Coverity fixes

	* src/search.c (compre_prfun): Use write_fmt_str instead of snprintf
	* src/search.c (fast_string_match): safeguard alloca from being
	used with a negative length.

Signed-off-by: Nelson Ferreira <nelson.ferreira@ieee.org>

diff --git a/src/search.c b/src/search.c
index 72206aa..52271ce 100644 (file)
--- a/src/search.c
+++ b/src/search.c
@@ -333,12 +333,8 @@ compile_pattern(Lisp_Object pattern,
 static void
 compre_prfun(Lisp_Object obj, Lisp_Object pcfun, int escflag)
 {
-       char buf[18];
-       write_c_string("#<compiled regexp ", pcfun);
-       snprintf(buf, 17, "%lx>",
-                (long unsigned int)((COMPRE_GET(obj))->buffer));
-       write_c_string(buf, pcfun);
-
+       write_fmt_str(pcfun, "#<compiled regexp %lx", 
+                     (long unsigned int)((COMPRE_GET(obj))->buffer));
        if (escflag);
 }
 
@@ -750,6 +746,8 @@ fast_string_match(Lisp_Object regexp, const Bufbyte * nonreloc,
 
        fixup_internal_substring(nonreloc, reloc, offset, &length);
 
+
+       
        if (!NILP(reloc)) {
                if (no_quit) {
                        newnonreloc = XSTRING_DATA(reloc);
@@ -759,6 +757,13 @@ fast_string_match(Lisp_Object regexp, const Bufbyte * nonreloc,
                           serious rewriting of re_search(). */
                        /* yeah, let's rewrite this bugger, the warning
                           hereafter is inevitable too */
+                       if ( length < 0)
+                               /* By this point
+                                  fixup_internal_substring should
+                                  have updated length, if it didn't
+                                  return with failure...
+                               */
+                               return -1;
                        newnonreloc = alloca(length);
                        memcpy((void*)newnonreloc, (void*)XSTRING_DATA(reloc), length);
                }