Subject: Emacs 24 stack corruption in fontset.c:fontset_pattern_regexp
From: John F Carr <[email-masked]>
To: "[email-masked]" <[email-masked]>
Date: Sat, 21 Mar 2015 12:06:16 +0000
List-Id: <debbugs-submit.debbugs.gnu.org>

Emacs crashes on Mac Yosemite (native window system) when I use set-frame-font with certain font patterns.  The cause is writing past the end of an alloca buffer in fontset.c:fontset_pattern_regexp.  This triggers a stack check assertion.  Alloca is used to allocate space for a regexp, but the size neglects to consider the ^$ around the regexp.  “+1” should be “+3”.

To reproduce:

(set-frame-font "-adobe-courier-medium-r-normal--24-*-75-75-m-150-iso8859-1”)

without X installed.

Bug in 24.3 and "GNU Emacs 24.4.2 (x86_64-apple-darwin14.1.0, NS apple-appkit-1344.72)”.