1 files changed, 14 insertions, 7 deletions

diff --git a/src/prog.c b/src/prog.c
index 83401ef3..75b52284 100644
--- a/src/prog.c
+++ b/src/prog.c
@@ -381,13 +381,13 @@ static void env_register_auto(eval_environ_t env, void *ptr);
 
 void
 env_get_locus(eval_environ_t env, struct mu_locus_range *locus)
 {
         mu_locus_range_init(locus);
         locus->beg.mu_file = (char*)(env->dataseg + env->locus.file);
-        env_register_auto(env, (void*) locus->beg.mu_file);
+        env_register_auto(env, (void*) &locus->beg.mu_file);
         locus->beg.mu_line = env->locus.line;
 #if 0
         locus->beg.mu_col = env->locus.point;
         ...
 #endif
 }
@@ -490,38 +490,45 @@ env_function_cleanup_add(eval_environ_t env, void *data,
    The auto_ptr array is cleared (by calling env_unregister_autos) after
    executing each instruction (see eval_environment). 
  */
 static void
 env_register_auto(eval_environ_t env, void *ptr)
 {
+        char *addr = *(char**)ptr;
+        
         if (env->numautos == MAX_AUTO_PTR)
                 runtime_error(env, "INTERNAL ERROR at %s:%d, please report",
                               __FILE__, __LINE__);
+        /* Check if address is within the dataseg */
+        if (!(addr >= (char*) env->dataseg
+              && (addr < (char*) (env->dataseg + datasize + env->stack_size))))
+                ptr = NULL;
         env->auto_ptr[env->numautos++] = ptr;
 }
 
 /* Pop the last registered auto variable */
-void
+static void
 env_pop_auto(eval_environ_t env)
 {
         env->numautos--;
 }
 
-void
+static void
 env_unregister_autos(eval_environ_t env)
 {
         env->numautos = 0;
 }
 
-void
+static void
 env_fixup_autos(eval_environ_t env, ptrdiff_t offset)
 {
         int i;
         for (i = 0; i < env->numautos; i++) {
                 STKVAL *pptr = env->auto_ptr[i];
-                mf_c_val(*pptr,str) += offset; /*FIXME*/
+                if (pptr)
+                        mf_c_val(*pptr,str) += offset; /*FIXME*/
         }
 }
 
 
 int
 expand_dataseg(eval_environ_t env, size_t count, const char *errtext)
@@ -796,13 +803,13 @@ heap_obstack_finish(eval_environ_t env)
 void *
 heap_obstack_grow(eval_environ_t env, void * MFL_DATASEG ptr, size_t size)
 {
         size_t words = B2STACK(size);
         char *ret;
 
-        env_register_auto(env, ptr);
+        env_register_auto(env, (void*) &ptr);
         if (env->tos - env->toh < words + B2STACK(env->temp_size))
                 expand_dataseg(env, words,
                                _("memory chunk too big to fit into heap"));
         ret = (char*) env_data_ref(env, env->temp_start) + env->temp_size;
         if (ptr)
                 memmove(ret, ptr, size);
@@ -826,13 +833,13 @@ env_data_ref(eval_environ_t env, size_t off)
 
 void
 pushs(eval_environ_t env, const char * MFL_DATASEG s)
 {
         size_t off;
 
-        env_register_auto(env, (void*) s);
+        env_register_auto(env, (void*) &s);
         off = heap_reserve(env, strlen(s) + 1);
         strcpy((char*) env_data_ref(env, off), s);
         env_pop_auto(env);
         push(env, (STKVAL) off);
 }