL_VECTOR_BITS_PER_CHAR)) - 1;
+      /* Clear any extraneous bits in the last byte.  */
+      p->data[length_in_chars - 1]
+       &= (1 << (XINT (length) % BOOL_VECTOR_BITS_PER_CHAR)) - 1;
+    }
 
   return val;
 }

=== modified file 'src/buffer.c'
--- a/src/buffer.c      2011-06-13 08:00:15 +0000
+++ b/src/buffer.c      2011-06-21 23:16:43 +0000
@@ -27,6 +27,8 @@
 #include <setjmp.h>
 #include <unistd.h>
 
+#include <verify.h>
+
 #include "lisp.h"
 #include "intervals.h"
 #include "window.h"
@@ -92,6 +94,11 @@
 #define PER_BUFFER_SYMBOL(OFFSET) \
       (*(Lisp_Object *)((OFFSET) + (char *) &buffer_local_symbols))
 
+/* Maximum length of an overlay vector.  */
+#define OVERLAY_COUNT_MAX                                              \
+  ((ptrdiff_t) min (MOST_POSITIVE_FIXNUM,                              \
+                   min (PTRDIFF_MAX, SIZE_MAX) / sizeof (Lisp_Object)))
+
 /* Flags indicating which built-in buffer-local variables
    are permanent locals.  */
 static char buffer_permanent_local_flags[MAX_PER_BUFFER_VARS];
@@ -2516,14 +2523,15 @@
    *NEXT_PTR is guaranteed to be not equal to POS, unless it is the
    default (BEGV or ZV).  */
 
-int
-overlays_at (EMACS_INT pos, int extend, Lisp_Object **vec_ptr, int *len_ptr,
+ptrdiff_t
+overlays_at (EMACS_INT pos, int extend, Lisp_Object **vec_ptr,
+            ptrdiff_t *len_ptr,
             EMACS_INT *next_ptr, EMACS_INT *prev_ptr, int change_req)
 {
   Lisp_Object overlay, start, end;
   struct Lisp_Overlay *tail;
-  int idx = 0;
-  int len = *len_ptr;
+  ptrdiff_t idx = 0;
+  ptrdiff_t len = *len_ptr;
   Lisp_Object *vec = *vec_ptr;
   EMACS_INT next = ZV;
   EMACS_INT prev = BEGV;
@@ -2559,10 +2567,10 @@
                 Either make it bigger, or don't store any more in it.  */
              if (extend)
                {
+                 if ((OVERLAY_COUNT_MAX - 4) / 2 < len)
+                   memory_full (SIZE_MAX);
                  /* Make it work with an initial len == 0.  */
-                 len *= 2;
-                 if (len == 0)
-                   len = 4;
+                 len = len * 2 + 4;
                  *len_ptr = len;
                  vec = (Lisp_Object *) xrealloc (vec, len * sizeof 
(Lisp_Object));
                  *vec_ptr = vec;
@@ -2602,10 +2610,10 @@
            {
              if (extend)
                {
+                 if ((OVERLAY_COUNT_MAX - 4) / 2 < len)
+                   memory_full (SIZE_MAX);
                  /* Make it work with an initial len == 0.  */
-                 len *= 2;
-                 if (len == 0)
-                   len = 4;
+                 len = len * 2 + 4;
                  *len_ptr = len;
                  vec = (Lisp_Object *) xrealloc (vec, len * sizeof 
(Lisp_Object));
                  *vec_ptr = vec;
@@ -2655,15 +2663,15 @@
    and we store only as many overlays as will fit.
    But we still return the total number of overlays.  */
 
-static int
+static ptrdiff_t
 overlays_in (EMACS_INT beg, EMACS_INT end, int extend,
-            Lisp_Object **vec_ptr, int *len_ptr,
+            Lisp_Object **vec_ptr, ptrdiff_t *len_ptr,
             EMACS_INT *next_ptr, EMACS_INT *prev_ptr)
 {
   Lisp_Object overlay, ostart, oend;
   struct Lisp_Overlay *tail;
-  int idx = 0;
-  int len = *len_ptr;
+  ptrdiff_t idx = 0;
+  ptrdiff_t len = *len_ptr;
   Lisp_Object *vec = *vec_ptr;
   EMACS_INT next = ZV;
   EMACS_INT prev = BEGV;
@@ -2699,10 +2707,10 @@
                 Either make it bigger, or don't store any more in it.  */
              if (extend)
                {
+                 if ((OVERLAY_COUNT_MAX - 4) / 2 < len)
+                   memory_full (SIZE_MAX);
                  /* Make it work with an initial len == 0.  */
-                 len *= 2;
-                 if (len == 0)
-                   len = 4;
+                 len = len * 2 + 4;
                  *len_ptr = len;
                  vec = (Lisp_Object *) xrealloc (vec, len * sizeof 
(Lisp_Object));
                  *vec_ptr = vec;
@@ -2747,10 +2755,10 @@
            {
              if (extend)
                {
+                 if ((OVERLAY_COUNT_MAX - 4) / 2 < len)
+                   memory_full (SIZE_MAX);
                  /* Make it work with an initial len == 0.  */
-                 len *= 2;
-                 if (len == 0)
-                   len = 4;
+                 len = len * 2 + 4;
                  *len_ptr = len;
                  vec = (Lisp_Object *) xrealloc (vec, len * sizeof 
(Lisp_Object));
                  *vec_ptr = vec;
@@ -2783,7 +2791,7 @@
 {
   EMACS_INT start = OVERLAY_POSITION (OVERLAY_START (overlay));
   EMACS_INT end = OVERLAY_POSITION (OVERLAY_END (overlay));
-  int n, i, size;
+  ptrdiff_t n, i, size;
   Lisp_Object *v, tem;
 
   size = 10;
@@ -2849,7 +2857,7 @@
 {
   Lisp_Object overlay;
   EMACS_INT beg, end;
-  int priority;
+  EMACS_INT priority;
 };
 
 static int
@@ -2858,21 +2866,21 @@
   const struct sortvec *s1 = (const struct sortvec *) v1;
   const struct sortvec *s2 = (const struct sortvec *) v2;
   if (s1->priority != s2->priority)
-    return s1->priority - s2->priority;
+    return s1->priority < s2->priority ? -1 : 1;
   if (s1->beg != s2->beg)
-    return s1->beg - s2->beg;
+    return s1->beg < s2->beg ? -1 : 1;
   if (s1->end != s2->end)
-    return s2->end - s1->end;
+    return s2->end < s1->end ? -1 : 1;
   return 0;
 }
 
 /* Sort an array of overlays by priority.  The array is modified in place.
    The return value is the new size; this may be smaller than the original
    size if some of the overlays were invalid or were window-specific.  */
-int
-sort_overlays (Lisp_Object *overlay_vec, int noverlays, struct window *w)
+ptrdiff_t
+sort_overlays (Lisp_Object *overlay_vec, ptrdiff_t noverlays, struct window *w)
 {
-  int i, j;
+  ptrdiff_t i, j;
   struct sortvec *sortvec;
   sortvec = (struct sortvec *) alloca (noverlays * sizeof (struct sortvec));
 
@@ -2926,15 +2934,15 @@
 struct sortstr
 {
   Lisp_Object string, string2;
-  int size;
-  int priority;
+  ptrdiff_t size;
+  EMACS_INT priority;
 };
 
 struct sortstrlist
 {
   struct sortstr *buf; /* An array that expands as needed; never freed.  */
-  int size;            /* Allocated length of that array.  */
-  int used;            /* How much of the array is currently in use.  */
+  ptrdiff_t size;      /* Allocated length of that array.  */
+  ptrdiff_t used;      /* How much of the array is currently in use.  */
   EMACS_INT bytes;             /* Total length of the strings in buf.  */
 };
 
@@ -2955,20 +2963,24 @@
   struct sortstr *s1 = (struct sortstr *)as1;
   struct sortstr *s2 = (struct sortstr *)as2;
   if (s1->size != s2->size)
-    return s2->size - s1->size;
+    return s2->size < s1->size ? -1 : 1;
   if (s1->priority != s2->priority)
-    return s1->priority - s2->priority;
+    return s1->priority < s2->priority ? -1 : 1;
   return 0;
 }
 
 static void
-record_overlay_string (struct sortstrlist *ssl, Lisp_Object str, Lisp_Object 
str2, Lisp_Object pri, int size)
+record_overlay_string (struct sortstrlist *ssl, Lisp_Object str,
+                      Lisp_Object str2, Lisp_Object pri, ptrdiff_t size)
 {
   EMACS_INT nbytes;
 
   if (ssl->used == ssl->size)
     {
-      if (ssl->buf)
+      if (min (PTRDIFF_MAX, SIZE_MAX) / (sizeof (struct sortstr) * 2)
+         < ssl->size)
+       memory_full (SIZE_MAX);
+      else if (0 < ssl->size)
        ssl->size *= 2;
       else
        ssl->size = 5;
@@ -3874,9 +3886,8 @@
        doc: /* Return a list of the overlays that contain the character at 
POS.  */)
   (Lisp_Object pos)
 {
-  int noverlays;
+  ptrdiff_t len, noverlays;
   Lisp_Object *overlay_vec;
-  int len;
   Lisp_Object result;
 
   CHECK_NUMBER_COERCE_MARKER (pos);
@@ -3906,9 +3917,8 @@
 end of the buffer.  */)
   (Lisp_Object beg, Lisp_Object end)
 {
-  int noverlays;
+  ptrdiff_t len, noverlays;
   Lisp_Object *overlay_vec;
-  int len;
   Lisp_Object result;
 
   CHECK_NUMBER_COERCE_MARKER (beg);
@@ -3936,11 +3946,9 @@
 the value is (point-max).  */)
   (Lisp_Object pos)
 {
-  int noverlays;
+  ptrdiff_t i, len, noverlays;
   EMACS_INT endpos;
   Lisp_Object *overlay_vec;
-  int len;
-  int i;
 
   CHECK_NUMBER_COERCE_MARKER (pos);
 
@@ -3979,7 +3987,7 @@
 {
   EMACS_INT prevpos;
   Lisp_Object *overlay_vec;
-  int len;
+  ptrdiff_t len;
 
   CHECK_NUMBER_COERCE_MARKER (pos);
 
@@ -4971,7 +4979,7 @@
      The local flag bits are in the local_var_flags slot of the buffer.  */
 
   /* Nothing can work if this isn't true */
-  if (sizeof (EMACS_INT) != sizeof (Lisp_Object)) abort ();
+  { verify (sizeof (EMACS_INT) == sizeof (Lisp_Object)); }
 
   /* 0 means not a lisp var, -1 means always local, else mask */
   memset (&buffer_local_flags, 0, sizeof buffer_local_flags);
@@ -5077,7 +5085,7 @@
 {
   char *pwd;
   Lisp_Object temp;
-  int len;
+  ptrdiff_t len;
 
 #ifdef USE_MMAP_FOR_BUFFERS
  {

=== modified file 'src/buffer.h'
--- a/src/buffer.h      2011-06-16 06:19:26 +0000
+++ b/src/buffer.h      2011-06-21 21:32:10 +0000
@@ -887,10 +887,10 @@
 extern void delete_all_overlays (struct buffer *);
 extern void reset_buffer (struct buffer *);
 extern void evaporate_overlays (EMACS_INT);
-extern int overlays_at (EMACS_INT pos, int extend, Lisp_Object **vec_ptr,
-                        int *len_ptr, EMACS_INT *next_ptr,
-                        EMACS_INT *prev_ptr, int change_req);
-extern int sort_overlays (Lisp_Object *, int, struct window *);
+extern ptrdiff_t overlays_at (EMACS_INT pos, int extend, Lisp_Object **vec_ptr,
+                             ptrdiff_t *len_ptr, EMACS_INT *next_ptr,
+                             EMACS_INT *prev_ptr, int change_req);
+extern ptrdiff_t sort_overlays (Lisp_Object *, ptrdiff_t, struct window *);
 extern void recenter_overlay_lists (struct buffer *, EMACS_INT);
 extern EMACS_INT overlay_strings (EMACS_INT, struct window *, unsigned char 
**);
 extern void validate_region (Lisp_Object *, Lisp_Object *);
@@ -908,7 +908,7 @@
 
 #define GET_OVERLAYS_AT(posn, overlays, noverlays, nextp, chrq)                
\
   do {                                                                 \
-    int maxlen = 40;                                                   \
+    ptrdiff_t maxlen = 40;                                                     
\
     overlays = (Lisp_Object *) alloca (maxlen * sizeof (Lisp_Object)); \
     noverlays = overlays_at (posn, 0, &overlays, &maxlen,              \
                             nextp, NULL, chrq);                                
\

