summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorandreas_kupries <akupries@shaw.ca>2007-02-26 23:27:48 (GMT)
committerandreas_kupries <akupries@shaw.ca>2007-02-26 23:27:48 (GMT)
commit8b97cae9489a09e264bd03416686ed7fbaa363c2 (patch)
treea6a3d330417ce2cb6db9fffbc0c488de4290e871
parent1f1d5fbf52282c44556d4e7c81ce8814c7fe6035 (diff)
downloadtcl-8b97cae9489a09e264bd03416686ed7fbaa363c2.zip
tcl-8b97cae9489a09e264bd03416686ed7fbaa363c2.tar.gz
tcl-8b97cae9489a09e264bd03416686ed7fbaa363c2.tar.bz2
* generic/tclIORChan.c (FreeReflectedChannel): Added the missing
refcount release between NewRC and FreeRC for the channel handle object, spotted by Don Porter. This fixes the bug 1667990.
-rw-r--r--ChangeLog6
-rw-r--r--generic/tclIORChan.c11
2 files changed, 16 insertions, 1 deletions
diff --git a/ChangeLog b/ChangeLog
index 427c246..2b6344c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2007-02-26 Andreas Kupries <andreask@activestate.com>
+
+ * generic/tclIORChan.c (FreeReflectedChannel): Added the missing
+ refcount release between NewRC and FreeRC for the channel handle
+ object, spotted by Don Porter. This fixes the bug 1667990.
+
2007-02-26 Don Porter <dgp@users.sourceforge.net>
* generic/tclCmdAH.c (Tcl_ForeachObjCmd): Removed surplus copying
diff --git a/generic/tclIORChan.c b/generic/tclIORChan.c
index fcb40a7..2ea4870 100644
--- a/generic/tclIORChan.c
+++ b/generic/tclIORChan.c
@@ -15,7 +15,7 @@
* See the file "license.terms" for information on usage and redistribution of
* this file, and for a DISCLAIMER OF ALL WARRANTIES.
*
- * RCS: @(#) $Id: tclIORChan.c,v 1.19 2007/02/20 23:24:04 nijtmans Exp $
+ * RCS: @(#) $Id: tclIORChan.c,v 1.20 2007/02/26 23:27:49 andreas_kupries Exp $
*/
#include <tclInt.h>
@@ -1860,6 +1860,9 @@ NewReflectedChannel(
i++; /* Skip placeholder for method */
+ /*
+ * [SF Bug 1667990] See [x] in FreeReflectedChannel for release
+ */
rcPtr->argv[i] = handleObj;
Tcl_IncrRefCount(handleObj);
@@ -1936,6 +1939,12 @@ FreeReflectedChannel(rcPtr)
Tcl_DecrRefCount(rcPtr->argv[i]);
}
+ /*
+ * [SF Bug 1667990] See [x] in NewReflectedChannel for lock
+ * n+1 = argc-1.
+ */
+ Tcl_IncrRefCount(rcPtr->argv[n+1]);
+
ckfree((char*) rcPtr->argv);
ckfree((char*) rcPtr);
}