Subject: bug#25684: 25.1; (downcase -1) segfaults Emacs on GNU/Linux

From: Andreas Schwab <[email-masked]>
Date: Tue, 14 Feb 2017 16:04:24 +0100

On Feb 13 2017, Glenn Morris <[email-masked]> wrote:

> Wilfred Hughes wrote:
>
>> The elisp primitives downcase and upcase cause Emacs to segfault when
>> given a negative argument. For example, (downcase -1).
>>
>> I can reproduce this on Emacs 25.1 as well as on master. It occurs on
>> GNU/Linux but not on OS X.
>
> I can't reproduce this, but it seems to me that (downcase -1) should
> signal a wrong-type-argument error, since negative numbers are not characters.
> But I think there are probably subtleties here that I don't get.

The function uses XFASTINT, which only works for non-negative numbers.
This is checked when runtime checking is enabled.

Andreas.

-- 
Andreas Schwab, [email-masked]
GPG Key fingerprint = 58CA 54C7 6D53 942B 1756  01D3 44D5 214B 8276 4ED5
"And now for something completely different."