=== modified file 'src/callproc.c'
--- a/src/callproc.c    2011-06-14 18:57:19 +0000
+++ b/src/callproc.c    2011-06-21 01:06:45 +0000
@@ -1230,8 +1230,7 @@
 
     if (STRINGP (display))
       {
-       int vlen = strlen ("DISPLAY=") + strlen (SSDATA (display)) + 1;
-       char *vdata = (char *) alloca (vlen);
+       char *vdata = (char *) alloca (sizeof "DISPLAY=" + SBYTES (display));
        strcpy (vdata, "DISPLAY=");
        strcat (vdata, SSDATA (display));
        new_env = add_env (env, new_env, vdata);
@@ -1378,8 +1377,8 @@
 #endif /* not WINDOWSNT */
 
 static int
-getenv_internal_1 (const char *var, int varlen, char **value, int *valuelen,
-                  Lisp_Object env)
+getenv_internal_1 (const char *var, ptrdiff_t varlen, char **value,
+                  ptrdiff_t *valuelen, Lisp_Object env)
 {
   for (; CONSP (env); env = XCDR (env))
     {
@@ -1413,8 +1412,8 @@
 }
 
 static int
-getenv_internal (const char *var, int varlen, char **value, int *valuelen,
-                Lisp_Object frame)
+getenv_internal (const char *var, ptrdiff_t varlen, char **value,
+                ptrdiff_t *valuelen, Lisp_Object frame)
 {
   /* Try to find VAR in Vprocess_environment first.  */
   if (getenv_internal_1 (var, varlen, value, valuelen,
@@ -1454,7 +1453,7 @@
   (Lisp_Object variable, Lisp_Object env)
 {
   char *value;
-  int valuelen;
+  ptrdiff_t valuelen;
 
   CHECK_STRING (variable);
   if (CONSP (env))
@@ -1478,7 +1477,7 @@
 egetenv (const char *var)
 {
   char *value;
-  int valuelen;
+  ptrdiff_t valuelen;
 
   if (getenv_internal (var, strlen (var), &value, &valuelen, Qnil))
     return value;

=== modified file 'src/category.h'
--- a/src/category.h    2011-04-11 06:28:35 +0000
+++ b/src/category.h    2011-06-17 08:17:29 +0000
@@ -62,7 +62,7 @@
 #define XCATEGORY_SET XBOOL_VECTOR
 
 #define CATEGORY_SET_P(x) \
-  (BOOL_VECTOR_P ((x)) && (EMACS_INT) (XBOOL_VECTOR ((x))->size) == 128)
+  (BOOL_VECTOR_P (x) && XBOOL_VECTOR (x)->size == 128)
 
 /* Return a new empty category set.  */
 #define MAKE_CATEGORY_SET (Fmake_bool_vector (make_number (128), Qnil))

=== modified file 'src/coding.c'
--- a/src/coding.c      2011-06-14 18:57:19 +0000
+++ b/src/coding.c      2011-06-19 18:44:09 +0000
@@ -9442,7 +9442,7 @@
 make_subsidiaries (Lisp_Object base)
 {
   Lisp_Object subsidiaries;
-  int base_name_len = SBYTES (SYMBOL_NAME (base));
+  ptrdiff_t base_name_len = SBYTES (SYMBOL_NAME (base));
   char *buf = (char *) alloca (base_name_len + 6);
   int i;
 
@@ -9450,7 +9450,7 @@
   subsidiaries = Fmake_vector (make_number (3), Qnil);
   for (i = 0; i < 3; i++)
     {
-      memcpy (buf + base_name_len, suffixes[i], strlen (suffixes[i]) + 1);
+      strcpy (buf + base_name_len, suffixes[i]);
       ASET (subsidiaries, i, intern (buf));
     }
   return subsidiaries;

=== modified file 'src/composite.c'
--- a/src/composite.c   2011-06-21 16:47:56 +0000
+++ b/src/composite.c   2011-06-22 16:01:00 +0000
@@ -285,7 +285,7 @@
       && VECTORP (AREF (components, 0)))
     {
       /* COMPONENTS is a glyph-string.  */
-      EMACS_UINT len = ASIZE (key);
+      EMACS_INT len = ASIZE (key);
 
       for (i = 1; i < len; i++)
        if (! VECTORP (AREF (key, i)))
@@ -293,7 +293,7 @@
     }
   else if (VECTORP (components) || CONSP (components))
     {
-      EMACS_UINT len = ASIZE (key);
+      EMACS_INT len = ASIZE (key);
 
       /* The number of elements should be odd.  */
       if ((len % 2) == 0)
@@ -673,13 +673,14 @@
   hash = h->hashfn (h, header);
   if (len < 0)
     {
-      EMACS_UINT j, glyph_len = LGSTRING_GLYPH_LEN (gstring);
+      EMACS_INT j, glyph_len = LGSTRING_GLYPH_LEN (gstring);
       for (j = 0; j < glyph_len; j++)
        if (NILP (LGSTRING_GLYPH (gstring, j)))
          break;
       len = j;
     }
 
+  lint_assume (len <= TYPE_MAXIMUM (EMACS_INT) - 2);
   copy = Fmake_vector (make_number (len + 2), Qnil);
   LGSTRING_SET_HEADER (copy, Fcopy_sequence (header));
   for (i = 0; i < len; i++)
@@ -705,7 +706,7 @@
 composition_gstring_p (Lisp_Object gstring)
 {
   Lisp_Object header;
-  int i;
+  EMACS_INT i;
 
   if (! VECTORP (gstring) || ASIZE (gstring) < 2)
     return 0;
@@ -1252,7 +1253,7 @@
     {
       Lisp_Object lgstring = Qnil;
       Lisp_Object val, elt;
-      int i;
+      EMACS_INT i;
 
       val = CHAR_TABLE_REF (Vcomposition_function_table, cmp_it->ch);
       for (i = 0; i < cmp_it->rule_idx; i++, val = XCDR (val));
@@ -1684,9 +1685,8 @@
 EMACS_INT
 composition_adjust_point (EMACS_INT last_pt, EMACS_INT new_pt)
 {
-  EMACS_INT beg, end;
+  EMACS_INT i, beg, end;
   Lisp_Object val;
-  int i;
 
   if (new_pt == BEGV || new_pt == ZV)
     return new_pt;

=== modified file 'src/data.c'
--- a/src/data.c        2011-06-14 18:57:19 +0000
+++ b/src/data.c        2011-06-19 18:44:58 +0000
@@ -703,7 +703,7 @@
   const char *name;
   CHECK_SUBR (subr);
   name = XSUBR (subr)->symbol_name;
-  return make_string (name, strlen (name));
+  return build_string (name);
 }
 
 DEFUN ("interactive-form", Finteractive_form, Sinteractive_form, 1, 1, 0,

=== modified file 'src/dbusbind.c'
--- a/src/dbusbind.c    2011-06-14 18:57:19 +0000
+++ b/src/dbusbind.c    2011-06-19 18:32:55 +0000
@@ -111,13 +111,12 @@
 /* Raise a Lisp error from a D-Bus ERROR.  */
 #define XD_ERROR(error)                                                        
\
   do {                                                                 \
-    char s[1024];                                                      \
-    strncpy (s, error.message, 1023);                                  \
+    /* Remove the trailing newline.  */                                        
\
+    char const *mess = error.message;                                  \
+    char const *nl = strchr (mess, '\n');                              \
+    Lisp_Object err = make_string (mess, nl ? nl - mess : strlen (mess)); \
     dbus_error_free (&error);                                          \
-    /* Remove the trailing newline.  */                                        
\
-    if (strchr (s, '\n') != NULL)                                      \
-      s[strlen (s) - 1] = '\0';                                                
\
-    XD_SIGNAL1 (build_string (s));                                     \
+    XD_SIGNAL1 (err);                                                  \
   } while (0)
 
 /* Macros for debugging.  In order to enable them, build with
@@ -126,7 +125,7 @@
 #define XD_DEBUG_MESSAGE(...)          \
   do {                                 \
     char s[1024];                      \
-    snprintf (s, 1023, __VA_ARGS__);   \
+    snprintf (s, sizeof s, __VA_ARGS__); \
     printf ("%s: %s\n", __func__, s);  \
     message ("%s: %s", __func__, s);   \
   } while (0)

=== modified file 'src/dispextern.h'
--- a/src/dispextern.h  2011-06-13 05:15:27 +0000
+++ b/src/dispextern.h  2011-06-22 06:16:16 +0000
@@ -1532,12 +1532,12 @@
 
   /* Background stipple or bitmap used for this face.  This is
      an id as returned from load_pixmap.  */
-  int stipple;
+  ptrdiff_t stipple;
 
 #else /* not HAVE_WINDOW_SYSTEM */
 
   /* Dummy.  */
-  int stipple;
+  ptrdiff_t stipple;
 
 #endif /* not HAVE_WINDOW_SYSTEM */
 
@@ -2183,7 +2183,7 @@
      be set at the same time as n_overlay_strings.  It is needed
      because we show before-strings at the start of invisible text;
      see handle_invisible_prop in xdisp.c.  */
-  int overlay_strings_charpos;
+  EMACS_INT overlay_strings_charpos;
 
   /* Vector of overlays to process.  Overlay strings are processed
      OVERLAY_STRING_CHUNK_SIZE at a time.  */
@@ -2259,7 +2259,7 @@
 
   /* -1 means selective display hides everything between a \r and the
      next newline; > 0 means hide lines indented more than that value.  */
-  int selective;
+  EMACS_INT selective;
 
   /* An enumeration describing what the next display element is
      after a call to get_next_display_element.  */
@@ -3082,21 +3082,21 @@
 
 #ifdef HAVE_WINDOW_SYSTEM
 
-extern int x_bitmap_height (struct frame *, int);
-extern int x_bitmap_width (struct frame *, int);
-extern int x_bitmap_pixmap (struct frame *, int);
+extern int x_bitmap_height (struct frame *, ptrdiff_t);
+extern int x_bitmap_width (struct frame *, ptrdiff_t);
+extern int x_bitmap_pixmap (struct frame *, ptrdiff_t);
 extern void x_reference_bitmap (struct frame *, int);
-extern int x_create_bitmap_from_data (struct frame *, char *,
-                                      unsigned int, unsigned int);
-extern int x_create_bitmap_from_file (struct frame *, Lisp_Object);
+extern ptrdiff_t x_create_bitmap_from_data (struct frame *, char *,
+                                           unsigned int, unsigned int);
+extern ptrdiff_t x_create_bitmap_from_file (struct frame *, Lisp_Object);
 #if defined HAVE_XPM && defined HAVE_X_WINDOWS && !defined USE_GTK
-extern int x_create_bitmap_from_xpm_data (struct frame *f, const char **bits);
+extern ptrdiff_t x_create_bitmap_from_xpm_data (struct frame *, const char **);
 #endif
 #ifndef x_destroy_bitmap
-extern void x_destroy_bitmap (struct frame *, int);
+extern void x_destroy_bitmap (struct frame *, ptrdiff_t);
 #endif
 extern void x_destroy_all_bitmaps (Display_Info *);
-extern int x_create_bitmap_mask (struct frame * , int);
+extern int x_create_bitmap_mask (struct frame *, ptrdiff_t);
 extern Lisp_Object x_find_image_file (Lisp_Object);
 
 void x_kill_gs_process (Pixmap, struct frame *);

=== modified file 'src/editfns.c'
--- a/src/editfns.c     2011-06-16 17:44:43 +0000
+++ b/src/editfns.c     2011-06-21 21:32:10 +0000
@@ -86,21 +86,7 @@
 
 static void time_overflow (void) NO_RETURN;
 static int tm_diff (struct tm *, struct tm *);
-static void find_field (Lisp_Object, Lisp_Object, Lisp_Object,
-                       EMACS_INT *, Lisp_Object, EMACS_INT *);
 static void update_buffer_properties (EMACS_INT, EMACS_INT);
-static Lisp_Object region_limit (int);
-static size_t emacs_nmemftime (char *, size_t, const char *,
-                              size_t, const struct tm *, int, int);
-static void general_insert_function (void (*) (const char *, EMACS_INT),
-                                    void (*) (Lisp_Object, EMACS_INT,
-                                              EMACS_INT, EMACS_INT,
-                                              EMACS_INT, int),
-                                    int, ptrdiff_t, Lisp_Object *);
-static Lisp_Object subst_char_in_region_unwind (Lisp_Object);
-static Lisp_Object subst_char_in_region_unwind_1 (Lisp_Object);
-static void transpose_markers (EMACS_INT, EMACS_INT, EMACS_INT, EMACS_INT,
-                              EMACS_INT, EMACS_INT, EMACS_INT, EMACS_INT);
 
 static Lisp_Object Qbuffer_access_fontify_functions;
 static Lisp_Object Fuser_full_name (Lisp_Object);
@@ -345,13 +331,13 @@
    Return the number found, and store them in a vector in VEC
    of length LEN.  */
 
-static int
-overlays_around (EMACS_INT pos, Lisp_Object *vec, int len)
+static ptrdiff_t
+overlays_around (EMACS_INT pos, Lisp_Object *vec, ptrdiff_t len)
 {
   Lisp_Object overlay, start, end;
   struct Lisp_Overlay *tail;
   EMACS_INT startpos, endpos;
-  int idx = 0;
+  ptrdiff_t idx = 0;
 
   for (tail = current_buffer->overlays_before; tail; tail = tail->next)
     {
@@ -419,7 +405,7 @@
   else
     {
       EMACS_INT posn = XINT (position);
-      int noverlays;
+      ptrdiff_t noverlays;
       Lisp_Object *overlay_vec, tem;
       struct buffer *obuf = current_buffer;
 

=== modified file 'src/emacs.c'
--- a/src/emacs.c       2011-06-04 18:29:18 +0000
+++ b/src/emacs.c       2011-06-19 18:37:51 +0000
@@ -585,7 +585,7 @@
           int minlen, char **valptr, int *skipptr)
 {
   char *p = NULL;
-  int arglen;
+  ptrdiff_t arglen;
   char *arg;
 
