* generic/tclStringObj.c: A few more string overflow cases in

        [format].  [Bug 2845535]

2 files changed, 18 insertions, 3 deletions

diff --git a/ChangeLog b/ChangeLog
index 45345ea..9567753 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2009-08-27  Don Porter  <dgp@users.sourceforge.net>
+
+	* generic/tclStringObj.c:	A few more string overflow cases in
+	[format].  [Bug 2845535]
+
 2009-08-25  Andreas Kupries  <andreask@activestate.com>
 
 	* generic/tclBasic.c (Tcl_CreateInterp, Tcl_EvalTokensStandard,
diff --git a/generic/tclStringObj.c b/generic/tclStringObj.c
index 6e202d5..2289659 100644
--- a/generic/tclStringObj.c
+++ b/generic/tclStringObj.c
@@ -33,7 +33,7 @@
  * See the file "license.terms" for information on usage and redistribution of
  * this file, and for a DISCLAIMER OF ALL WARRANTIES.
  *
- * RCS: @(#) $Id: tclStringObj.c,v 1.70.2.17 2009/07/31 16:56:32 dgp Exp $ */
+ * RCS: @(#) $Id: tclStringObj.c,v 1.70.2.18 2009/08/27 19:33:24 dgp Exp $ */
 
 #include "tclInt.h"
 #include "tommath.h"
@@ -2363,6 +2363,10 @@ Tcl_AppendFormatToObj(
 	    if (gotPrecision) {
 		*p++ = '.';
 		p += sprintf(p, "%d", precision);
+		if (precision > INT_MAX - length) {
+		    msg=overflow;
+		    goto errorMsg;
+		}
 		length += precision;
 	    }
 
@@ -2375,9 +2379,15 @@ Tcl_AppendFormatToObj(
 
 	    segment = Tcl_NewObj();
 	    allocSegment = 1;
-	    Tcl_SetObjLength(segment, length);
+	    if (!Tcl_AttemptSetObjLength(segment, length)) {
+		msg = overflow;
+		goto errorMsg;
+	    }
 	    bytes = TclGetString(segment);
-	    Tcl_SetObjLength(segment, sprintf(bytes, spec, d));
+	    if (!Tcl_AttemptSetObjLength(segment, sprintf(bytes, spec, d))) {
+		msg = overflow;
+		goto errorMsg;
+	    }
 	    break;
 	}
 	default: