Only look for the needle when it fits in the haystack. [Bug 2960021]

2 files changed, 21 insertions, 5 deletions

diff --git a/ChangeLog b/ChangeLog
index 7a9fbae..73c15ae 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2010-02-27  Donal K. Fellows  <dkf@users.sf.net>
+
+	* generic/tclCmdMZ.c (StringFirstCmd, StringLastCmd): [Bug 2960021]:
+	Only search for the needle in the haystack when the needle isn't
+	larger than the haystack. Prevents an odd crash from sometimes
+	happening when things get mixed up (a common programming error).
+
 2010-02-21  Jan Nijtmans  <nijtmans@users.sf.net>
 
 	* generic/tclBasic.c:   Fix [Bug 2954959] expr abs(0.0) is -0.0
@@ -5,8 +12,7 @@
 
 2010-02-19  Stuart Cassoff  <stwo@users.sourceforge.net>
 
-	* tcl.m4: Correct compiler/linker flags
-	for threaded builds on OpenBSD.
+	* tcl.m4: Correct compiler/linker flags for threaded builds on OpenBSD
 	* configure: (regenerated).
 
 2010-02-19  Donal K. Fellows  <dkf@users.sf.net>
diff --git a/generic/tclCmdMZ.c b/generic/tclCmdMZ.c
index 1ff2138..70002b5 100644
--- a/generic/tclCmdMZ.c
+++ b/generic/tclCmdMZ.c
@@ -15,7 +15,7 @@
  * See the file "license.terms" for information on usage and redistribution of
  * this file, and for a DISCLAIMER OF ALL WARRANTIES.
  *
- * RCS: @(#) $Id: tclCmdMZ.c,v 1.163.2.5 2009/08/25 21:01:05 andreas_kupries Exp $
+ * RCS: @(#) $Id: tclCmdMZ.c,v 1.163.2.6 2010/02/27 21:25:05 dkf Exp $
  */
 
 #include "tclInt.h"
@@ -1166,7 +1166,12 @@ StringFirstCmd(
 	}
     }
 
-    if (length1 > 0) {
+    /*
+     * If the length of the needle is more than the length of the haystack, it
+     * cannot be contained in there so we can avoid searching. [Bug 2960021]
+     */
+
+    if (length1 > 0 && length1 <= length2) {
 	register Tcl_UniChar *p, *end;
 
 	end = ustring2 + length2 - length1 + 1;
@@ -1269,7 +1274,12 @@ StringLastCmd(
 	p = ustring2 + length2 - length1;
     }
 
-    if (length1 > 0) {
+    /*
+     * If the length of the needle is more than the length of the haystack, it
+     * cannot be contained in there so we can avoid searching. [Bug 2960021]
+     */
+
+    if (length1 > 0 && length1 <= length2) {
 	for (; p >= ustring2; p--) {
 	    /*
 	     * Scan backwards to find the first character.