merge to rc

3 files changed, 14 insertions, 2 deletions

diff --git a/ChangeLog b/ChangeLog
index 62f85e7..f327122 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2011-07-19  Don Porter  <dgp@users.sourceforge.net>
+
+	* generic/tclUtil.c:	[Bug 3371644] Repair failure to properly handle 
+	* tests/util.test: (length == -1) scanning in TclConvertElement().
+	Thanks to Thomas Sader and Alexandre Ferrieux.
+
 2011-07-19  Donal K. Fellows  <dkf@users.sf.net>
 
 	* doc/*.3, doc/*.n: Many small fixes to documentation as part of
diff --git a/generic/tclUtil.c b/generic/tclUtil.c
index 6f36dad..51508d2 100644
--- a/generic/tclUtil.c
+++ b/generic/tclUtil.c
@@ -1261,7 +1261,7 @@ int TclConvertElement(
 	    p[1] = '#';
 	    p += 2;
 	    src++;
-	    length--;
+	    length -= (length > 0);
 	} else {
 	    conversion = CONVERT_BRACE;
 	}
diff --git a/tests/util.test b/tests/util.test
index d06925b..15457da 100644
--- a/tests/util.test
+++ b/tests/util.test
@@ -175,6 +175,12 @@ test util-3.5.1 {Tcl_ConverCountedElement procedure - quote leading '#'} {
     rename #\{ {}
     set result
 } {#}
+test util-3.6 {Tcl_ConvertElement, Bug 3371644} {
+    interp create #\\
+    interp alias {} x #\\ concat
+    interp target {} x ;# Crash if bug not fixed
+    interp delete #\\
+} {}
 
 test util-4.1 {Tcl_ConcatObj - backslash-space at end of argument} {
     concat a {b\ } c
@@ -3895,4 +3901,4 @@ return
 
 # Local Variables:
 # mode: tcl
-# End:
+# End:
\ No newline at end of file