   /* Don't access argv[argc]; give up in advance.  */
@@ -1087,7 +1087,7 @@
         dname_arg2[0] = '\0';
         sscanf (dname_arg, "\n%d,%d\n%s", &(daemon_pipe[0]), &(daemon_pipe[1]),
                 dname_arg2);
-        dname_arg = strlen (dname_arg2) ? dname_arg2 : NULL;
+        dname_arg = *dname_arg2 ? dname_arg2 : NULL;
       }
 #endif /* NS_IMPL_COCOA */
 
@@ -1846,8 +1846,7 @@
       priority[from] = 0;
       if (argv[from][0] == '-')
        {
-         int match, thislen;
-         char *equals;
+         int match;
 
          /* If we have found "--", don't consider
             any more arguments as options.  */
@@ -1879,11 +1878,11 @@
             >= 0 (the table index of the match) if just one match so far.  */
          if (argv[from][1] == '-')
            {
+             char const *equals = strchr (argv[from], '=');
+             ptrdiff_t thislen =
+               equals ? equals - argv[from] : strlen (argv[from]);
+
              match = -1;
-             thislen = strlen (argv[from]);
-             equals = strchr (argv[from], '=');
-             if (equals != 0)
-               thislen = equals - argv[from];
 
              for (i = 0;
                   i < sizeof (standard_args) / sizeof (standard_args[0]); i++)

=== modified file 'src/fileio.c'
--- a/src/fileio.c      2011-06-16 21:18:12 +0000
+++ b/src/fileio.c      2011-06-19 19:06:16 +0000
@@ -440,11 +440,9 @@
 static char *
 file_name_as_directory (char *out, const char *in)
 {
-  int size = strlen (in) - 1;
-
-  strcpy (out, in);
-
-  if (size < 0)
+  ptrdiff_t len = strlen (in);
+
+  if (len == 0)
     {
       out[0] = '.';
       out[1] = '/';
@@ -452,11 +450,13 @@
       return out;
     }
 
+  strcpy (out, in);
+
   /* For Unix syntax, Append a slash if necessary */
-  if (!IS_DIRECTORY_SEP (out[size]))
+  if (!IS_DIRECTORY_SEP (out[len - 1]))
     {
-      out[size + 1] = DIRECTORY_SEP;
-      out[size + 2] = '\0';
+      out[len] = DIRECTORY_SEP;
+      out[len + 1] = '\0';
     }
 #ifdef DOS_NT
   dostounix_filename (out);
@@ -503,7 +503,7 @@
 static int
 directory_file_name (char *src, char *dst)
 {
-  long slen;
+  ptrdiff_t slen;
 
   slen = strlen (src);
 
@@ -587,9 +587,9 @@
 {
   Lisp_Object val;
   int len, clen;
-  int pid;
+  intmax_t pid;
   char *p, *data;
-  char pidbuf[20];
+  char pidbuf[INT_BUFSIZE_BOUND (pid_t)];
   int pidlen;
 
   CHECK_STRING (prefix);
@@ -599,7 +599,7 @@
      three are incremented if the file already exists.  This ensures
      262144 unique file names per PID per PREFIX.  */
 
-  pid = (int) getpid ();
+  pid = getpid ();
 
   if (base64_p)
     {
@@ -611,8 +611,7 @@
   else
     {
 #ifdef HAVE_LONG_FILE_NAMES
-      sprintf (pidbuf, "%d", pid);
-      pidlen = strlen (pidbuf);
+      pidlen = sprintf (pidbuf, "%"PRIdMAX, pid);
 #else
       pidbuf[0] = make_temp_name_tbl[pid & 63], pid >>= 6;
       pidbuf[1] = make_temp_name_tbl[pid & 63], pid >>= 6;
@@ -737,14 +736,14 @@
   /* This should only point to alloca'd data.  */
   char *target;
 
-  int tlen;
+  ptrdiff_t tlen;
   struct passwd *pw;
 #ifdef DOS_NT
   int drive = 0;
   int collapse_newdir = 1;
   int is_escaped = 0;
 #endif /* DOS_NT */
-  int length;
+  ptrdiff_t length;
   Lisp_Object handler, result;
   int multibyte;
   Lisp_Object hdir;
@@ -1314,7 +1313,7 @@
   unsigned char *nm;
 
   register unsigned char *newdir, *p, *o;
-  int tlen;
+  ptrdiff_t tlen;
   unsigned char *target;
   struct passwd *pw;
   int lose;
@@ -1366,7 +1365,7 @@
        unsigned char *user = nm + 1;
        /* Find end of name. */
        unsigned char *ptr = (unsigned char *) strchr (user, '/');
-       int len = ptr ? ptr - user : strlen (user);
+       ptrdiff_t len = ptr ? ptr - user : strlen (user);
        /* Copy the user name into temp storage. */
        o = (unsigned char *) alloca (len + 1);
        memcpy (o, user, len);
@@ -1672,7 +1671,7 @@
        else
          {
            Lisp_Object orig, decoded;
-           int orig_length, decoded_length;
+           ptrdiff_t orig_length, decoded_length;
            orig_length = strlen (o);
            orig = make_unibyte_string (o, orig_length);
            decoded = DECODE_FILE (orig);

=== modified file 'src/filelock.c'
--- a/src/filelock.c    2011-04-14 05:04:02 +0000
+++ b/src/filelock.c    2011-06-20 03:11:40 +0000
@@ -168,7 +168,7 @@
   /* If we did not find a boot time in wtmp, look at wtmp, and so on.  */
   for (counter = 0; counter < 20 && ! boot_time; counter++)
     {
-      char cmd_string[100];
+      char cmd_string[sizeof WTMP_FILE ".19.gz"];
       Lisp_Object tempname, filename;
       int delete_flag = 0;
 
@@ -191,19 +191,16 @@
                 character long prefix, and call make_temp_file with
                 second arg non-zero, so that it will add not more
                 than 6 characters to the prefix.  */
-             tempname = Fexpand_file_name (build_string ("wt"),
+             filename = Fexpand_file_name (build_string ("wt"),
                                            Vtemporary_file_directory);
-             tempname = make_temp_name (tempname, 1);
-             args[0] = Vshell_file_name;
+             filename = make_temp_name (filename, 1);
+             args[0] = build_string ("gzip");
              args[1] = Qnil;
-             args[2] = Qnil;
+             args[2] = list2 (QCfile, filename);
              args[3] = Qnil;
-             args[4] = build_string ("-c");
-             sprintf (cmd_string, "gunzip < %s.%d.gz > %s",
-                      WTMP_FILE, counter, SDATA (tempname));
-             args[5] = build_string (cmd_string);
+             args[4] = build_string ("-cd");
+             args[5] = tempname;
              Fcall_process (6, args);
-             filename = tempname;
              delete_flag = 1;
            }
        }
@@ -284,14 +281,10 @@
 {
   char *user;
   char *host;
-  unsigned long pid;
+  pid_t pid;
   time_t boot_time;
 } lock_info_type;
 
-/* When we read the info back, we might need this much more,
-   enough for decimal representation plus null.  */
-#define LOCK_PID_MAX (4 * sizeof (unsigned long))
-
 /* Free the two dynamically-allocated pieces in PTR.  */
 #define FREE_LOCK_INFO(i) do { xfree ((i).user); xfree ((i).host); } while (0)
 
@@ -344,7 +337,7 @@
 lock_file_1 (char *lfname, int force)
 {
   register int err;
-  time_t boot;
+  intmax_t boot, pid;
   const char *user_name;
   const char *host_name;
   char *lock_info_str;
@@ -361,14 +354,16 @@
   else
     host_name = "";
   lock_info_str = (char *)alloca (strlen (user_name) + strlen (host_name)
-                                 + LOCK_PID_MAX + 30);
+                                 + 2 * INT_STRLEN_BOUND (intmax_t)
+                                 + sizeof "@.:");
+  pid = getpid ();
 
   if (boot)
-    sprintf (lock_info_str, "address@hidden:%lu", user_name, host_name,
-            (unsigned long) getpid (), (unsigned long) boot);
+    sprintf (lock_info_str, "address@hidden"PRIdMAX":%"PRIdMAX,
+            user_name, host_name, pid, boot);
   else
-    sprintf (lock_info_str, "address@hidden", user_name, host_name,
-            (unsigned long) getpid ());
+    sprintf (lock_info_str, "address@hidden"PRIdMAX,
+            user_name, host_name, pid);
 
   err = symlink (lock_info_str, lfname);
   if (errno == EEXIST && force)
@@ -397,8 +392,9 @@
 current_lock_owner (lock_info_type *owner, char *lfname)
 {
   int ret;
-  size_t len;
-  int local_owner = 0;
+  ptrdiff_t len;
+  lock_info_type local_owner;
+  intmax_t n;
   char *at, *dot, *colon;
   char readlink_buf[READLINK_BUFSIZE];
   char *lfinfo = emacs_readlink (lfname, readlink_buf);
@@ -408,12 +404,9 @@
     return errno == ENOENT ? 0 : -1;
 
   /* Even if the caller doesn't want the owner info, we still have to
-     read it to determine return value, so allocate it.  */
+     read it to determine return value.  */
   if (!owner)
-    {
-      owner = (lock_info_type *) alloca (sizeof (lock_info_type));
-      local_owner = 1;
-    }
+    owner = &local_owner;
 
   /* Parse address@hidden:BOOT_TIME.  If can't parse, return -1.  */
   /* The USER is everything before the last @.  */
@@ -427,24 +420,34 @@
     }
   len = at - lfinfo;
   owner->user = (char *) xmalloc (len + 1);
-  strncpy (owner->user, lfinfo, len);
+  memcpy (owner->user, lfinfo, len);
   owner->user[len] = 0;
 
   /* The PID is everything from the last `.' to the `:'.  */
-  owner->pid = atoi (dot + 1);
-  colon = dot;
-  while (*colon && *colon != ':')
-    colon++;
+  errno = 0;
+  n = strtoimax (dot + 1, NULL, 10);
+  owner->pid =
+    ((0 <= n && n <= TYPE_MAXIMUM (pid_t)
+      && (TYPE_MAXIMUM (pid_t) < INTMAX_MAX || errno != ERANGE))
+     ? n : 0);
+
+  colon = strchr (dot + 1, ':');
   /* After the `:', if there is one, comes the boot time.  */
-  if (*colon == ':')
-    owner->boot_time = atoi (colon + 1);
-  else
-    owner->boot_time = 0;
+  n = 0;
+  if (colon)
+    {
+      errno = 0;
+      n = strtoimax (colon + 1, NULL, 10);
+    }
+  owner->boot_time =
+    ((0 <= n && n <= TYPE_MAXIMUM (time_t)
+      && (TYPE_MAXIMUM (time_t) < INTMAX_MAX || errno != ERANGE))
+     ? n : 0);
 
   /* The host is everything in between.  */
   len = dot - at - 1;
   owner->host = (char *) xmalloc (len + 1);
-  strncpy (owner->host, at + 1, len);
+  memcpy (owner->host, at + 1, len);
   owner->host[len] = 0;
 
   /* We're done looking at the link info.  */
@@ -476,7 +479,7 @@
     }
 
   /* Avoid garbage.  */
-  if (local_owner || ret <= 0)
+  if (owner == &local_owner || ret <= 0)
     {
       FREE_LOCK_INFO (*owner);
     }
@@ -539,6 +542,7 @@
   register Lisp_Object attack, orig_fn, encoded_fn;
   register char *lfname, *locker;
   lock_info_type lock_info;
+  intmax_t pid;
   struct gcpro gcpro1;
 
   /* Don't do locking while dumping Emacs.
@@ -577,9 +581,10 @@
 
   /* Else consider breaking the lock */
   locker = (char *) alloca (strlen (lock_info.user) + strlen (lock_info.host)
-                           + LOCK_PID_MAX + 9);
-  sprintf (locker, "address@hidden (pid %lu)", lock_info.user, lock_info.host,
-           lock_info.pid);
+                           + INT_STRLEN_BOUND (intmax_t) + sizeof "@ (pid )");
+  pid = lock_info.pid;
+  sprintf (locker, "address@hidden (pid %"PRIdMAX")",
+          lock_info.user, lock_info.host, pid);
   FREE_LOCK_INFO (lock_info);
 
   attack = call2 (intern ("ask-user-about-lock"), fn, build_string (locker));

=== modified file 'src/fns.c'
--- a/src/fns.c 2011-06-21 16:47:56 +0000
+++ b/src/fns.c 2011-06-22 16:01:00 +0000
@@ -23,6 +23,8 @@
 #include <time.h>
 #include <setjmp.h>
 
