lisp-format, scheme-format: Fix a memory overrun.

* gettext-tools/src/format-lisp.c (make_repeated_list): Fix upper bound of a
loop.
* gettext-tools/src/format-scheme.c (make_repeated_list): Likewise.
* gettext-tools/tests/xgettext-lisp-4: New file.
* gettext-tools/tests/xgettext-scheme-6: New file.
* gettext-tools/tests/Makefile.am (TESTS): Add them.

5 files changed, 52 insertions, 4 deletions

diff --git a/gettext-tools/src/format-lisp.c b/gettext-tools/src/format-lisp.c
index 58b242840..57e23210d 100644
--- a/gettext-tools/src/format-lisp.c
+++ b/gettext-tools/src/format-lisp.c
@@ -2279,7 +2279,7 @@ make_repeated_list (struct format_arg_list *sublist, unsigned int period)
           list->repeated.allocated = newcount;
           list->repeated.element = XNMALLOC (newcount, struct format_arg);
         }
-      for (i = splitindex, j = 0; i < n; i++, j++)
+      for (i = splitindex, j = 0; j < newcount; i++, j++)
         list->repeated.element[j] = list->initial.element[i];
       list->repeated.count = newcount;
       list->repeated.length = p;
diff --git a/gettext-tools/src/format-scheme.c b/gettext-tools/src/format-scheme.c
index f3e2ddff4..90aa3aa93 100644
--- a/gettext-tools/src/format-scheme.c
+++ b/gettext-tools/src/format-scheme.c
@@ -2302,7 +2302,7 @@ make_repeated_list (struct format_arg_list *sublist, unsigned int period)
           list->repeated.allocated = newcount;
           list->repeated.element = XNMALLOC (newcount, struct format_arg);
         }
-      for (i = splitindex, j = 0; i < n; i++, j++)
+      for (i = splitindex, j = 0; j < newcount; i++, j++)
         list->repeated.element[j] = list->initial.element[i];
       list->repeated.count = newcount;
       list->repeated.length = p;
diff --git a/gettext-tools/tests/Makefile.am b/gettext-tools/tests/Makefile.am
index 034296659..5349c7624 100644
--- a/gettext-tools/tests/Makefile.am
+++ b/gettext-tools/tests/Makefile.am
@@ -121,7 +121,7 @@ TESTS = gettext-1 gettext-2 \
 	xgettext-javascript-stackovfl-7 xgettext-javascript-stackovfl-8 \
 	xgettext-librep-1 xgettext-librep-2 xgettext-librep-3 \
 	xgettext-librep-stackovfl-1 xgettext-librep-stackovfl-2 \
-	xgettext-lisp-1 xgettext-lisp-2 xgettext-lisp-3 \
+	xgettext-lisp-1 xgettext-lisp-2 xgettext-lisp-3 xgettext-lisp-4 \
 	xgettext-lisp-stackovfl-1 xgettext-lisp-stackovfl-2 \
 	xgettext-lua-1 xgettext-lua-2 xgettext-lua-3 \
 	xgettext-lua-stackovfl-1 xgettext-lua-stackovfl-2 \
@@ -145,7 +145,7 @@ TESTS = gettext-1 gettext-2 \
 	xgettext-python-stackovfl-3 xgettext-python-stackovfl-4 \
 	xgettext-ruby-1 \
 	xgettext-scheme-1 xgettext-scheme-2 xgettext-scheme-3 \
-	xgettext-scheme-4 xgettext-scheme-5 \
+	xgettext-scheme-4 xgettext-scheme-5 xgettext-scheme-6 \
 	xgettext-scheme-stackovfl-1 xgettext-scheme-stackovfl-2 \
 	xgettext-sh-1 xgettext-sh-2 xgettext-sh-3 xgettext-sh-4 xgettext-sh-5 \
 	xgettext-sh-6 xgettext-sh-7 \
diff --git a/gettext-tools/tests/xgettext-lisp-4 b/gettext-tools/tests/xgettext-lisp-4
new file mode 100755
index 000000000..b8d8b6bfa
--- /dev/null
+++ b/gettext-tools/tests/xgettext-lisp-4
@@ -0,0 +1,24 @@
+#! /bin/sh
+. "${srcdir=.}/init.sh"; path_prepend_ . ../src
+
+# Test Lisp support: lisp-format string with a complex nested loop.
+
+cat <<EOF > xg-ls-4.lisp
+(gettext "A~0{B~0b~,v*C~:*D~,v*E~,v*F~0{G~0{H~}I~}J~^~}K")
+EOF
+
+: ${XGETTEXT=xgettext}
+${XGETTEXT} --omit-header --no-location -d xg-ls-4.tmp xg-ls-4.lisp || Exit 1
+LC_ALL=C tr -d '\r' < xg-ls-4.tmp.po > xg-ls-4.po || Exit 1
+
+cat <<EOF > xg-ls-4.ok
+#, lisp-format
+msgid "A~0{B~0b~,v*C~:*D~,v*E~,v*F~0{G~0{H~}I~}J~^~}K"
+msgstr ""
+EOF
+
+: ${DIFF=diff}
+${DIFF} xg-ls-4.ok xg-ls-4.po
+result=$?
+
+exit $result
diff --git a/gettext-tools/tests/xgettext-scheme-6 b/gettext-tools/tests/xgettext-scheme-6
new file mode 100755
index 000000000..f91ca43a9
--- /dev/null
+++ b/gettext-tools/tests/xgettext-scheme-6
@@ -0,0 +1,24 @@
+#! /bin/sh
+. "${srcdir=.}/init.sh"; path_prepend_ . ../src
+
+# Test Scheme support: scheme-format string with a complex nested loop.
+
+cat <<EOF > xg-sc-6.scm
+(_ "A~0{B~0b~,v*C~:*D~,v*E~,v*F~0{G~0{H~}I~}J~^~}K")
+EOF
+
+: ${XGETTEXT=xgettext}
+${XGETTEXT} -k_ --omit-header --no-location -d xg-sc-6.tmp xg-sc-6.scm || Exit 1
+LC_ALL=C tr -d '\r' < xg-sc-6.tmp.po > xg-sc-6.po || Exit 1
+
+cat <<EOF > xg-sc-6.ok
+#, scheme-format
+msgid "A~0{B~0b~,v*C~:*D~,v*E~,v*F~0{G~0{H~}I~}J~^~}K"
+msgstr ""
+EOF
+
+: ${DIFF=diff}
+${DIFF} xg-sc-6.ok xg-sc-6.po
+result=$?
+
+exit $result