summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorjan.nijtmans <nijtmans@users.sourceforge.net>2012-12-27 14:57:32 (GMT)
committerjan.nijtmans <nijtmans@users.sourceforge.net>2012-12-27 14:57:32 (GMT)
commit74ba8ceda7f5765eb6d06f6bac99f565b9a71154 (patch)
tree30f9805cad842d36d4e5474c555a4248fc2364db
parentd525cce307b002900a04c58a4adff1470f24202c (diff)
parent20253b8c7d3f3c59314380703be48df859cdf9e6 (diff)
downloadtcl-74ba8ceda7f5765eb6d06f6bac99f565b9a71154.zip
tcl-74ba8ceda7f5765eb6d06f6bac99f565b9a71154.tar.gz
tcl-74ba8ceda7f5765eb6d06f6bac99f565b9a71154.tar.bz2
[Bug 3598580]: Tcl_ListObjReplace may release deleted elements too early
-rw-r--r--ChangeLog5
-rw-r--r--generic/tclListObj.c9
2 files changed, 10 insertions, 4 deletions
diff --git a/ChangeLog b/ChangeLog
index 147224d..f1eb346 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2012-12-27 Jan Nijtmans <nijtmans@users.sf.net>
+
+ * generic/tclListObj.c: [Bug 3598580]: Tcl_ListObjReplace may release
+ deleted elements too early
+
2012-12-21 Jan Nijtmans <nijtmans@users.sf.net>
* unix/dltest/pkgb.c: Make pkgb.so loadable in Tcl 8.4 as well.
diff --git a/generic/tclListObj.c b/generic/tclListObj.c
index 17aa256..1166759 100644
--- a/generic/tclListObj.c
+++ b/generic/tclListObj.c
@@ -857,6 +857,10 @@ Tcl_ListObjReplace(
isShared = (listRepPtr->refCount > 1);
numRequired = numElems - count + objc;
+ for (i = 0; i < objc; i++) {
+ Tcl_IncrRefCount(objv[i]);
+ }
+
if ((numRequired <= listRepPtr->maxElemCount) && !isShared) {
int shift;
@@ -964,14 +968,11 @@ Tcl_ListObjReplace(
}
/*
- * Insert the new elements into elemPtrs before "first". We don't do a
- * memcpy here because we must increment the reference counts for the
- * added elements, so we must explicitly loop anyway.
+ * Insert the new elements into elemPtrs before "first".
*/
for (i=0,j=first ; i<objc ; i++,j++) {
elemPtrs[j] = objv[i];
- Tcl_IncrRefCount(objv[i]);
}
/*