+#include <intprops.h>
+
 #include "lisp.h"
 #include "commands.h"
 #include "character.h"
@@ -567,8 +569,8 @@
        }
 
       result_len += len;
-      if (result_len < 0)
-       error ("String overflow");
+      if (STRING_BYTES_BOUND < result_len)
+       string_overflow ();
     }
 
   if (! some_multibyte)
@@ -2141,7 +2143,6 @@
   (Lisp_Object array, Lisp_Object item)
 {
   register EMACS_INT size, idx;
-  int charval;
 
   if (VECTORP (array))
     {
@@ -2161,27 +2162,21 @@
   else if (STRINGP (array))
     {
       register unsigned char *p = SDATA (array);
-      CHECK_NUMBER (item);
-      charval = XINT (item);
+      int charval;
+      CHECK_CHARACTER (item);
+      charval = XFASTINT (item);
       size = SCHARS (array);
       if (STRING_MULTIBYTE (array))
        {
          unsigned char str[MAX_MULTIBYTE_LENGTH];
          int len = CHAR_STRING (charval, str);
          EMACS_INT size_byte = SBYTES (array);
-         unsigned char *p1 = p, *endp = p + size_byte;
-         int i;
 
-         if (size != size_byte)
-           while (p1 < endp)
-             {
-               int this_len = BYTES_BY_CHAR_HEAD (*p1);
-               if (len != this_len)
-                 error ("Attempt to change byte length of a string");
-               p1 += this_len;
-             }
-         for (i = 0; i < size_byte; i++)
-           *p++ = str[i % len];
+         if (INT_MULTIPLY_OVERFLOW (SCHARS (array), len)
+             || SCHARS (array) * len != size_byte)
+           error ("Attempt to change byte length of a string");
+         for (idx = 0; idx < size_byte; idx++)
+           *p++ = str[idx % len];
        }
       else
        for (idx = 0; idx < size; idx++)
@@ -2190,19 +2185,18 @@
   else if (BOOL_VECTOR_P (array))
     {
       register unsigned char *p = XBOOL_VECTOR (array)->data;
-      int size_in_chars
-       = ((XBOOL_VECTOR (array)->size + BOOL_VECTOR_BITS_PER_CHAR - 1)
+      EMACS_INT size_in_chars;
+      size = XBOOL_VECTOR (array)->size;
+      size_in_chars
+       = ((size + BOOL_VECTOR_BITS_PER_CHAR - 1)
           / BOOL_VECTOR_BITS_PER_CHAR);
 
-      charval = (! NILP (item) ? -1 : 0);
-      for (idx = 0; idx < size_in_chars - 1; idx++)
-       p[idx] = charval;
-      if (idx < size_in_chars)
+      if (size_in_chars)
        {
-         /* Mask out bits beyond the vector size.  */
-         if (XBOOL_VECTOR (array)->size % BOOL_VECTOR_BITS_PER_CHAR)
-           charval &= (1 << (XBOOL_VECTOR (array)->size % 
BOOL_VECTOR_BITS_PER_CHAR)) - 1;
-         p[idx] = charval;
+         memset (p, ! NILP (item) ? -1 : 0, size_in_chars);
+
+         /* Clear any extraneous bits in the last byte.  */
+         p[size_in_chars - 1] &= (1 << (size % BOOL_VECTOR_BITS_PER_CHAR)) - 1;
        }
     }
   else
@@ -2316,7 +2310,7 @@
     {
       for (i = 0; i < leni; i++)
        {
-         int byte;
+         unsigned char byte;
          byte = XBOOL_VECTOR (seq)->data[i / BOOL_VECTOR_BITS_PER_CHAR];
          dummy = (byte & (1 << (i % BOOL_VECTOR_BITS_PER_CHAR))) ? Qt : Qnil;
          dummy = call1 (fn, dummy);

=== modified file 'src/font.c'
--- a/src/font.c        2011-06-14 18:57:19 +0000
+++ b/src/font.c        2011-06-22 06:18:06 +0000
@@ -232,22 +232,35 @@
    STR.  */
 
 Lisp_Object
-font_intern_prop (const char *str, int len, int force_symbol)
+font_intern_prop (const char *str, ptrdiff_t len, int force_symbol)
 {
-  int i;
+  ptrdiff_t i;
   Lisp_Object tem;
   Lisp_Object obarray;
   EMACS_INT nbytes, nchars;
 
   if (len == 1 && *str == '*')
     return Qnil;
-  if (!force_symbol && len >=1 && isdigit (*str))
+  if (!force_symbol && 0 < len && '0' <= *str && *str <= '9')
     {
       for (i = 1; i < len; i++)
-       if (! isdigit (str[i]))
+       if (! ('0' <= str[i] && str[i] <= '9'))
          break;
       if (i == len)
-       return make_number (atoi (str));
+       {
+         EMACS_INT n;
+
+         i = 0;
+         for (n = 0; (n += str[i++] - '0') <= MOST_POSITIVE_FIXNUM; n *= 10)
+           {
+             if (i == len)
+               return make_number (n);
+             if (MOST_POSITIVE_FIXNUM / 10 < n)
+               break;
+           }
+
+         xsignal1 (Qoverflow_error, make_string (str, len));
+       }
     }
 
   /* The following code is copied from the function intern (in
@@ -982,7 +995,7 @@
 int
 font_parse_xlfd (char *name, Lisp_Object font)
 {
-  int len = strlen (name);
+  ptrdiff_t len = strlen (name);
   int i, j, n;
   char *f[XLFD_LAST_INDEX + 1];
   Lisp_Object val;
@@ -1310,7 +1323,7 @@
   char *p, *q;
   char *size_beg = NULL, *size_end = NULL;
   char *props_beg = NULL, *family_end = NULL;
-  int len = strlen (name);
+  ptrdiff_t len = strlen (name);
 
   if (len == 0)
     return -1;
@@ -1376,7 +1389,7 @@
              if (*q != '=')
                {
                  /* Must be an enumerated value.  */
-                 int word_len;
+                 ptrdiff_t word_len;
                  p = p + 1;
                  word_len = q - p;
                  val = font_intern_prop (p, q - p, 1);
@@ -1452,7 +1465,7 @@
       Lisp_Object weight = Qnil, slant = Qnil;
       Lisp_Object width  = Qnil, size  = Qnil;
       char *word_start;
-      int word_len;
+      ptrdiff_t word_len;
 
       /* Scan backwards from the end, looking for a size.  */
       for (p = name + len - 1; p >= name; p--)
@@ -1542,7 +1555,8 @@
   Lisp_Object family, foundry;
   Lisp_Object tail, val;
   int point_size;
-  int i, len = 1;
+  int i;
+  ptrdiff_t len = 1;
   char *p;
   Lisp_Object styles[3];
   const char *style_names[3] = { "weight", "slant", "width" };
@@ -2093,8 +2107,8 @@
     {
       /* We use the higher 6-bit for the actual size difference.  The
         lowest bit is set if the DPI is different.  */
-      int diff;
-      int pixel_size = XINT (spec_prop[FONT_SIZE_INDEX]);
+      EMACS_INT diff;
+      EMACS_INT pixel_size = XINT (spec_prop[FONT_SIZE_INDEX]);
 
       if (CONSP (Vface_font_rescale_alist))
        pixel_size *= font_rescale_ratio (entity);
@@ -4294,7 +4308,7 @@
 {
   struct font *font;
   Lisp_Object font_object, n, glyph;
-  int i, j, from, to;
+  EMACS_INT i, j, from, to;
 
   if (! composition_gstring_p (gstring))
     signal_error ("Invalid glyph-string: ", gstring);

=== modified file 'src/font.h'
--- a/src/font.h        2011-05-29 19:04:01 +0000
+++ b/src/font.h        2011-06-20 05:51:47 +0000
@@ -777,7 +777,8 @@
 extern Lisp_Object font_open_by_spec (FRAME_PTR f, Lisp_Object spec);
 extern Lisp_Object font_open_by_name (FRAME_PTR f, const char *name);
 
-extern Lisp_Object font_intern_prop (const char *str, int len, int 
force_symbol);
+extern Lisp_Object font_intern_prop (const char *str, ptrdiff_t len,
+                                    int force_symbol);
 extern void font_update_sort_order (int *order);
 
 extern void font_parse_family_registry (Lisp_Object family,

=== modified file 'src/ftfont.c'
--- a/src/ftfont.c      2011-06-10 19:31:15 +0000
+++ b/src/ftfont.c      2011-06-18 18:09:17 +0000
@@ -2385,8 +2385,8 @@
 ftfont_shape_by_flt (Lisp_Object lgstring, struct font *font,
                     FT_Face ft_face, OTF *otf, FT_Matrix *matrix)
 {
-  EMACS_UINT len = LGSTRING_GLYPH_LEN (lgstring);
-  EMACS_UINT i;
+  EMACS_INT len = LGSTRING_GLYPH_LEN (lgstring);
+  EMACS_INT i;
   struct MFLTFontFT flt_font_ft;
   MFLT *flt = NULL;
   int with_variation_selector = 0;
@@ -2412,7 +2412,10 @@
       if (CHAR_VARIATION_SELECTOR_P (c))
        with_variation_selector++;
     }
+
   len = i;
+  lint_assume (len <= TYPE_MAXIMUM (EMACS_INT) - 2);
+
   if (with_variation_selector)
     {
       setup_otf_gstring (len);

=== modified file 'src/gtkutil.c'
--- a/src/gtkutil.c     2011-06-14 21:08:20 +0000
+++ b/src/gtkutil.c     2011-06-20 05:54:33 +0000
@@ -1015,7 +1015,7 @@
 
   EVENT_INIT (event);
   event.kind = CONFIG_CHANGED_EVENT;
-  event.frame_or_window = make_string (display_name, strlen (display_name));
+  event.frame_or_window = build_string (display_name);
   /* Theme doesn't change often, so intern is called seldom.  */
   event.arg = intern ("theme-name");
   kbd_buffer_store_event (&event);
@@ -1024,7 +1024,7 @@
 
   /* If scroll bar width changed, we need set the new size on all frames
      on this display.  */
-  if (dpy) 
+  if (dpy)
     {
       Lisp_Object rest, frame;
       FOR_EACH_FRAME (rest, frame)

=== modified file 'src/image.c'
--- a/src/image.c       2011-06-22 12:23:17 +0000
+++ b/src/image.c       2011-06-22 16:01:00 +0000
@@ -182,20 +182,20 @@
 /* Functions to access the contents of a bitmap, given an id.  */
 
 int
-x_bitmap_height (FRAME_PTR f, int id)
+x_bitmap_height (FRAME_PTR f, ptrdiff_t id)
 {
   return FRAME_X_DISPLAY_INFO (f)->bitmaps[id - 1].height;
 }
 
 int
-x_bitmap_width (FRAME_PTR f, int id)
+x_bitmap_width (FRAME_PTR f, ptrdiff_t id)
 {
   return FRAME_X_DISPLAY_INFO (f)->bitmaps[id - 1].width;
 }
 
 #if defined (HAVE_X_WINDOWS) || defined (HAVE_NTGUI)
 int
-x_bitmap_pixmap (FRAME_PTR f, int id)
+x_bitmap_pixmap (FRAME_PTR f, ptrdiff_t id)
 {
   return (int) FRAME_X_DISPLAY_INFO (f)->bitmaps[id - 1].pixmap;
 }
@@ -203,7 +203,7 @@
 
 #ifdef HAVE_X_WINDOWS
 int
-x_bitmap_mask (FRAME_PTR f, int id)
+x_bitmap_mask (FRAME_PTR f, ptrdiff_t id)
 {
   return FRAME_X_DISPLAY_INFO (f)->bitmaps[id - 1].mask;
 }
@@ -211,11 +211,11 @@
 
 /* Allocate a new bitmap record.  Returns index of new record.  */
 
-static int
+static ptrdiff_t
 x_allocate_bitmap_record (FRAME_PTR f)
 {
   Display_Info *dpyinfo = FRAME_X_DISPLAY_INFO (f);
-  int i;
+  ptrdiff_t i;
 
   if (dpyinfo->bitmaps == NULL)
     {
@@ -233,6 +233,9 @@
     if (dpyinfo->bitmaps[i].refcount == 0)
       return i + 1;
 
+  if (min (PTRDIFF_MAX, SIZE_MAX) / sizeof (Bitmap_Record) / 2
+      < dpyinfo->bitmaps_size)
+    memory_full (SIZE_MAX);
   dpyinfo->bitmaps_size *= 2;
   dpyinfo->bitmaps
     = (Bitmap_Record *) xrealloc (dpyinfo->bitmaps,
@@ -250,11 +253,11 @@
 
 /* Create a bitmap for frame F from a HEIGHT x WIDTH array of bits at BITS.  */
 
-int
+ptrdiff_t
 x_create_bitmap_from_data (struct frame *f, char *bits, unsigned int width, 
unsigned int height)
 {
   Display_Info *dpyinfo = FRAME_X_DISPLAY_INFO (f);
-  int id;
+  ptrdiff_t id;
 
 #ifdef HAVE_X_WINDOWS
   Pixmap bitmap;
@@ -309,7 +312,7 @@
 
 /* Create bitmap from file FILE for frame F.  */
 
-int
+ptrdiff_t
 x_create_bitmap_from_file (struct frame *f, Lisp_Object file)
 {
   Display_Info *dpyinfo = FRAME_X_DISPLAY_INFO (f);
@@ -319,7 +322,7 @@
 #endif /* HAVE_NTGUI */
 
