[Emacs-diffs] /srv/bzr/emacs/trunk r109631: Fix bug #12196 with incorrect memory allocations for region-cache.

[Eli Zaretskii]

------------------------------------------------------------
revno: 109631
fixes bug: http://debbugs.gnu.org/12196
committer: Eli Zaretskii <address@hidden>
branch nick: trunk
timestamp: Wed 2012-08-15 19:21:41 +0300
message:
  Fix bug #12196 with incorrect memory allocations for region-cache.
  
   src/region-cache.c (move_cache_gap): Update gap_len using the actual
   growth of the boundaries array.  Do not change cache_len.
modified:
  src/ChangeLog
  src/region-cache.c

=== modified file 'src/ChangeLog'
--- a/src/ChangeLog     2012-08-15 14:20:16 +0000
+++ b/src/ChangeLog     2012-08-15 16:21:41 +0000
@@ -1,3 +1,9 @@
+2012-08-15  Eli Zaretskii  <address@hidden>
+
+       * region-cache.c (move_cache_gap): Update gap_len using the actual
+       growth of the boundaries array.  Do not change cache_len.
+       (Bug#12196)
+
 2012-08-15  Dmitry Antipov  <address@hidden>
 
        Generalize and cleanup font subsystem checks.

=== modified file 'src/region-cache.c'
--- a/src/region-cache.c        2012-07-05 18:35:48 +0000
+++ b/src/region-cache.c        2012-08-15 16:21:41 +0000
@@ -245,16 +245,16 @@
      when the portion after the gap is smallest.  */
   if (gap_len < min_size)
     {
-      ptrdiff_t i;
+      ptrdiff_t i, nboundaries = c->cache_len;
 
       c->boundaries =
-       xpalloc (c->boundaries, &c->cache_len, min_size, -1,
+       xpalloc (c->boundaries, &nboundaries, min_size - gap_len, -1,
                 sizeof *c->boundaries);
 
       /* Some systems don't provide a version of the copy routine that
          can be trusted to shift memory upward into an overlapping
          region.  memmove isn't widely available.  */
-      min_size -= gap_len;
+      min_size = nboundaries - c->cache_len - gap_len;
       for (i = c->cache_len - 1; i >= gap_start; i--)
         {
           c->boundaries[i + min_size].pos   = c->boundaries[i + gap_len].pos;