Subject: bug#24206: 25.1; Curly quotes generate invalid strings, leading to a segfault

From: Eli Zaretskii <[email-masked]>
Date: Sun, 14 Aug 2016 17:27:14 +0300

> Cc: [email-masked], Eli Zaretskii <[email-masked]>,
>  John Wiegley <[email-masked]>, Nicolas Petton <[email-masked]>
> From: Paul Eggert <[email-masked]>
> Date: Sat, 13 Aug 2016 23:54:43 -0500
> 
> Thanks forreporting that, Phil. Ituncovered several bugs in 
> substitute-command-keys,some predating the curved-quote changes in Emacs 
> 25. I installed a patch into Emacs master as commit 
> 2791580f5eaa65948a13ea4ea4952d03b4da795b and am closing the bug as fixed.
> 
> For Emacs 25 I propose installing the attached patch, which should avoid 
> the emacs-goodies-el problem though it does not fix the other 
> (presumably less-likely) bugs in this area. This patch is considerably 
> simpler than what I just installed into master.

Thanks for fixing this.  However, I'm not sure I agree with the fix:
it looks like it loses support for unibyte strings in
substitute-command-keys?  If so, I don't think we should go that way:
Emacs in general tries to support both unibyte and multibyte strings
alike in all the primitives that handle strings (with the obvious
exception of encoding and decoding them), so losing that here would be
a regression.

Isn't it true that the problem was in this fragment:

      else if ((strp[0] == '`' || strp[0] == '\'')
	       && quoting_style == CURVE_QUOTING_STYLE)
	{
	  start = (unsigned char const *) (strp[0] == '`' ? uLSQM : uRSQM);
	  length = 1;
	  length_byte = sizeof uLSQM - 1;
	  idx = strp - SDATA (string) + 1;
	  goto subst_quote;
	}

The "length = 1" part is only correct if the argument string is
multibyte, and should otherwise count the number of bytes in
uLSQM/uRSQ, right?  If this is not the reason for the crash, could you
please describe the reason(s) in more detail, so that we could try to
find a solution that doesn't lose unibyte string support?