 #ifdef HAVE_NS
-  int id;
+  ptrdiff_t id;
   void *bitmap = ns_image_from_file (file);
 
   if (!bitmap)
@@ -340,7 +343,8 @@
 #ifdef HAVE_X_WINDOWS
   unsigned int width, height;
   Pixmap bitmap;
-  int xhot, yhot, result, id;
+  int xhot, yhot, result;
+  ptrdiff_t id;
   Lisp_Object found;
   int fd;
   char *filename;
@@ -413,7 +417,7 @@
 /* Remove reference to bitmap with id number ID.  */
 
 void
-x_destroy_bitmap (FRAME_PTR f, int id)
+x_destroy_bitmap (FRAME_PTR f, ptrdiff_t id)
 {
   Display_Info *dpyinfo = FRAME_X_DISPLAY_INFO (f);
 
@@ -435,7 +439,7 @@
 void
 x_destroy_all_bitmaps (Display_Info *dpyinfo)
 {
-  int i;
+  ptrdiff_t i;
   Bitmap_Record *bm = dpyinfo->bitmaps;
 
   for (i = 0; i < dpyinfo->bitmaps_last; i++, bm++)
@@ -467,7 +471,7 @@
    It's nicer with some borders in this context */
 
 int
-x_create_bitmap_mask (struct frame *f, int id)
+x_create_bitmap_mask (struct frame *f, ptrdiff_t id)
 {
   Pixmap pixmap, mask;
   XImagePtr ximg, mask_img;
@@ -2308,7 +2312,7 @@
   else
     {
       Lisp_Object data;
-      int width, height;
+      EMACS_INT width, height;
 
       /* Entries for `:width', `:height' and `:data' must be present.  */
       if (!kw[XBM_WIDTH].count
@@ -2324,7 +2328,7 @@
         data.  */
       if (VECTORP (data))
        {
-         int i;
+         EMACS_INT i;
 
          /* Number of elements of the vector must be >= height.  */
          if (ASIZE (data) < height)
@@ -3282,11 +3286,12 @@
 #endif /* HAVE_XPM || HAVE_NS */
 
 #if defined HAVE_XPM && defined HAVE_X_WINDOWS && !defined USE_GTK
-int
+ptrdiff_t
 x_create_bitmap_from_xpm_data (struct frame *f, const char **bits)
 {
   Display_Info *dpyinfo = FRAME_X_DISPLAY_INFO (f);
-  int id, rc;
+  ptrdiff_t id;
+  int rc;
   XpmAttributes attrs;
   Pixmap bitmap, mask;
 
@@ -3590,25 +3595,14 @@
 /* XPM support functions for NS where libxpm is not available.
    Only XPM version 3 (without any extensions) is supported.  */
 
-static int xpm_scan (const unsigned char **, const unsigned char *,
-                     const unsigned char **, int *);
-static Lisp_Object xpm_make_color_table_v
-  (void (**) (Lisp_Object, const unsigned char *, int, Lisp_Object),
-   Lisp_Object (**) (Lisp_Object, const unsigned char *, int));
 static void xpm_put_color_table_v (Lisp_Object, const unsigned char *,
                                    int, Lisp_Object);
 static Lisp_Object xpm_get_color_table_v (Lisp_Object,
                                           const unsigned char *, int);
-static Lisp_Object xpm_make_color_table_h
-  (void (**) (Lisp_Object, const unsigned char *, int, Lisp_Object),
-   Lisp_Object (**) (Lisp_Object, const unsigned char *, int));
 static void xpm_put_color_table_h (Lisp_Object, const unsigned char *,
                                    int, Lisp_Object);
 static Lisp_Object xpm_get_color_table_h (Lisp_Object,
                                           const unsigned char *, int);
-static int xpm_str_to_color_key (const char *);
-static int xpm_load_image (struct frame *, struct image *,
-                           const unsigned char *, const unsigned char *);
 
 /* Tokens returned from xpm_scan.  */
 
@@ -3630,7 +3624,7 @@
 xpm_scan (const unsigned char **s,
           const unsigned char *end,
           const unsigned char **beg,
-          int *len)
+          ptrdiff_t *len)
 {
   int c;
 
@@ -3800,7 +3794,8 @@
   unsigned char buffer[BUFSIZ];
   int width, height, x, y;
   int num_colors, chars_per_pixel;
-  int len, LA1;
+  ptrdiff_t len;
+  int LA1;
   void (*put_color_table) (Lisp_Object, const unsigned char *, int, 
Lisp_Object);
   Lisp_Object (*get_color_table) (Lisp_Object, const unsigned char *, int);
   Lisp_Object frame, color_symbols, color_table;

=== modified file 'src/indent.c'
--- a/src/indent.c      2011-06-07 09:26:21 +0000
+++ b/src/indent.c      2011-06-18 18:29:19 +0000
@@ -318,6 +318,15 @@
   last_known_column_point = 0;
 }
 
+/* Return a non-outlandish value for the tab width.  */
+
+static int
+sane_tab_width (void)
+{
+  EMACS_INT n = XFASTINT (BVAR (current_buffer, tab_width));
+  return 0 < n && n <= 1000 ? n : 8;
+}
+
 EMACS_INT
 current_column (void)
 {
@@ -326,7 +335,7 @@
   register int tab_seen;
   EMACS_INT post_tab;
   register int c;
-  register EMACS_INT tab_width = XINT (BVAR (current_buffer, tab_width));
+  int tab_width = sane_tab_width ();
   int ctl_arrow = !NILP (BVAR (current_buffer, ctl_arrow));
   register struct Lisp_Char_Table *dp = buffer_display_table ();
 
@@ -356,9 +365,6 @@
   else
     stop = GAP_END_ADDR;
 
-  if (tab_width <= 0 || tab_width > 1000)
-    tab_width = 8;
-
   col = 0, tab_seen = 0, post_tab = 0;
 
   while (1)
@@ -509,7 +515,7 @@
 static void
 scan_for_column (EMACS_INT *endpos, EMACS_INT *goalcol, EMACS_INT *prevcol)
 {
-  register EMACS_INT tab_width = XINT (BVAR (current_buffer, tab_width));
+  int tab_width = sane_tab_width ();
   register int ctl_arrow = !NILP (BVAR (current_buffer, ctl_arrow));
   register struct Lisp_Char_Table *dp = buffer_display_table ();
   int multibyte = !NILP (BVAR (current_buffer, enable_multibyte_characters));
@@ -535,7 +541,6 @@
   window = Fget_buffer_window (Fcurrent_buffer (), Qnil);
   w = ! NILP (window) ? XWINDOW (window) : NULL;
 
-  if (tab_width <= 0 || tab_width > 1000) tab_width = 8;
   memset (&cmp_it, 0, sizeof cmp_it);
   cmp_it.id = -1;
   composition_compute_stop_pos (&cmp_it, scan, scan_byte, end, Qnil);
@@ -728,7 +733,7 @@
   register int tab_seen;
   int post_tab;
   register int c;
-  register int tab_width = XINT (current_buffer->tab_width);
+  int tab_width = sane_tab_width ();
   int ctl_arrow = !NILP (current_buffer->ctl_arrow);
   register struct Lisp_Char_Table *dp = buffer_display_table ();
   int b, e;
@@ -755,8 +760,6 @@
      going backwards from point.  */
   stop = SDATA (string) + b;
 
-  if (tab_width <= 0 || tab_width > 1000) tab_width = 8;
-
   col = 0, tab_seen = 0, post_tab = 0;
 
   while (1)
@@ -806,7 +809,7 @@
 {
   EMACS_INT mincol;
   register EMACS_INT fromcol;
-  register EMACS_INT tab_width = XINT (BVAR (current_buffer, tab_width));
+  int tab_width = sane_tab_width ();
 
   CHECK_NUMBER (column);
   if (NILP (minimum))
@@ -820,8 +823,6 @@
   if (fromcol == mincol)
     return make_number (mincol);
 
-  if (tab_width <= 0 || tab_width > 1000) tab_width = 8;
-
   if (indent_tabs_mode)
     {
       Lisp_Object n;
@@ -867,15 +868,13 @@
 position_indentation (register int pos_byte)
 {
   register EMACS_INT column = 0;
-  register EMACS_INT tab_width = XINT (BVAR (current_buffer, tab_width));
+  int tab_width = sane_tab_width ();
   register unsigned char *p;
   register unsigned char *stop;
   unsigned char *start;
   EMACS_INT next_boundary_byte = pos_byte;
   EMACS_INT ceiling = next_boundary_byte;
 
-  if (tab_width <= 0 || tab_width > 1000) tab_width = 8;
-
   p = BYTE_POS_ADDR (pos_byte);
   /* STOP records the value of P at which we will need
      to think about the gap, or about invisible text,
@@ -1118,7 +1117,7 @@
   register EMACS_INT pos;
   EMACS_INT pos_byte;
   register int c = 0;
-  register EMACS_INT tab_width = XFASTINT (BVAR (current_buffer, tab_width));
+  int tab_width = sane_tab_width ();
   register int ctl_arrow = !NILP (BVAR (current_buffer, ctl_arrow));
   register struct Lisp_Char_Table *dp = window_display_table (win);
   EMACS_INT selective
@@ -1173,9 +1172,6 @@
        run cache, because that's based on the buffer's display table.  */
     width_table = 0;
 
-  if (tab_width <= 0 || tab_width > 1000)
-    tab_width = 8;
-
   /* Negative width means use all available text columns.  */
   if (width < 0)
     {
@@ -1747,7 +1743,7 @@
   struct window *w;
   Lisp_Object bufpos, hpos, vpos, prevhpos;
   struct position *pos;
-  int hscroll, tab_offset;
+  EMACS_INT hscroll, tab_offset;
 
   CHECK_NUMBER_COERCE_MARKER (from);
   CHECK_CONS (frompos);

=== modified file 'src/insdel.c'
--- a/src/insdel.c      2011-06-16 21:18:12 +0000
+++ b/src/insdel.c      2011-06-18 18:28:32 +0000
@@ -44,12 +44,6 @@
                                  int inherit);
 static void gap_left (EMACS_INT charpos, EMACS_INT bytepos, int newgap);
 static void gap_right (EMACS_INT charpos, EMACS_INT bytepos);
-static void adjust_markers_for_insert (EMACS_INT from, EMACS_INT from_byte,
-                                      EMACS_INT to, EMACS_INT to_byte,
-                                      int before_markers);
-static void adjust_markers_for_replace (EMACS_INT, EMACS_INT, EMACS_INT,
-                                       EMACS_INT, EMACS_INT, EMACS_INT);
-static void adjust_point (EMACS_INT nchars, EMACS_INT nbytes);
 
 static Lisp_Object Fcombine_after_change_execute (void);
 

=== modified file 'src/keyboard.c'
--- a/src/keyboard.c    2011-06-14 18:57:19 +0000
+++ b/src/keyboard.c    2011-06-20 06:07:16 +0000
@@ -8225,7 +8225,7 @@
           /* `:label LABEL-STRING'.  */
           PROP (TOOL_BAR_ITEM_LABEL) = STRINGP (value)
             ? value
-            : make_string (bad_label, strlen (bad_label));
+            : build_string (bad_label);
           have_label = 1;
         }
       else if (EQ (ikey, QCfilter))
@@ -8291,7 +8291,7 @@
       else
        label = "";
 
-      new_lbl = Fupcase_initials (make_string (label, strlen (label)));
+      new_lbl = Fupcase_initials (build_string (label));
       if (SCHARS (new_lbl) <= tool_bar_max_label_size)
         PROP (TOOL_BAR_ITEM_LABEL) = new_lbl;
       else

=== modified file 'src/lisp.h'
--- a/src/lisp.h        2011-06-16 22:50:46 +0000
+++ b/src/lisp.h        2011-06-22 06:16:16 +0000
@@ -291,7 +291,7 @@
   {
     /* Used for comparing two Lisp_Objects;
        also, positive integers can be accessed fast this way.  */
-    EMACS_UINT i;
+    EMACS_INT i;
 
     struct
       {
@@ -315,7 +315,7 @@
   {
     /* Used for comparing two Lisp_Objects;
        also, positive integers can be accessed fast this way.  */
-    EMACS_UINT i;
+    EMACS_INT i;
 
     struct
       {
@@ -494,8 +494,8 @@
 #ifdef USE_LSB_TAG
 
 # define XSET(var, vartype, ptr) \
-  (eassert ((((EMACS_UINT) (ptr)) & ((1 << GCTYPEBITS) - 1)) == 0),    \
-   (var).u.val = ((EMACS_UINT) (ptr)) >> GCTYPEBITS,                   \
+  (eassert ((((uintptr_t) (ptr)) & ((1 << GCTYPEBITS) - 1)) == 0),     \
+   (var).u.val = ((uintptr_t) (ptr)) >> GCTYPEBITS,                    \
    (var).u.type = ((char) (vartype)))
 
 /* Some versions of gcc seem to consider the bitfield width when issuing
@@ -512,7 +512,7 @@
 # define XSETFASTINT(a, b) ((a).i = (b))
 
 # define XSET(var, vartype, ptr) \
-   (((var).s.val = ((EMACS_INT) (ptr))), ((var).s.type = ((char) (vartype))))
+   (((var).s.val = ((intptr_t) (ptr))), ((var).s.type = ((char) (vartype))))
 
