* generic/tclBinary.c (UpdateStringOfByteArray): Add panic

        when the generated string representation would grow beyond Tcl's
        size limits.  [Bug 2994924]

2 files changed, 11 insertions, 2 deletions

diff --git a/ChangeLog b/ChangeLog
index cc246f5..dd13e73 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2010-04-30  Don Porter  <dgp@users.sourceforge.net>
+
+	* generic/tclBinary.c (UpdateStringOfByteArray):        Add panic
+	when the generated string representation would grow beyond Tcl's
+	size limits.  [Bug 2994924]
+
 2010-04-29  Andreas Kupries  <andreask@activestate.com>
 
 	* library/platform/platform.tcl: Another stab at getting the /lib,
diff --git a/generic/tclBinary.c b/generic/tclBinary.c
index baea4ba..8708294 100644
--- a/generic/tclBinary.c
+++ b/generic/tclBinary.c
@@ -10,7 +10,7 @@
  * See the file "license.terms" for information on usage and redistribution of
  * this file, and for a DISCLAIMER OF ALL WARRANTIES.
  *
- * RCS: @(#) $Id: tclBinary.c,v 1.41 2008/03/24 03:10:06 patthoyts Exp $
+ * RCS: @(#) $Id: tclBinary.c,v 1.41.2.1 2010/04/30 20:59:20 dgp Exp $
  */
 
 #include "tclInt.h"
@@ -518,11 +518,14 @@ UpdateStringOfByteArray(
      */
 
     size = length;
-    for (i = 0; i < length; i++) {
+    for (i = 0; i < length && size >= 0; i++) {
 	if ((src[i] == 0) || (src[i] > 127)) {
 	    size++;
 	}
     }
+    if (size < 0) {
+	Tcl_Panic("max size for a Tcl value (%d bytes) exceeded", INT_MAX);
+    }
 
     dst = (char *) ckalloc((unsigned) (size + 1));
     objPtr->bytes = dst;