diff options
| author | jan.nijtmans <nijtmans@users.sourceforge.net> | 2022-01-13 13:22:07 (GMT) |
|---|---|---|
| committer | jan.nijtmans <nijtmans@users.sourceforge.net> | 2022-01-13 13:22:07 (GMT) |
| commit | be409f301ed5dff8685300d8f28e0e06711ee22d (patch) | |
| tree | 2af3633addbadbe3413d702823b458fbbe5cced4 | |
| parent | 71c8acf7e6000d377ec146dae352142ad9c3b5f3 (diff) | |
| parent | 2171b321cf1ec2d7c671d02dfea59860bccc06f2 (diff) | |
| download | tcl-be409f301ed5dff8685300d8f28e0e06711ee22d.zip tcl-be409f301ed5dff8685300d8f28e0e06711ee22d.tar.gz tcl-be409f301ed5dff8685300d8f28e0e06711ee22d.tar.bz2 | |
Fix [69218ab7b]: TEBCResume(): buffer over-read in INST_STR_MAP
| -rw-r--r-- | generic/tclExecute.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/generic/tclExecute.c b/generic/tclExecute.c index 5dc506a..e5a6b71 100644 --- a/generic/tclExecute.c +++ b/generic/tclExecute.c @@ -5855,7 +5855,9 @@ TEBCresume( p = ustring1; end = ustring1 + length; for (; ustring1 < end; ustring1++) { - if ((*ustring1 == *ustring2) && (length2==1 || + if ((*ustring1 == *ustring2) && + /* Fix bug [69218ab7b]: restrict max compare length. */ + (end-ustring1 >= length2) && (length2==1 || memcmp(ustring1, ustring2, sizeof(Tcl_UniChar) * length2) == 0)) { if (p != ustring1) { |