 #ifdef DATA_SEG_BITS
 /* DATA_SEG_BITS forces extra bits to be or'd in with any pointers
@@ -1013,7 +1013,7 @@
        just the subtype information.  */
     struct vectorlike_header header;
     /* This is the size in bits.  */
-    EMACS_UINT size;
+    EMACS_INT size;
     /* This contains the actual bits, packed into bytes.  */
     unsigned char data[1];
   };
@@ -1890,7 +1890,7 @@
 #define DEFUN(lname, fnname, sname, minargs, maxargs, intspec, doc) \
   Lisp_Object fnname DEFUN_ARGS_ ## maxargs ;                          \
   static DECL_ALIGN (struct Lisp_Subr, sname) =                                
\
-    { PVEC_SUBR | (sizeof (struct Lisp_Subr) / sizeof (EMACS_INT)),    \
+    { PVEC_SUBR,                                                       \
       { .a ## maxargs = fnname },                              \
       minargs, maxargs, lname, intspec, 0};                            \
   Lisp_Object fnname
@@ -2628,7 +2628,7 @@
 /* Defined in image.c */
 extern Lisp_Object QCascent, QCmargin, QCrelief;
 extern Lisp_Object QCconversion;
-extern int x_bitmap_mask (struct frame *, int);
+extern int x_bitmap_mask (struct frame *, ptrdiff_t);
 extern void syms_of_image (void);
 extern void init_image (void);
 
@@ -3590,29 +3590,19 @@
 
 #define SWITCH_ENUM_CAST(x) (x)
 
-/* Loop over Lisp list LIST.  Signal an error if LIST is not a proper
-   list, or if it contains circles.
-
-   HARE and TORTOISE should be the names of Lisp_Object variables, and
-   N should be the name of an EMACS_INT variable declared in the
-   function where the macro is used.  Each nested loop should use
-   its own variables.
-
-   In the loop body, HARE is set to each cons of LIST, and N is the
-   length of the list processed so far.  */
-
-#define LIST_END_P(list, obj)                          \
-  (NILP (obj)                                          \
-   ? 1                                                 \
-   : (CONSP (obj)                                      \
-      ? 0                                              \
-      : (wrong_type_argument (Qlistp, (list))), 1))
-
-/* Use this to suppress gcc's `...may be used before initialized' warnings. */
+/* Use this to suppress gcc's warnings. */
 #ifdef lint
+
+/* Use CODE only if lint checking is in effect.  */
 # define IF_LINT(Code) Code
+
+/* Assume that the expression COND is true.  This differs in intent
+   from 'assert', as it is a message from the programmer to the compiler.  */
+# define lint_assume(cond) ((cond) ? (void) 0 : abort ())
+
 #else
 # define IF_LINT(Code) /* empty */
+# define lint_assume(cond) ((void) (0 && (cond)))
 #endif
 
 /* The ubiquitous min and max macros.  */
@@ -3635,9 +3625,7 @@
    fixnum.  */
 
 #define make_fixnum_or_float(val) \
-   (FIXNUM_OVERFLOW_P (val) \
-    ? make_float (val) \
-    : make_number ((EMACS_INT)(val)))
+   (FIXNUM_OVERFLOW_P (val) ? make_float (val) : make_number (val))
 
 
 /* Checks the `cycle check' variable CHECK to see if it indicates that

=== modified file 'src/lread.c'
--- a/src/lread.c       2011-06-13 05:18:27 +0000
+++ b/src/lread.c       2011-06-20 06:11:36 +0000
@@ -158,7 +158,7 @@
 static Lisp_Object load_unwind (Lisp_Object);
 static Lisp_Object load_descriptor_unwind (Lisp_Object);
 
-static void invalid_syntax (const char *, int) NO_RETURN;
+static void invalid_syntax (const char *) NO_RETURN;
 static void end_of_file_error (void) NO_RETURN;
 
 
@@ -2014,11 +2014,9 @@
    S is error string of length N (if > 0)  */
 
 static void
-invalid_syntax (const char *s, int n)
+invalid_syntax (const char *s)
 {
-  if (!n)
-    n = strlen (s);
-  xsignal1 (Qinvalid_read_syntax, make_string (s, n));
+  xsignal1 (Qinvalid_read_syntax, build_string (s));
 }
 
 
@@ -2336,7 +2334,7 @@
   if (! valid)
     {
       sprintf (buf, "integer, radix %d", radix);
-      invalid_syntax (buf, 0);
+      invalid_syntax (buf);
     }
 
   return string_to_number (buf, radix, 0);
@@ -2453,7 +2451,7 @@
              return ht;
            }
          UNREAD (c);
-         invalid_syntax ("#", 1);
+         invalid_syntax ("#");
        }
       if (c == '^')
        {
@@ -2487,9 +2485,9 @@
                  XSETPVECTYPE (XVECTOR (tmp), PVEC_SUB_CHAR_TABLE);
                  return tmp;
                }
-             invalid_syntax ("#^^", 3);
+             invalid_syntax ("#^^");
            }
-         invalid_syntax ("#^", 2);
+         invalid_syntax ("#^");
        }
       if (c == '&')
        {
@@ -2513,7 +2511,7 @@
                         version.  */
                      && ! (XFASTINT (length)
                            == (SCHARS (tmp) - 1) * BOOL_VECTOR_BITS_PER_CHAR)))
-               invalid_syntax ("#&...", 5);
+               invalid_syntax ("#&...");
 
              val = Fmake_bool_vector (length, Qnil);
              memcpy (XBOOL_VECTOR (val)->data, SDATA (tmp), size_in_chars);
@@ -2523,7 +2521,7 @@
                  &= (1 << (XINT (length) % BOOL_VECTOR_BITS_PER_CHAR)) - 1;
              return val;
            }
-         invalid_syntax ("#&...", 5);
+         invalid_syntax ("#&...");
        }
       if (c == '[')
        {
@@ -2543,7 +2541,7 @@
          /* Read the string itself.  */
          tmp = read1 (readcharfun, &ch, 0);
          if (ch != 0 || !STRINGP (tmp))
-           invalid_syntax ("#", 1);
+           invalid_syntax ("#");
          GCPRO1 (tmp);
          /* Read the intervals and their properties.  */
          while (1)
@@ -2559,7 +2557,7 @@
              if (ch == 0)
                plist = read1 (readcharfun, &ch, 0);
              if (ch)
-               invalid_syntax ("Invalid string property list", 0);
+               invalid_syntax ("Invalid string property list");
              Fset_text_properties (beg, end, plist, tmp);
            }
          UNGCPRO;
@@ -2716,7 +2714,7 @@
        return read_integer (readcharfun, 2);
 
       UNREAD (c);
-      invalid_syntax ("#", 1);
+      invalid_syntax ("#");
 
     case ';':
       while ((c = READCHAR) >= 0 && c != '\n');
@@ -2833,7 +2831,7 @@
        if (ok)
          return make_number (c);
 
-       invalid_syntax ("?", 1);
+       invalid_syntax ("?");
       }
 
     case '"':
@@ -3335,7 +3333,7 @@
          /* Unfortunately there's no simple and accurate way to convert
             non-base-10 numbers that are out of C-language range.  */
          if (base != 10)
-           xsignal (Qoverflow_error, list1 (build_string (string)));
+           xsignal1 (Qoverflow_error, build_string (string));
        }
       else if (n <= (negative ? -MOST_NEGATIVE_FIXNUM : MOST_POSITIVE_FIXNUM))
        {
@@ -3501,7 +3499,7 @@
            {
              if (ch == ']')
                return val;
-             invalid_syntax (") or . in a vector", 18);
+             invalid_syntax (") or . in a vector");
            }
          if (ch == ')')
            return val;
@@ -3603,9 +3601,9 @@
 
                  return val;
                }
-             invalid_syntax (". in wrong context", 18);
+             invalid_syntax (". in wrong context");
            }
-         invalid_syntax ("] in a list", 11);
+         invalid_syntax ("] in a list");
        }
       tem = (read_pure && flag <= 0
             ? pure_cons (elt, Qnil)
@@ -3652,7 +3650,7 @@
 intern (const char *str)
 {
   Lisp_Object tem;
-  int len = strlen (str);
+  ptrdiff_t len = strlen (str);
   Lisp_Object obarray;
 
   obarray = Vobarray;
@@ -3668,7 +3666,7 @@
 intern_c_string (const char *str)
 {
   Lisp_Object tem;
-  int len = strlen (str);
+  ptrdiff_t len = strlen (str);
   Lisp_Object obarray;
 
   obarray = Vobarray;

=== modified file 'src/minibuf.c'
--- a/src/minibuf.c     2011-06-10 20:05:21 +0000
+++ b/src/minibuf.c     2011-06-20 06:14:57 +0000
@@ -1115,7 +1115,7 @@
 {
   Lisp_Object args[4], result;
   char *s;
-  int len;
+  ptrdiff_t len;
   int count = SPECPDL_INDEX ();
 
   if (BUFFERP (def))
@@ -1137,7 +1137,7 @@
          if (STRINGP (prompt))
            {
              s = SSDATA (prompt);
-             len = strlen (s);
+             len = SBYTES (prompt);
              if (len >= 2 && s[len - 2] == ':' && s[len - 1] == ' ')
                len = len - 2;
              else if (len >= 1 && (s[len - 1] == ':' || s[len - 1] == ' '))

=== modified file 'src/nsterm.h'
--- a/src/nsterm.h      2011-01-25 04:08:28 +0000
+++ b/src/nsterm.h      2011-06-22 06:16:16 +0000
@@ -468,8 +468,8 @@
   int smallest_font_height;
 
   struct ns_bitmap_record *bitmaps;
-  int bitmaps_size;
-  int bitmaps_last;
+  ptrdiff_t bitmaps_size;
+  ptrdiff_t bitmaps_last;
 
   struct image_cache *image_cache;
 
@@ -818,4 +818,3 @@
 
 
 #endif /* HAVE_NS */
-

=== modified file 'src/process.c'
--- a/src/process.c     2011-06-20 12:54:05 +0000
+++ b/src/process.c     2011-06-21 00:59:02 +0000
@@ -1187,7 +1187,7 @@
   if (VECTORP (address))  /* AF_INET or AF_INET6 */
     {
       register struct Lisp_Vector *p = XVECTOR (address);
-      EMACS_UINT size = p->header.size;
+      EMACS_INT size = p->header.size;
       Lisp_Object args[10];
       int nargs, i;
 

=== modified file 'src/termcap.c'
--- a/src/termcap.c     2011-04-12 10:20:32 +0000
+++ b/src/termcap.c     2011-06-20 07:21:06 +0000
@@ -323,10 +323,10 @@
 struct termcap_buffer
   {
     char *beg;
-    int size;
+    ptrdiff_t size;
     char *ptr;
     int ateof;
-    int full;
+    ptrdiff_t full;
   };
 
 /* Forward declarations of static functions.  */
@@ -367,7 +367,7 @@
   register char *bp1;
   char *tc_search_point;
   char *term;
-  int malloc_size = 0;
+  ptrdiff_t malloc_size = 0;
   register int c;
   char *tcenv = NULL;          /* TERMCAP value, if it contains :tc=.  */
   char *indirect = NULL;       /* Terminal type in :tc= in TERMCAP value.  */
@@ -637,6 +637,8 @@
        {
          if (bufp->full == bufp->size)
            {
+             if ((PTRDIFF_MAX - 1) / 2 < bufp->size)
+               memory_full (SIZE_MAX);
              bufp->size *= 2;
              /* Add 1 to size to ensure room for terminating null.  */
              tem = (char *) xrealloc (buf, bufp->size + 1);
@@ -715,4 +717,3 @@
 }
 
 #endif /* TEST */
-

=== modified file 'src/textprop.c'
--- a/src/textprop.c    2011-05-28 22:39:39 +0000
+++ b/src/textprop.c    2011-06-21 21:32:10 +0000
@@ -613,7 +613,7 @@
     }
   if (BUFFERP (object))
     {
-      int noverlays;
+      ptrdiff_t noverlays;
       Lisp_Object *overlay_vec;
       struct buffer *obuf = current_buffer;
 

=== modified file 'src/w32term.h'
--- a/src/w32term.h     2011-03-14 17:07:53 +0000
+++ b/src/w32term.h     2011-06-22 06:16:16 +0000
@@ -103,7 +103,7 @@
 
   /* Emacs bitmap-id of the default icon bitmap for this frame.
      Or -1 if none has been allocated yet.  */
-  int icon_bitmap_id;
+  ptrdiff_t icon_bitmap_id;
 
   /* The root window of this screen.  */
   Window root_window;
@@ -151,10 +151,10 @@
   struct w32_bitmap_record *bitmaps;
 
   /* Allocated size of bitmaps field.  */
-  int bitmaps_size;
+  ptrdiff_t bitmaps_size;
 
   /* Last used bitmap index.  */
-  int bitmaps_last;
+  ptrdiff_t bitmaps_last;
 
   /* The frame (if any) which has the window that has keyboard focus.
      Zero if none.  This is examined by Ffocus_frame in w32fns.c.  Note

