Subject: bug#8664: closed (committed fix into trunk)

From: [email-masked] (GNU bug Tracking System)
Date: Wed, 18 May 2011 01:34:02 +0000

Your bug report

#8664: * keyboard.c (make_lispy_event): Fix problem in integer overflow.

which was filed against the emacs package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
8664: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=8664
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: committed fix into trunk
From: Paul Eggert <[email-masked]>
To: [email-masked], [email-masked]
Date: Tue, 17 May 2011 18:33:25 -0700
List-Id: <debbugs-submit.debbugs.gnu.org>

Bzr 104265,which I just committed into the trunk,
should contain the fix discussed above, so I'm
marking this as "done".  As requested I separated
the gnulib merge into a separate commit, bzr 104264.

Subject: * keyboard.c (make_lispy_event): Fix problem in integer overflow.
From: Paul Eggert <[email-masked]>
To: [email-masked]
Date: Thu, 12 May 2011 12:58:14 -0700
List-Id: <debbugs-submit.debbugs.gnu.org>

Here's a patch for a potential problem with integer overflow
on 64-bit hosts that I plan to install after some more testing.
The problem is a bit more severe if EMACS_INT is 64-bit on
a 32-bit host, and I found it by inspection.

* keyboard.c (make_lispy_event): Fix problem in integer overflow.
Don't assume that the difference between two unsigned long values
can fit into an integer.  At this point, we know button_down_time
<= event->timestamp, so the difference must be nonnegative, so
there's no need to cast the result if double-click-time is
nonnegative, as it should be; check that it's nonnegative, just in
case.  This bug is triggered when events are more than 2**31 ms
apart (about 25 days).
=== modified file 'src/keyboard.c'
--- src/keyboard.c	2011-04-28 19:35:20 +0000
+++ src/keyboard.c	2011-05-12 19:33:15 +0000
@@ -5556,9 +5556,9 @@
 		       && (eabs (XINT (event->y) - last_mouse_y) <= fuzz)
 		       && button_down_time != 0
 		       && (EQ (Vdouble_click_time, Qt)
-			   || (INTEGERP (Vdouble_click_time)
-			       && ((int)(event->timestamp - button_down_time)
-				   < XINT (Vdouble_click_time)))));
+			   || (NATNUMP (Vdouble_click_time)
+			       && (event->timestamp - button_down_time
+				   < XFASTINT (Vdouble_click_time)))));
 	}

 	last_mouse_button = button;
@@ -5742,9 +5742,9 @@
 		       && (eabs (XINT (event->y) - last_mouse_y) <= fuzz)
 		       && button_down_time != 0
 		       && (EQ (Vdouble_click_time, Qt)
-			   || (INTEGERP (Vdouble_click_time)
-			       && ((int)(event->timestamp - button_down_time)
-				   < XINT (Vdouble_click_time)))));
+			   || (NATNUMP (Vdouble_click_time)
+			       && (event->timestamp - button_down_time
+				   < XFASTINT (Vdouble_click_time)))));
 	  if (is_double)
 	    {
 	      double_click_count++;