When using Tcl_SetObjLength() calls to grow and shrink the objPtr->bytes buffer,

care must be taken that the value cannot possibly become pure Unicode.  Calling
Tcl_AppendToObj() has the possibility of making such a conversion.  Bug found
while valgrinding the trunk.

3 files changed, 11 insertions, 3 deletions

diff --git a/ChangeLog b/ChangeLog
index fad0871..1769bd9 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2012-05-21  Don Porter  <dgp@users.sourceforge.net>
+
+	* generic/tclFileName.c:	When using Tcl_SetObjLength() calls to grow
+	* generic/tclIOUtil.c:	and shrink the objPtr->bytes buffer, care must be
+	taken that the value cannot possibly become pure Unicode.  Calling
+	Tcl_AppendToObj() has the possibility of making such a conversion.  Bug
+	found while valgrinding the trunk.
+
 2012-05-17  Donal K. Fellows  <dkf@users.sf.net>
 
 	* doc/expr.n: [Bug 3525462]: Corrected statement about what happens
diff --git a/generic/tclFileName.c b/generic/tclFileName.c
index 761c8be..c5ecf0f 100644
--- a/generic/tclFileName.c
+++ b/generic/tclFileName.c
@@ -1155,7 +1155,7 @@ TclpNativeJoinPath(prefix, joining)
 
 	    if (length > 0 && (start[length-1] != '/')) {
 		Tcl_AppendToObj(prefix, "/", 1);
-		length++;
+		Tcl_GetStringFromObj(prefix, &length);
 	    }
 	    needsSep = 0;
 	    
@@ -1194,7 +1194,7 @@ TclpNativeJoinPath(prefix, joining)
 	    if ((length > 0) && 
 		(start[length-1] != '/') && (start[length-1] != ':')) {
 		Tcl_AppendToObj(prefix, "/", 1);
-		length++;
+		Tcl_GetStringFromObj(prefix, &length);
 	    }
 	    needsSep = 0;
 	    
diff --git a/generic/tclIOUtil.c b/generic/tclIOUtil.c
index d50f2e3..40f3f76 100644
--- a/generic/tclIOUtil.c
+++ b/generic/tclIOUtil.c
@@ -4977,7 +4977,7 @@ Tcl_FSJoinPath(listObj, elements)
 
 	    if (length > 0 && ptr[length -1] != '/') {
 		Tcl_AppendToObj(res, &separator, 1);
-		length++;
+		Tcl_GetStringFromObj(res, &length);
 	    }
 	    Tcl_SetObjLength(res, length + (int) strlen(strElt));