=== modified file 'src/xdisp.c'
--- a/src/xdisp.c       2011-06-18 19:15:06 +0000
+++ b/src/xdisp.c       2011-06-21 21:32:10 +0000
@@ -810,7 +810,7 @@
 static int try_scrolling (Lisp_Object, int, EMACS_INT, EMACS_INT, int, int);
 static int try_cursor_movement (Lisp_Object, struct text_pos, int *);
 static int trailing_whitespace_p (EMACS_INT);
-static unsigned long int message_log_check_duplicate (EMACS_INT, EMACS_INT);
+static intmax_t message_log_check_duplicate (EMACS_INT, EMACS_INT);
 static void push_it (struct it *, struct text_pos *);
 static void pop_it (struct it *);
 static void sync_frame_with_window_matrix_rows (struct window *);
@@ -2384,7 +2384,7 @@
      is invisible.  >0 means lines indented more than this value are
      invisible.  */
   it->selective = (INTEGERP (BVAR (current_buffer, selective_display))
-                  ? XFASTINT (BVAR (current_buffer, selective_display))
+                  ? XINT (BVAR (current_buffer, selective_display))
                   : (!NILP (BVAR (current_buffer, selective_display))
                      ? -1 : 0));
   it->selective_display_ellipsis_p
@@ -3062,10 +3062,9 @@
 static EMACS_INT
 next_overlay_change (EMACS_INT pos)
 {
-  int noverlays;
+  ptrdiff_t i, noverlays;
   EMACS_INT endpos;
   Lisp_Object *overlays;
-  int i;
 
   /* Get all overlays at the given position.  */
   GET_OVERLAYS_AT (pos, overlays, noverlays, &endpos, 1);
@@ -5178,7 +5177,8 @@
 static int
 forward_to_next_line_start (struct it *it, int *skipped_p)
 {
-  int old_selective, newline_found_p, n;
+  EMACS_INT old_selective;
+  int newline_found_p, n;
   const int MAX_NEWLINE_DISTANCE = 500;
 
   /* If already on a newline, just consume it to avoid unintended
@@ -5270,7 +5270,7 @@
         invisible.  */
       if (it->selective > 0
          && indented_beyond_p (IT_CHARPOS (*it), IT_BYTEPOS (*it),
-                               (double) it->selective)) /* iftc */
+                               it->selective))
        continue;
 
       /* Check the newline before point for invisibility.  */
@@ -5364,7 +5364,7 @@
   if (it->selective > 0)
     while (IT_CHARPOS (*it) < ZV
           && indented_beyond_p (IT_CHARPOS (*it), IT_BYTEPOS (*it),
-                                (double) it->selective)) /* iftc */
+                                it->selective))
       {
        xassert (IT_BYTEPOS (*it) == BEGV
                 || FETCH_BYTE (IT_BYTEPOS (*it) - 1) == '\n');
@@ -6812,7 +6812,7 @@
                  && IT_CHARPOS (*it) + 1 < ZV
                  && indented_beyond_p (IT_CHARPOS (*it) + 1,
                                        IT_BYTEPOS (*it) + 1,
-                                       (double) it->selective)) /* iftc */
+                                       it->selective))
                {
                  success_p = next_element_from_ellipsis (it);
                  it->dpvec_char_len = -1;
@@ -8063,7 +8063,7 @@
       if (nlflag)
        {
          EMACS_INT this_bol, this_bol_byte, prev_bol, prev_bol_byte;
-         unsigned long int dups;
+         intmax_t dups;
          insert_1 ("\n", 1, 1, 0, 0);
 
          scan_newline (Z, Z_BYTE, BEG, BEG_BYTE, -2, 0);
@@ -8086,12 +8086,13 @@
                                  this_bol, this_bol_byte, 0);
                  if (dups > 1)
                    {
-                     char dupstr[40];
+                     char dupstr[sizeof " [ times]"
+                                 + INT_STRLEN_BOUND (intmax_t)];
                      int duplen;
 
                      /* If you change this format, don't forget to also
                         change message_log_check_duplicate.  */
-                     sprintf (dupstr, " [%lu times]", dups);
+                     sprintf (dupstr, " [%"PRIdMAX" times]", dups);
                      duplen = strlen (dupstr);
                      TEMP_SET_PT_BOTH (Z - 1, Z_BYTE - 1);
                      insert_1 (dupstr, duplen, 1, 0, 1);
@@ -8153,7 +8154,7 @@
    Return 0 if different, 1 if the new one should just replace it, or a
    value N > 1 if we should also append " [N times]".  */
 
-static unsigned long int
+static intmax_t
 message_log_check_duplicate (EMACS_INT prev_bol_byte, EMACS_INT this_bol_byte)
 {
   EMACS_INT i;
@@ -8175,8 +8176,8 @@
   if (*p1++ == ' ' && *p1++ == '[')
     {
       char *pend;
-      unsigned long int n = strtoul ((char *) p1, &pend, 10);
-      if (strncmp (pend, " times]\n", 8) == 0)
+      intmax_t n = strtoimax ((char *) p1, &pend, 10);
+      if (0 < n && n < INTMAX_MAX && strncmp (pend, " times]\n", 8) == 0)
        return n+1;
     }
   return 0;
@@ -18728,8 +18729,7 @@
                        break;
                      case MODE_LINE_STRING:
                        {
-                         int len = strlen (spec);
-                         Lisp_Object tem = make_string (spec, len);
+                         Lisp_Object tem = build_string (spec);
                          props = Ftext_properties_at (make_number (charpos), 
elt);
                          /* Should only keep face property in props */
                          n += store_mode_line_string (NULL, tem, 0, field, 
prec, props);
@@ -25452,13 +25452,13 @@
       && XFASTINT (w->last_modified) == BUF_MODIFF (b)
       && XFASTINT (w->last_overlay_modified) == BUF_OVERLAY_MODIFF (b))
     {
-      int hpos, vpos, i, dx, dy, area;
+      int hpos, vpos, dx, dy, area;
       EMACS_INT pos;
       struct glyph *glyph;
       Lisp_Object object;
       Lisp_Object mouse_face = Qnil, position;
       Lisp_Object *overlay_vec = NULL;
-      int noverlays;
+      ptrdiff_t i, noverlays;
       struct buffer *obuf;
       EMACS_INT obegv, ozv;
       int same_region;

=== modified file 'src/xfaces.c'
--- a/src/xfaces.c      2011-06-18 19:15:06 +0000
+++ b/src/xfaces.c      2011-06-22 06:16:16 +0000
@@ -463,7 +463,8 @@
 static void set_font_frame_param (Lisp_Object, Lisp_Object);
 static int get_lface_attributes (struct frame *, Lisp_Object, Lisp_Object *,
                                  int, struct named_merge_point *);
-static int load_pixmap (struct frame *, Lisp_Object, unsigned *, unsigned *);
+static ptrdiff_t load_pixmap (struct frame *, Lisp_Object,
+                             unsigned *, unsigned *);
 static struct frame *frame_or_selected_frame (Lisp_Object, int);
 static void load_face_colors (struct frame *, struct face *, Lisp_Object *);
 static void free_face_colors (struct frame *, struct face *);
@@ -963,10 +964,10 @@
    zero.  Store the bitmap width in *W_PTR and its height in *H_PTR,
    if these pointers are not null.  */
 
-static int
+static ptrdiff_t
 load_pixmap (FRAME_PTR f, Lisp_Object name, unsigned int *w_ptr, unsigned int 
*h_ptr)
 {
-  int bitmap_id;
+  ptrdiff_t bitmap_id;
 
   if (NILP (name))
     return 0;
@@ -5934,7 +5935,7 @@
   struct frame *f = XFRAME (w->frame);
   Lisp_Object attrs[LFACE_VECTOR_SIZE];
   Lisp_Object prop, position;
-  int i, noverlays;
+  ptrdiff_t i, noverlays;
   Lisp_Object *overlay_vec;
   Lisp_Object frame;
   EMACS_INT endpos;

=== modified file 'src/xfns.c'
--- a/src/xfns.c        2011-06-18 19:15:06 +0000
+++ b/src/xfns.c        2011-06-21 01:38:04 +0000
@@ -1883,7 +1883,7 @@
   /* Make a fontset name from the base font name.  */
   if (xic_defaut_fontset == base_fontname)
     { /* There is no base font name, use the default.  */
-      int len = strlen (base_fontname) + 2;
+      ptrdiff_t len = strlen (base_fontname) + 2;
       fontsetname = xmalloc (len);
       memset (fontsetname, 0, len);
       strcpy (fontsetname, base_fontname);
@@ -1896,7 +1896,7 @@
         - the base font where the charset spec is replaced by -*-*.
         - the same but with the family also replaced with -*-*-.  */
       const char *p = base_fontname;
-      int i;
+      ptrdiff_t i;
 
       for (i = 0; *p; p++)
        if (*p == '-') i++;
@@ -1904,7 +1904,8 @@
        { /* As the font name doesn't conform to XLFD, we can't
             modify it to generalize it to allcs and allfamilies.
             Use the specified font plus the default.  */
-         int len = strlen (base_fontname) + strlen (xic_defaut_fontset) + 3;
+         ptrdiff_t len =
+           strlen (base_fontname) + strlen (xic_defaut_fontset) + 3;
          fontsetname = xmalloc (len);
          memset (fontsetname, 0, len);
          strcpy (fontsetname, base_fontname);
@@ -1913,7 +1914,7 @@
        }
       else
        {
-         int len;
+         ptrdiff_t len;
          const char *p1 = NULL, *p2 = NULL, *p3 = NULL;
          char *font_allcs = NULL;
          char *font_allfamilies = NULL;
@@ -1940,7 +1941,7 @@
             wildcard.  */
          if (*p3 != '*')
            {
-             int diff = (p2 - p3) - 2;
+             ptrdiff_t diff = (p2 - p3) - 2;
 
              base = alloca (strlen (base_fontname) + 1);
              memcpy (base, base_fontname, p3 - base_fontname);
@@ -2434,7 +2435,7 @@
 
   /* Do some needed geometry management.  */
   {
-    int len;
+    ptrdiff_t len;
     char *tem, shell_position[32];
     Arg gal[10];
     int gac = 0;

=== modified file 'src/xfont.c'
--- a/src/xfont.c       2011-04-11 05:58:27 +0000
+++ b/src/xfont.c       2011-06-21 01:40:45 +0000
@@ -594,16 +594,14 @@
     {
       if (XGetFontProperty (xfont, XA_FONT, &value))
        {
-         int len;
          char *s;
 
          s = (char *) XGetAtomName (display, (Atom) value);
-         len = strlen (s);
 
          /* If DXPC (a Differential X Protocol Compressor)
             Ver.3.7 is running, XGetAtomName will return null
             string.  We must avoid such a name.  */
-         if (len > 0)
+         if (*s)
            {
              entity = font_make_entity ();
              ASET (entity, FONT_TYPE_INDEX, Qx);

=== modified file 'src/xrdb.c'
--- a/src/xrdb.c        2011-04-19 00:34:42 +0000
+++ b/src/xrdb.c        2011-06-21 02:15:16 +0000
@@ -120,20 +120,20 @@
    refers to %L only when the LANG environment variable is set, or
    otherwise provided by X.
 
-   ESCAPED_SUFFIX and SUFFIX are postpended to STRING if they are
-   non-zero.  %-escapes in ESCAPED_SUFFIX are expanded; STRING is left
-   alone.
+   ESCAPED_SUFFIX is postpended to STRING if it is non-zero.
+   %-escapes in ESCAPED_SUFFIX are expanded.
 
    Return NULL otherwise.  */
 
 static char *
-magic_file_p (const char *string, EMACS_INT string_len, const char *class, 
const char *escaped_suffix, const char *suffix)
+magic_file_p (const char *string, EMACS_INT string_len, const char *class,
+             const char *escaped_suffix)
 {
   char *lang = getenv ("LANG");
 
-  int path_size = 100;
+  ptrdiff_t path_size = 100;
   char *path = (char *) xmalloc (path_size);
-  int path_len = 0;
+  ptrdiff_t path_len = 0;
 
   const char *p = string;
 
@@ -141,7 +141,7 @@
     {
       /* The chunk we're about to stick on the end of result.  */
       const char *next = NULL;
-      int next_len;
+      ptrdiff_t next_len;
 
       if (*p == '%')
        {
@@ -201,8 +201,10 @@
        next = p, next_len = 1;
 
       /* Do we have room for this component followed by a '\0' ?  */
-      if (path_len + next_len + 1 > path_size)
+      if (path_size - path_len <= next_len)
        {
+         if (min (PTRDIFF_MAX, SIZE_MAX) / 2 - 1 - path_len < next_len)
+           memory_full (SIZE_MAX);
          path_size = (path_len + next_len + 1) * 2;
          path = (char *) xrealloc (path, path_size);
        }
@@ -222,21 +224,6 @@
        }
     }
 
-  /* Perhaps we should add the SUFFIX now.  */
-  if (suffix)
-    {
-      int suffix_len = strlen (suffix);
-
-      if (path_len + suffix_len + 1 > path_size)
-       {
-         path_size = (path_len + suffix_len + 1);
-         path = (char *) xrealloc (path, path_size);
-       }
-
-      memcpy (path + path_len, suffix, suffix_len);
-      path_len += suffix_len;
-    }
-
   path[path_len] = '\0';
 
   if (! file_p (path))
@@ -295,7 +282,8 @@
    the path name of the one we found otherwise.  */
 
 static char *
-search_magic_path (const char *search_path, const char *class, const char 
*escaped_suffix, const char *suffix)
+search_magic_path (const char *search_path, const char *class,
+                  const char *escaped_suffix)
 {
   const char *s, *p;
 
