diff options
| author | dgp <dgp@users.sourceforge.net> | 2015-07-29 03:06:30 (GMT) |
|---|---|---|
| committer | dgp <dgp@users.sourceforge.net> | 2015-07-29 03:06:30 (GMT) |
| commit | 96585a0ae4cf7d41417955b92a4491510101b38e (patch) | |
| tree | ff330788f36aed09bec54d44ad583b68678569eb | |
| parent | 61947d12ec0d917d65a31b72dd14c2ee52c2ce5a (diff) | |
| download | tcl-96585a0ae4cf7d41417955b92a4491510101b38e.zip tcl-96585a0ae4cf7d41417955b92a4491510101b38e.tar.gz tcl-96585a0ae4cf7d41417955b92a4491510101b38e.tar.bz2 | |
[3e7eca8c8c] Prevent overflow in the size value passed to ckrealloc().
| -rw-r--r-- | generic/tclCompExpr.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/generic/tclCompExpr.c b/generic/tclCompExpr.c index 23dc0a4..abb917f 100644 --- a/generic/tclCompExpr.c +++ b/generic/tclCompExpr.c @@ -659,11 +659,13 @@ ParseExpr( if (nodesUsed >= nodesAvailable) { int size = nodesUsed * 2; - OpNode *newPtr; + OpNode *newPtr = NULL; do { + if (size <= UINT_MAX/sizeof(OpNode)) { newPtr = (OpNode *) attemptckrealloc((char *) nodes, (unsigned int) size * sizeof(OpNode)); + } } while ((newPtr == NULL) && ((size -= (size - nodesUsed) / 2) > nodesUsed)); if (newPtr == NULL) { |