* tests/string.test: string-10.[21-30]

	* generic/tclCmdMZ.c (Tcl_StringObjCmd): add extra checks to
	prevent possible UMR in unichar cmp function for string map.

3 files changed, 42 insertions, 3 deletions

diff --git a/ChangeLog b/ChangeLog
index c3bcd37..743a58d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2005-05-10  Jeff Hobbs  <jeffh@ActiveState.com>
+
+	* tests/string.test: string-10.[21-30]
+	* generic/tclCmdMZ.c (Tcl_StringObjCmd): add extra checks to
+	prevent possible UMR in unichar cmp function for string map.
+
 2005-05-10  Kevin Kenny  <kennykb@acm.org>
 
 	* generic/tclBinary.c (FormatNumber): Fixed a bug where NaN's
diff --git a/generic/tclCmdMZ.c b/generic/tclCmdMZ.c
index aee76d3..91e4b1e 100644
--- a/generic/tclCmdMZ.c
+++ b/generic/tclCmdMZ.c
@@ -15,7 +15,7 @@
  * See the file "license.terms" for information on usage and redistribution
  * of this file, and for a DISCLAIMER OF ALL WARRANTIES.
  *
- * RCS: @(#) $Id: tclCmdMZ.c,v 1.118 2005/05/10 18:34:08 kennykb Exp $
+ * RCS: @(#) $Id: tclCmdMZ.c,v 1.119 2005/05/11 00:51:28 hobbs Exp $
  */
 
 #include "tclInt.h"
@@ -1907,7 +1907,8 @@ Tcl_StringObjCmd(dummy, interp, objc, objv)
 
 		ustring2 = Tcl_GetUnicodeFromObj(mapElemv[0], &length2);
 		p = ustring1;
-		if (length2 == 0) {
+		if ((length2 > length1) || (length2 == 0)) {
+		    /* match string is either longer than input or empty */
 		    ustring1 = end;
 		} else {
 		    mapString = Tcl_GetUnicodeFromObj(mapElemv[1], &mapLen);
@@ -1965,6 +1966,8 @@ Tcl_StringObjCmd(dummy, interp, objc, objv)
 			if ((length2 > 0) && ((*ustring1 == *ustring2) ||
 				(nocase && (Tcl_UniCharToLower(*ustring1) ==
 					u2lc[index/2]))) &&
+				/* restrict max compare length */
+				((end - ustring1) >= length2) &&
 				((length2 == 1) || strCmpFn(ustring2, ustring1,
 					(unsigned long) length2) == 0)) {
 			    if (p != ustring1) {
diff --git a/tests/string.test b/tests/string.test
index 93939df..1008c42 100644
--- a/tests/string.test
+++ b/tests/string.test
@@ -12,7 +12,7 @@
 # See the file "license.terms" for information on usage and redistribution
 # of this file, and for a DISCLAIMER OF ALL WARRANTIES.
 #
-# RCS: @(#) $Id: string.test,v 1.47 2005/05/10 18:35:24 kennykb Exp $
+# RCS: @(#) $Id: string.test,v 1.48 2005/05/11 00:51:28 hobbs Exp $
 
 if {[lsearch [namespace children] ::tcltest] == -1} {
     package require tcltest
@@ -810,6 +810,36 @@ test string-10.21 {string map, nasty sharing crash from [Bug 1018562]} {
     set a {a b}
     string map $a $a
 } {b b}
+test string-10.21 {string map, ABR checks} {
+    string map {longstring foob} long
+} long
+test string-10.22 {string map, ABR checks} {
+    string map {long foob} long
+} foob
+test string-10.23 {string map, ABR checks} {
+    string map {lon foob} long
+} foobg
+test string-10.24 {string map, ABR checks} {
+    string map {lon foob} longlo
+} foobglo
+test string-10.25 {string map, ABR checks} {
+    string map {lon foob} longlon
+} foobgfoob
+test string-10.26 {string map, ABR checks} {
+    string map {longstring foob longstring bar} long
+} long
+test string-10.27 {string map, ABR checks} {
+    string map {long foob longstring bar} long
+} foob
+test string-10.28 {string map, ABR checks} {
+    string map {lon foob longstring bar} long
+} foobg
+test string-10.29 {string map, ABR checks} {
+    string map {lon foob longstring bar} longlo
+} foobglo
+test string-10.30 {string map, ABR checks} {
+    string map {lon foob longstring bar} longlon
+} foobgfoob
 
 test string-11.1 {string match, too few args} {
     list [catch {string match a} msg] $msg