diff options
| author | jan.nijtmans <nijtmans@users.sourceforge.net> | 2022-01-12 15:50:30 (GMT) |
|---|---|---|
| committer | jan.nijtmans <nijtmans@users.sourceforge.net> | 2022-01-12 15:50:30 (GMT) |
| commit | 2171b321cf1ec2d7c671d02dfea59860bccc06f2 (patch) | |
| tree | 883ed31b87d287ba4aee8e8daaf1e31c0b1996f7 | |
| parent | 5608e51a46c5ddb594d05a3d9cbeace701b5dcc6 (diff) | |
| download | tcl-2171b321cf1ec2d7c671d02dfea59860bccc06f2.zip tcl-2171b321cf1ec2d7c671d02dfea59860bccc06f2.tar.gz tcl-2171b321cf1ec2d7c671d02dfea59860bccc06f2.tar.bz2 | |
Fix [69218ab7b]: TEBCResume(): buffer over-read in INST_STR_MAP
| -rw-r--r-- | generic/tclExecute.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/generic/tclExecute.c b/generic/tclExecute.c index 7e014d4..aa5730a 100644 --- a/generic/tclExecute.c +++ b/generic/tclExecute.c @@ -5855,7 +5855,9 @@ TEBCresume( p = ustring1; end = ustring1 + length; for (; ustring1 < end; ustring1++) { - if ((*ustring1 == *ustring2) && (length2==1 || + if ((*ustring1 == *ustring2) && + /* Fix bug [69218ab7b]: restrict max compare length. */ + (end-ustring1 >= length2) && (length2==1 || memcmp(ustring1, ustring2, sizeof(Tcl_UniChar) * length2) == 0)) { if (p != ustring1) { |