3371644 Repair failure to properly handle (length == -1) in TclConvertElement().

3 files changed, 13 insertions, 2 deletions

diff --git a/ChangeLog b/ChangeLog
index 8e9dcff..d5a3648 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2011-07-19  Don Porter  <dgp@users.sourceforge.net>
+
+	* generic/tclUtil.c:	[Bug 3371644] Repair failure to properly handle 
+	* tests/util.test: (length == -1) scanning in TclConvertElement().
+
 2011-07-15  Don Porter  <dgp@users.sourceforge.net>
 
 	* generic/tclCompile.c: Avoid segfaults when RecordByteCodeStats()
diff --git a/generic/tclUtil.c b/generic/tclUtil.c
index f5c2926..eaa7eae 100644
--- a/generic/tclUtil.c
+++ b/generic/tclUtil.c
@@ -1253,7 +1253,7 @@ int TclConvertElement(
 	    p[1] = '#';
 	    p += 2;
 	    src++;
-	    length--;
+	    length -= (length > 0);
 	} else {
 	    conversion = CONVERT_BRACE;
 	}
diff --git a/tests/util.test b/tests/util.test
index 6a0785e..c910b43 100644
--- a/tests/util.test
+++ b/tests/util.test
@@ -174,6 +174,12 @@ test util-3.5.1 {Tcl_ConverCountedElement procedure - quote leading '#'} {
     rename #\{ {}
     set result
 } {#}
+test util-3.6 {Tcl_ConvertElement, Bug 3371644} {
+    interp create #\\
+    interp alias {} x #\\ concat
+    interp target {} x ;# Crash if bug not fixed
+    interp delete #\\
+} {}
 
 test util-4.1 {Tcl_ConcatObj - backslash-space at end of argument} {
     concat a {b\ } c
@@ -3889,4 +3895,4 @@ return
 
 # Local Variables:
 # mode: tcl
-# End:
\ No newline at end of file
+# End: