[Bug 3598580]: Tcl_ListObjReplace may release deleted elements too early

2 files changed, 10 insertions, 4 deletions

diff --git a/ChangeLog b/ChangeLog
index 49da827..43b6dfa 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2012-12-27  Jan Nijtmans  <nijtmans@users.sf.net>
+
+	* generic/tclListObj.c: [Bug 3598580]: Tcl_ListObjReplace may release
+	deleted elements too early
+
 2012-12-22  Alexandre Ferrieux  <ferrieux@users.sourceforge.net>
 
 	* generic/tclUtil.c: Stop leaking allocated space when objifying a
diff --git a/generic/tclListObj.c b/generic/tclListObj.c
index 3668b45..53c3f66 100644
--- a/generic/tclListObj.c
+++ b/generic/tclListObj.c
@@ -909,6 +909,10 @@ Tcl_ListObjReplace(
     isShared = (listRepPtr->refCount > 1);
     numRequired = numElems - count + objc;
 
+    for (i = 0;  i < objc;  i++) {
+	Tcl_IncrRefCount(objv[i]);
+    }
+
     if ((numRequired <= listRepPtr->maxElemCount) && !isShared) {
 	int shift;
 
@@ -1027,14 +1031,11 @@ Tcl_ListObjReplace(
     }
 
     /*
-     * Insert the new elements into elemPtrs before "first". We don't do a
-     * memcpy here because we must increment the reference counts for the
-     * added elements, so we must explicitly loop anyway.
+     * Insert the new elements into elemPtrs before "first".
      */
 
     for (i=0,j=first ; i<objc ; i++,j++) {
 	elemPtrs[j] = objv[i];
-	Tcl_IncrRefCount(objv[i]);
     }
 
     /*