Re: Bug in "info"

[Eli Zaretskii]

> While browsing documentation using "info", I've pressed some random
> keys, and the program caught SIGSEGV.  After spending some time
> experimenting I've learned that the key sequence was "-9-=".

Thank you for such a simple and clear test case, it made it very easy
to debug this problem.

In fact, even "-9-" should cause a crash, if you wait for a while
after pressing the last `-'.

This happens because this sequence causes an infinite recursion in
the Info's key dispatch code, so you get a stack overflow.

Please try the change below and see if the problem goes away:

2001-11-02  Eli Zaretskii  <address@hidden>

        * info/session.c (info_numeric_arg_digit_loop): If the user types
        a `-' after digits, signal an error.

--- info/session.c~3    Mon Oct  9 15:22:48 2000
+++ info/session.c      Fri Nov  2 13:18:12 2001
@@ -4725,14 +4725,34 @@ DECLARE_INFO_COMMAND (info_numeric_arg_d
           info_explicit_arg = 1;
         }
       else
-        {
-          if (key == '-' && !info_explicit_arg)
-            {
-              info_numeric_arg_sign = -1;
-              info_numeric_arg = 1;
-            }
-          else
+       {
+         if (key == '-' && !info_explicit_arg)
+           {
+             info_numeric_arg_sign = -1;
+             info_numeric_arg = 1;
+           }
+         else if (key == '-'
+                  && ((keymap['-'].type == ISFUNC
+                          && keymap['-'].function ==
+                          info_add_digit_to_numeric_arg)
+                      || (Meta_p (pure_key) && keymap[ESC].type == ISKMAP
+                          && (((Keymap)keymap[ESC].function)['-'].type == 
ISFUNC
+                              && ((Keymap)keymap[ESC].function)['-'].function 
==
+                              info_add_digit_to_numeric_arg))))
+           {
+             /* The user typed something like "- 1 -", and - is bound
+                to this function.  We could flip the sign of the
+                numeric arg, but Emacs doesn't do that.  We cannot
+                let info_dispatch_on_key be called, since that would
+                lead to an infinite recursion.  So we just throw an
+                error.  */
+             dispatch_error (info_keyseq);
+             return;
+           }
+         else
             {
+             /* Either not `-' or `-' is bound to something unrelated
+                to numeric arguments.  */
               info_keyseq_index--;
               info_dispatch_on_key (pure_key, keymap);
               return;