diff options
| author | dgp <dgp@users.sourceforge.net> | 2009-03-20 14:22:54 (GMT) |
|---|---|---|
| committer | dgp <dgp@users.sourceforge.net> | 2009-03-20 14:22:54 (GMT) |
| commit | a8d345d8f8f69ab77a2110e5838f61475ec15c8f (patch) | |
| tree | ce7b88edde595de34cd2601e67e73645448852ff | |
| parent | 653bcd908ccbb5daff9e2e4b6e01f64076a9247a (diff) | |
| download | tcl-a8d345d8f8f69ab77a2110e5838f61475ec15c8f.zip tcl-a8d345d8f8f69ab77a2110e5838f61475ec15c8f.tar.gz tcl-a8d345d8f8f69ab77a2110e5838f61475ec15c8f.tar.bz2 | |
* generic/tclExecute.c (INST_CONCAT1): Panic when appends overflow
the max length of a Tcl value. [Bug 2669109]
| -rw-r--r-- | ChangeLog | 5 | ||||
| -rw-r--r-- | generic/tclExecute.c | 10 |
2 files changed, 13 insertions, 2 deletions
@@ -1,3 +1,8 @@ +2009-03-20 Don Porter <dgp@users.sourceforge.net> + + * generic/tclExecute.c (INST_CONCAT1): Panic when appends overflow + the max length of a Tcl value. [Bug 2669109] + 2009-03-18 Don Porter <dgp@users.sourceforge.net> * win/tclWinFile.c (TclpObjNormalizePath): Corrected Tcl_Obj leak. diff --git a/generic/tclExecute.c b/generic/tclExecute.c index 657ac80..065024c 100644 --- a/generic/tclExecute.c +++ b/generic/tclExecute.c @@ -11,7 +11,7 @@ * See the file "license.terms" for information on usage and redistribution * of this file, and for a DISCLAIMER OF ALL WARRANTIES. * - * RCS: @(#) $Id: tclExecute.c,v 1.94.2.27 2008/07/23 04:08:00 dgp Exp $ + * RCS: @(#) $Id: tclExecute.c,v 1.94.2.28 2009/03/20 14:22:54 dgp Exp $ */ #include "tclInt.h" @@ -1442,13 +1442,19 @@ TclExecuteByteCode(interp, codePtr) * First, determine how many characters are needed. */ - for (i = (stackTop - (opnd-1)); i <= stackTop; i++) { + for (i = (stackTop - (opnd-1)); + totalLen >= 0 && i <= stackTop; i++) { bytes = Tcl_GetStringFromObj(stackPtr[i], &length); if (bytes != NULL) { totalLen += length; } } + if (totalLen < 0) { + Tcl_Panic("max size for a Tcl value (%d bytes) exceeded", + INT_MAX); + } + /* * Initialize the new append string object by appending the * strings of the opnd stack objects. Also pop the objects. |