summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authordgp <dgp@users.sourceforge.net>2015-11-20 16:59:55 (GMT)
committerdgp <dgp@users.sourceforge.net>2015-11-20 16:59:55 (GMT)
commit67929efb233a934a2d625216ee8d3b1d8022d33e (patch)
tree920bfb5bca1221572d6f4a11a7a2c1732df367c9
parentb043297e8b02ea12c45a49b4cea4dcaa50da99b3 (diff)
parentdfbac0054227702fab645e6c03d08c35a8dd9b7c (diff)
downloadtcl-67929efb233a934a2d625216ee8d3b1d8022d33e.zip
tcl-67929efb233a934a2d625216ee8d3b1d8022d33e.tar.gz
tcl-67929efb233a934a2d625216ee8d3b1d8022d33e.tar.bz2
Tcl_ListObjReplace() early out when > LIST_MAX attempted.
-rw-r--r--generic/tclListObj.c7
1 files changed, 6 insertions, 1 deletions
diff --git a/generic/tclListObj.c b/generic/tclListObj.c
index fa67ee6..0dfa845 100644
--- a/generic/tclListObj.c
+++ b/generic/tclListObj.c
@@ -906,8 +906,13 @@ Tcl_ListObjReplace(
count = numElems - first;
}
+ if (objc > LIST_MAX - (numElems - count)) {
+ Tcl_SetObjResult(interp, Tcl_ObjPrintf(
+ "max length of a Tcl list (%d elements) exceeded", LIST_MAX));
+ return TCL_ERROR;
+ }
isShared = (listRepPtr->refCount > 1);
- numRequired = numElems - count + objc;
+ numRequired = numElems - count + objc; /* Known <= LIST_MAX */
for (i = 0; i < objc; i++) {
Tcl_IncrRefCount(objv[i]);