summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorjan.nijtmans <nijtmans@users.sourceforge.net>2012-01-21 08:19:10 (GMT)
committerjan.nijtmans <nijtmans@users.sourceforge.net>2012-01-21 08:19:10 (GMT)
commit1fee70e19851cf0cd15e831a21a558dc898045d7 (patch)
tree0fb9168e970ce41111b49bbf2fef5af1c58e0151
parent39c48e8c29a2e3955bb342c100298c8a27b31372 (diff)
parent868168e18953894ec72ea898ff4d2f518283184e (diff)
downloadtcl-1fee70e19851cf0cd15e831a21a558dc898045d7.zip
tcl-1fee70e19851cf0cd15e831a21a558dc898045d7.tar.gz
tcl-1fee70e19851cf0cd15e831a21a558dc898045d7.tar.bz2
Prevent buffer read overflow. Thanks to "sebres" for the report and fix.
-rw-r--r--ChangeLog5
-rw-r--r--generic/tclCmdMZ.c2
2 files changed, 6 insertions, 1 deletions
diff --git a/ChangeLog b/ChangeLog
index 0f19ea4..85b7534 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2012-01-19 Don Porter <dgp@users.sourceforge.net>
+
+ * generic/tclCmdMZ.c: [Bug 3475667] Prevent buffer read overflow.
+ Thanks to "sebres" for the report and fix.
+
2012-01-17 Donal K. Fellows <dkf@users.sf.net>
* doc/dict.n (dict with): [Bug 3474512]: Explain better what is going
diff --git a/generic/tclCmdMZ.c b/generic/tclCmdMZ.c
index 60a9414..ab673d5 100644
--- a/generic/tclCmdMZ.c
+++ b/generic/tclCmdMZ.c
@@ -264,7 +264,7 @@ Tcl_RegexpObjCmd(
* start of the string unless the previous character is a newline.
*/
- if ((offset == 0) || ((offset > 0) &&
+ if ((offset == 0) || ((offset > 0) && (offset < stringLength) &&
(Tcl_GetUniChar(objPtr, offset-1) == (Tcl_UniChar)'\n'))) {
eflags = 0;
} else {