@@ -306,8 +294,7 @@
 
       if (p > s)
        {
-         char *path = magic_file_p (s, p - s, class, escaped_suffix,
-                                          suffix);
+         char *path = magic_file_p (s, p - s, class, escaped_suffix);
          if (path)
            return path;
        }
@@ -316,7 +303,7 @@
          char *path;
 
          s = "%N%S";
-         path = magic_file_p (s, strlen (s), class, escaped_suffix, suffix);
+         path = magic_file_p (s, strlen (s), class, escaped_suffix);
          if (path)
            return path;
        }
@@ -340,7 +327,7 @@
   path = getenv ("XFILESEARCHPATH");
   if (! path) path = PATH_X_DEFAULTS;
 
-  p = search_magic_path (path, class, 0, 0);
+  p = search_magic_path (path, class, 0);
   if (p)
     {
       db = XrmGetFileDatabase (p);
@@ -368,19 +355,19 @@
   /* Check for XUSERFILESEARCHPATH.  It is a path of complete file
      names, not directories.  */
   if (((path = getenv ("XUSERFILESEARCHPATH"))
-       && (file = search_magic_path (path, class, 0, 0)))
+       && (file = search_magic_path (path, class, 0)))
 
       /* Check for APPLRESDIR; it is a path of directories.  In each,
         we have to search for LANG/CLASS and then CLASS.  */
       || ((path = getenv ("XAPPLRESDIR"))
-         && ((file = search_magic_path (path, class, "/%L/%N", 0))
-             || (file = search_magic_path (path, class, "/%N", 0))))
+         && ((file = search_magic_path (path, class, "/%L/%N"))
+             || (file = search_magic_path (path, class, "/%N"))))
 
       /* Check in the home directory.  This is a bit of a hack; let's
         hope one's home directory doesn't contain any %-escapes.  */
       || (free_it = gethomedir (),
-         ((file = search_magic_path (free_it, class, "%L/%N", 0))
-          || (file = search_magic_path (free_it, class, "%N", 0)))))
+         ((file = search_magic_path (free_it, class, "%L/%N"))
+          || (file = search_magic_path (free_it, class, "%N")))))
     {
       XrmDatabase db = XrmGetFileDatabase (file);
       xfree (file);

=== modified file 'src/xselect.c'
--- a/src/xselect.c     2011-06-06 19:43:39 +0000
+++ b/src/xselect.c     2011-06-21 02:16:54 +0000
@@ -2361,7 +2361,7 @@
   x_uncatch_errors ();
 
   if (!had_errors)
-    ret = make_string (name, strlen (name));
+    ret = build_string (name);
 
   if (atom && name) XFree (name);
   if (NILP (ret)) ret = empty_unibyte_string;

=== modified file 'src/xsettings.c'
--- a/src/xsettings.c   2011-04-14 20:16:48 +0000
+++ b/src/xsettings.c   2011-06-21 17:52:14 +0000
@@ -18,6 +18,8 @@
 along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
 
 #include <config.h>
+
+#include <float.h>
 #include <limits.h>
 #include <setjmp.h>
 #include <fcntl.h>
@@ -434,10 +436,8 @@
   FcPattern *pat;
   struct xsettings oldsettings;
   int changed = 0;
-  char buf[256];
 
   memset (&oldsettings, 0, sizeof (oldsettings));
-  buf[0] = '\0';
   pat = FcPatternCreate ();
   XftDefaultSubstitute (dpyinfo->display,
                         XScreenNumberOfScreen (dpyinfo->screen),
@@ -458,7 +458,6 @@
       ++changed;
       oldsettings.aa = settings->aa;
     }
-  sprintf (buf, "Antialias: %d", oldsettings.aa);
 
   if ((settings->seen & SEEN_HINTING) != 0
       && oldsettings.hinting != settings->hinting)
@@ -468,8 +467,6 @@
       ++changed;
       oldsettings.hinting = settings->hinting;
     }
-  if (strlen (buf) > 0) strcat (buf, ", ");
-  sprintf (buf+strlen (buf), "Hinting: %d", oldsettings.hinting);
   if ((settings->seen & SEEN_RGBA) != 0 && oldsettings.rgba != settings->rgba)
     {
       FcPatternDel (pat, FC_RGBA);
@@ -477,8 +474,6 @@
       oldsettings.rgba = settings->rgba;
       ++changed;
     }
-  if (strlen (buf) > 0) strcat (buf, ", ");
-  sprintf (buf+strlen (buf), "RGBA: %d", oldsettings.rgba);
 
   /* Older fontconfig versions don't have FC_LCD_FILTER. */
   if ((settings->seen & SEEN_LCDFILTER) != 0
@@ -489,8 +484,6 @@
       ++changed;
       oldsettings.lcdfilter = settings->lcdfilter;
     }
-  if (strlen (buf) > 0) strcat (buf, ", ");
-  sprintf (buf+strlen (buf), "LCDFilter: %d", oldsettings.lcdfilter);
 
 # ifdef FC_HINT_STYLE
   if ((settings->seen & SEEN_HINTSTYLE) != 0
@@ -502,8 +495,6 @@
       oldsettings.hintstyle = settings->hintstyle;
     }
 # endif
-  if (strlen (buf) > 0) strcat (buf, ", ");
-  sprintf (buf+strlen (buf), "Hintstyle: %d", oldsettings.hintstyle);
 
   if ((settings->seen & SEEN_DPI) != 0 && oldsettings.dpi != settings->dpi
       && settings->dpi > 0)
@@ -523,16 +514,31 @@
           XFRAME (frame)->resy = XFRAME (frame)->resx = settings->dpi;
     }
 
-  if (strlen (buf) > 0) strcat (buf, ", ");
-  sprintf (buf+strlen (buf), "DPI: %lf", oldsettings.dpi);
-
   if (changed)
     {
+      static char const format[] =
+       "Antialias: %d, Hinting: %d, RGBA: %d, LCDFilter: %d, "
+       "Hintstyle: %d, DPI: %lf";
+      enum
+      {
+       d_formats = 5,
+       d_growth = INT_BUFSIZE_BOUND (int) - sizeof "%d",
+       lf_formats = 1,
+       max_f_integer_digits = DBL_MAX_10_EXP + 1,
+       f_precision = 6,
+       lf_growth = (sizeof "-." + max_f_integer_digits + f_precision
+                    - sizeof "%lf")
+      };
+      char buf[sizeof format + d_formats * d_growth + lf_formats * lf_growth];
+
       XftDefaultSet (dpyinfo->display, pat);
       if (send_event_p)
         store_config_changed_event (Qfont_render,
                                     XCAR (dpyinfo->name_list_element));
-      Vxft_settings = make_string (buf, strlen (buf));
+      sprintf (buf, format, oldsettings.aa, oldsettings.hinting,
+              oldsettings.rgba, oldsettings.lcdfilter,
+              oldsettings.hintstyle, oldsettings.dpi);
+      Vxft_settings = build_string (buf);
     }
   else
     FcPatternDestroy (pat);
@@ -705,9 +711,7 @@
        doc: /* Get the system default application font. */)
   (void)
 {
-  return current_font
-    ? make_string (current_font, strlen (current_font))
-    : Qnil;
+  return current_font ? build_string (current_font) : Qnil;
 }
 
 DEFUN ("font-get-system-font", Ffont_get_system_font, Sfont_get_system_font,
@@ -715,9 +719,7 @@
        doc: /* Get the system default fixed width font. */)
   (void)
 {
-  return current_mono_font
-    ? make_string (current_mono_font, strlen (current_mono_font))
-    : Qnil;
+  return current_mono_font ? build_string (current_mono_font) : Qnil;
 }
 
 DEFUN ("tool-bar-get-system-style", Ftool_bar_get_system_style,

=== modified file 'src/xsmfns.c'
--- a/src/xsmfns.c      2011-04-16 03:06:07 +0000
+++ b/src/xsmfns.c      2011-06-21 20:32:19 +0000
@@ -190,7 +190,7 @@
   props[props_idx]->type = xstrdup (SmARRAY8);
   props[props_idx]->num_vals = 1;
   props[props_idx]->vals = &values[val_idx++];
-  props[props_idx]->vals[0].length = strlen (SSDATA (Vinvocation_name));
+  props[props_idx]->vals[0].length = SBYTES (Vinvocation_name);
   props[props_idx]->vals[0].value = SDATA (Vinvocation_name);
   ++props_idx;
 
@@ -200,7 +200,7 @@
   props[props_idx]->type = xstrdup (SmARRAY8);
   props[props_idx]->num_vals = 1;
   props[props_idx]->vals = &values[val_idx++];
-  props[props_idx]->vals[0].length = strlen (SSDATA (Vuser_login_name));
+  props[props_idx]->vals[0].length = SBYTES (Vuser_login_name);
   props[props_idx]->vals[0].value = SDATA (Vuser_login_name);
   ++props_idx;
 
@@ -398,7 +398,7 @@
   char errorstring[SM_ERRORSTRING_LEN];
   char* previous_id = NULL;
   SmcCallbacks callbacks;
-  int  name_len = 0;
+  ptrdiff_t name_len = 0;
 
   ice_fd = -1;
   doing_interact = False;
@@ -410,8 +410,8 @@
 
   /* Construct the path to the Emacs program.  */
   if (! EQ (Vinvocation_directory, Qnil))
-    name_len += strlen (SSDATA (Vinvocation_directory));
-  name_len += strlen (SSDATA (Vinvocation_name));
+    name_len += SBYTES (Vinvocation_directory);
+  name_len += SBYTES (Vinvocation_name);
 
   /* This malloc will not be freed, but it is only done once, and hopefully
      not very large   */
@@ -457,7 +457,7 @@
 
   if (smc_conn != 0)
     {
-      Vx_session_id = make_string (client_id, strlen (client_id));
+      Vx_session_id = build_string (client_id);
 
 #ifdef USE_GTK
       /* GTK creats a leader window by itself, but we need to tell

=== modified file 'src/xterm.c'
--- a/src/xterm.c       2011-06-13 16:08:46 +0000
+++ b/src/xterm.c       2011-06-22 06:16:16 +0000
@@ -356,7 +356,7 @@
    interference with debugging failing X calls.  */
 static void x_connection_closed (Display *, const char *);
 static void x_wm_set_window_state (struct frame *, int);
-static void x_wm_set_icon_pixmap (struct frame *, int);
+static void x_wm_set_icon_pixmap (struct frame *, ptrdiff_t);
 static void x_initialize (void);
 
 
@@ -7427,7 +7427,7 @@
 int
 x_bitmap_icon (struct frame *f, Lisp_Object file)
 {
-  int bitmap_id;
+  ptrdiff_t bitmap_id;
 
   if (FRAME_X_WINDOW (f) == 0)
     return 1;
@@ -7453,7 +7453,7 @@
       /* Create the GNU bitmap and mask if necessary.  */
       if (FRAME_X_DISPLAY_INFO (f)->icon_bitmap_id < 0)
        {
-         int rc = -1;
+         ptrdiff_t rc = -1;
 
 #ifdef USE_GTK
 
@@ -8084,7 +8084,7 @@
     {
 #ifdef HAVE_X11R6_XIM
       struct xim_inst_t *xim_inst;
-      int len;
+      ptrdiff_t len;
 
       xim_inst = (struct xim_inst_t *) xmalloc (sizeof (struct xim_inst_t));
       dpyinfo->xim_callback_data = xim_inst;
@@ -9601,7 +9601,7 @@
 }
 
 static void
-x_wm_set_icon_pixmap (struct frame *f, int pixmap_id)
+x_wm_set_icon_pixmap (struct frame *f, ptrdiff_t pixmap_id)
 {
   Pixmap icon_pixmap, icon_mask;
 
@@ -9720,8 +9720,8 @@
 {
   int seen_colon = 0;
   const char *system_name = SSDATA (Vsystem_name);
-  int system_name_length = strlen (system_name);
-  int length_until_period = 0;
+  ptrdiff_t system_name_length = SBYTES (Vsystem_name);
+  ptrdiff_t length_until_period = 0;
 
   while (system_name[length_until_period] != 0
         && system_name[length_until_period] != '.')

=== modified file 'src/xterm.h'
--- a/src/xterm.h       2011-06-11 21:31:32 +0000
+++ b/src/xterm.h       2011-06-22 06:16:16 +0000
@@ -158,7 +158,7 @@
 
   /* Emacs bitmap-id of the default icon bitmap for this frame.
      Or -1 if none has been allocated yet.  */
-  int icon_bitmap_id;
+  ptrdiff_t icon_bitmap_id;
 
   /* The root window of this screen.  */
   Window root_window;
@@ -202,10 +202,10 @@
   struct x_bitmap_record *bitmaps;
 
   /* Allocated size of bitmaps field.  */
-  int bitmaps_size;
+  ptrdiff_t bitmaps_size;
 
   /* Last used bitmap index.  */
-  int bitmaps_last;
+  ptrdiff_t bitmaps_last;
 
   /* Which modifier keys are on which modifier bits?
 
@@ -490,7 +490,7 @@
 
   /* If >=0, a bitmap index.  The indicated bitmap is used for the
      icon. */
-  int icon_bitmap;
+  ptrdiff_t icon_bitmap;
 
   /* Default ASCII font of this frame.  */
   struct font *font;


reply via email to

[Prev in Thread] Current Thread [Next in Thread]