diff options
| author | dgp <dgp@users.sourceforge.net> | 2015-07-29 10:03:46 (GMT) |
|---|---|---|
| committer | dgp <dgp@users.sourceforge.net> | 2015-07-29 10:03:46 (GMT) |
| commit | e863ec8015f6bff1a8017b6557ba0b7cb9d7d039 (patch) | |
| tree | 1e3ea3f23684b15df034aeddacfbcdd4d1039762 | |
| parent | 0dfed6948cae4e926c49b5fc888b4b74b247a262 (diff) | |
| parent | 96585a0ae4cf7d41417955b92a4491510101b38e (diff) | |
| download | tcl-e863ec8015f6bff1a8017b6557ba0b7cb9d7d039.zip tcl-e863ec8015f6bff1a8017b6557ba0b7cb9d7d039.tar.gz tcl-e863ec8015f6bff1a8017b6557ba0b7cb9d7d039.tar.bz2 | |
[3e7eca8c8c] Prevent overflow in the size value passed to ckrealloc().
| -rw-r--r-- | generic/tclCompExpr.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/generic/tclCompExpr.c b/generic/tclCompExpr.c index 38c1ceb..50edbec 100644 --- a/generic/tclCompExpr.c +++ b/generic/tclCompExpr.c @@ -663,10 +663,12 @@ ParseExpr( if (nodesUsed >= nodesAvailable) { int size = nodesUsed * 2; - OpNode *newPtr; + OpNode *newPtr = NULL; do { + if (size <= UINT_MAX/sizeof(OpNode)) { newPtr = attemptckrealloc(nodes, size * sizeof(OpNode)); + } } while ((newPtr == NULL) && ((size -= (size - nodesUsed) / 2) > nodesUsed)); if (newPtr == NULL) { |