summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authordgp <dgp@users.sourceforge.net>2015-11-20 16:58:11 (GMT)
committerdgp <dgp@users.sourceforge.net>2015-11-20 16:58:11 (GMT)
commitdfbac0054227702fab645e6c03d08c35a8dd9b7c (patch)
treec017d91bb480b148b21901dc15d6208e37ac6b96
parentc32d032cbd7947d9e64e931df87fc4f374d81e7f (diff)
downloadtcl-dfbac0054227702fab645e6c03d08c35a8dd9b7c.zip
tcl-dfbac0054227702fab645e6c03d08c35a8dd9b7c.tar.gz
tcl-dfbac0054227702fab645e6c03d08c35a8dd9b7c.tar.bz2
[3293874] Simplified fix (not backport). Also detect >LIST_MAX early.
-rw-r--r--generic/tclListObj.c10
1 files changed, 9 insertions, 1 deletions
diff --git a/generic/tclListObj.c b/generic/tclListObj.c
index 289cf2d..c4b5cfc 100644
--- a/generic/tclListObj.c
+++ b/generic/tclListObj.c
@@ -854,8 +854,13 @@ Tcl_ListObjReplace(
count = numElems - first;
}
+ if (objc > LIST_MAX - (numElems - count)) {
+ Tcl_SetObjResult(interp, Tcl_ObjPrintf(
+ "max length of a Tcl list (%d elements) exceeded", LIST_MAX));
+ return TCL_ERROR;
+ }
isShared = (listRepPtr->refCount > 1);
- numRequired = numElems - count + objc;
+ numRequired = numElems - count + objc; /* Known <= LIST_MAX */
for (i = 0; i < objc; i++) {
Tcl_IncrRefCount(objv[i]);
@@ -906,6 +911,8 @@ Tcl_ListObjReplace(
listRepPtr = AttemptNewList(interp, newMax, NULL);
if (listRepPtr == NULL) {
+ listRepPtr = AttemptNewList(interp, numRequired, NULL);
+ if (listRepPtr == NULL) {
for (i = 0; i < objc; i++) {
/* See bug 3598580 */
#if TCL_MAJOR_VERSION > 8
@@ -916,6 +923,7 @@ Tcl_ListObjReplace(
}
return TCL_ERROR;
}
+ }
listPtr->internalRep.twoPtrValue.ptr1 = (void *) listRepPtr;
listRepPtr->refCount++;