3371644 Repair failure to properly handle (length == -1) in TclConvertElement().

3 files changed, 12 insertions, 6 deletions

diff --git a/ChangeLog b/ChangeLog
index 1a0e4dc..3ae93bc 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,6 +1,8 @@
-2011-07-19 Alexandre Ferrieux  <ferrieux@users.sourceforge.net>
+2011-07-19  Don Porter  <dgp@users.sourceforge.net>
 
-	* generic/tclUtil.c: Fix [bug 3371644] -- crash on Tcl_ConvertElement with leading pound.
+	* generic/tclUtil.c:	[Bug 3371644] Repair failure to properly handle 
+	* tests/util.test: (length == -1) scanning in TclConvertElement().
+	Thanks to Thomas Sader and Alexandre Ferrieux.
 
 2011-07-19  Donal K. Fellows  <dkf@users.sf.net>
 
diff --git a/generic/tclUtil.c b/generic/tclUtil.c
index 55103e3..51508d2 100644
--- a/generic/tclUtil.c
+++ b/generic/tclUtil.c
@@ -1261,9 +1261,7 @@ int TclConvertElement(
 	    p[1] = '#';
 	    p += 2;
 	    src++;
-	    if (length > 0) {
-		length--;
-	    }
+	    length -= (length > 0);
 	} else {
 	    conversion = CONVERT_BRACE;
 	}
diff --git a/tests/util.test b/tests/util.test
index d06925b..15457da 100644
--- a/tests/util.test
+++ b/tests/util.test
@@ -175,6 +175,12 @@ test util-3.5.1 {Tcl_ConverCountedElement procedure - quote leading '#'} {
     rename #\{ {}
     set result
 } {#}
+test util-3.6 {Tcl_ConvertElement, Bug 3371644} {
+    interp create #\\
+    interp alias {} x #\\ concat
+    interp target {} x ;# Crash if bug not fixed
+    interp delete #\\
+} {}
 
 test util-4.1 {Tcl_ConcatObj - backslash-space at end of argument} {
     concat a {b\ } c
@@ -3895,4 +3901,4 @@ return
 
 # Local Variables:
 # mode: tcl
-# End:
+# End:
\ No newline at end of file