* tests/string.test: string-10.[21-30]

	* generic/tclCmdMZ.c (Tcl_StringObjCmd): add extra checks to
	prevent possible UMR in unichar cmp function for string map.

3 files changed, 55 insertions, 16 deletions

diff --git a/ChangeLog b/ChangeLog
index 0d98a5a..85c486b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2005-05-10  Jeff Hobbs  <jeffh@ActiveState.com>
+
+	* tests/string.test: string-10.[21-30]
+	* generic/tclCmdMZ.c (Tcl_StringObjCmd): add extra checks to
+	prevent possible UMR in unichar cmp function for string map.
+
 2005-05-06  Jeff Hobbs  <jeffh@ActiveState.com>
 
 	* unix/tcl.m4, unix/configure: correct Solaris 10 (5.10) check and
@@ -20,10 +26,10 @@
 	* compat/string.h: fixed memchr() protoype for __APPLE__ so that we
 	build on Mac OS X 10.1 again.
 
-	* generic/tclNotify.c (TclFinalizeNotifier): fixed notifier not being
-	finalized in unthreaded core (was testing for notifier initialization in
-	current thread by checking thread id != 0 but thread id is always 0 in
-	untreaded core).
+	* generic/tclNotify.c (TclFinalizeNotifier): fixed notifier not
+	being finalized in unthreaded core (was testing for notifier
+	initialization in current thread by checking thread id != 0 but
+	thread id is always 0 in untreaded core).
 
 	* unix/tclUnixNotfy.c (Tcl_WaitForEvent): sync with HEAD: only declare
 	and use timeout var in unthreaded core.
@@ -36,12 +42,12 @@
 	unavailable, otherwise compat/strstr.o will be used twice (resulting in
 	duplicate symbol link errors on Mac OS X 10.1)
 	
-	* unix/tcl.m4 (Darwin): added configure checks for recently added linker
-	flags -single_module and -search_paths_first to allow building with
-	older tools (and on Mac OS X 10.1), use -single_module in SHLIB_LD and
-	not just T{CL,K}_SHLIB_LD_EXTRAS, added unexporting from Tk of symbols
-	from libtclstub to avoid duplicate symbol warnings, added PLAT_SRCS
-	definition for Mac OS X.
+	* unix/tcl.m4 (Darwin): added configure checks for recently added
+	linker flags -single_module and -search_paths_first to allow
+	building with older tools (and on Mac OS X 10.1), use
+	-single_module in SHLIB_LD and not just T{CL,K}_SHLIB_LD_EXTRAS,
+	added unexporting from Tk of symbols from libtclstub to avoid
+	duplicate symbol warnings, added PLAT_SRCS definition for Mac OS X.
 	(SC_MISSING_POSIX_HEADERS): added caching of dirent.h check.
 	(SC_TCL_64BIT_FLAGS): fixed 'checking for off64_t' message output.
 
@@ -59,9 +65,9 @@
 
 2005-04-20  Don Porter  <dgp@users.sourceforge.net>
 
-        * generic/tclGet.c (Tcl_GetInt):        Corrected error that did not
-        * generic/tclObj.c (Tcl_GetIntFromObj): permit 0x80000000 to be
-        recognized as an integer on TCL_WIDE_INT_IS_LONG systems [Bug 1090869].
+	* generic/tclGet.c (Tcl_GetInt):	Corrected error that did not
+	* generic/tclObj.c (Tcl_GetIntFromObj): permit 0x80000000 to be
+	recognized as an integer on TCL_WIDE_INT_IS_LONG systems [Bug 1090869].
 
 2005-04-19  Jeff Hobbs  <jeffh@ActiveState.com>
 
diff --git a/generic/tclCmdMZ.c b/generic/tclCmdMZ.c
index 45a2bed..c61afc5 100644
--- a/generic/tclCmdMZ.c
+++ b/generic/tclCmdMZ.c
@@ -14,7 +14,7 @@
  * See the file "license.terms" for information on usage and redistribution
  * of this file, and for a DISCLAIMER OF ALL WARRANTIES.
  *
- * RCS: @(#) $Id: tclCmdMZ.c,v 1.82.2.16 2005/04/22 16:30:02 dgp Exp $
+ * RCS: @(#) $Id: tclCmdMZ.c,v 1.82.2.17 2005/05/11 00:48:01 hobbs Exp $
  */
 
 #include "tclInt.h"
@@ -1936,7 +1936,8 @@ Tcl_StringObjCmd(dummy, interp, objc, objv)
 
 		ustring2 = Tcl_GetUnicodeFromObj(mapElemv[0], &length2);
 		p = ustring1;
-		if (length2 == 0) {
+		if ((length2 > length1) || (length2 == 0)) {
+		    /* match string is either longer than input or empty */
 		    ustring1 = end;
 		} else {
 		    mapString = Tcl_GetUnicodeFromObj(mapElemv[1], &mapLen);
@@ -1994,6 +1995,8 @@ Tcl_StringObjCmd(dummy, interp, objc, objv)
 			if ((length2 > 0) && ((*ustring1 == *ustring2) ||
 				(nocase && (Tcl_UniCharToLower(*ustring1) ==
 					u2lc[index/2]))) &&
+				/* restrict max compare length */
+				((end - ustring1) >= length2) &&
 				((length2 == 1) || strCmpFn(ustring2, ustring1,
 					(unsigned long) length2) == 0)) {
 			    if (p != ustring1) {
diff --git a/tests/string.test b/tests/string.test
index 71e94ec..ec730b7 100644
--- a/tests/string.test
+++ b/tests/string.test
@@ -12,7 +12,7 @@
 # See the file "license.terms" for information on usage and redistribution
 # of this file, and for a DISCLAIMER OF ALL WARRANTIES.
 #
-# RCS: @(#) $Id: string.test,v 1.36.2.4 2005/04/22 16:30:10 dgp Exp $
+# RCS: @(#) $Id: string.test,v 1.36.2.5 2005/05/11 00:48:01 hobbs Exp $
 
 if {[lsearch [namespace children] ::tcltest] == -1} {
     package require tcltest
@@ -766,6 +766,36 @@ test string-10.20 {string map, nasty sharing crash from [Bug 1018562]} {
     set a {a b}
     string map $a $a
 } {b b}
+test string-10.21 {string map, ABR checks} {
+    string map {longstring foob} long
+} long
+test string-10.22 {string map, ABR checks} {
+    string map {long foob} long
+} foob
+test string-10.23 {string map, ABR checks} {
+    string map {lon foob} long
+} foobg
+test string-10.24 {string map, ABR checks} {
+    string map {lon foob} longlo
+} foobglo
+test string-10.25 {string map, ABR checks} {
+    string map {lon foob} longlon
+} foobgfoob
+test string-10.26 {string map, ABR checks} {
+    string map {longstring foob longstring bar} long
+} long
+test string-10.27 {string map, ABR checks} {
+    string map {long foob longstring bar} long
+} foob
+test string-10.28 {string map, ABR checks} {
+    string map {lon foob longstring bar} long
+} foobg
+test string-10.29 {string map, ABR checks} {
+    string map {lon foob longstring bar} longlo
+} foobglo
+test string-10.30 {string map, ABR checks} {
+    string map {lon foob longstring bar} longlon
+} foobgfoob
 
 test string-11.1 {string match, too few args} {
     list [catch {string match a} msg] $msg