diff options
| author | dgp <dgp@noemail.net> | 2012-09-06 19:01:32 (GMT) |
|---|---|---|
| committer | dgp <dgp@noemail.net> | 2012-09-06 19:01:32 (GMT) |
| commit | 76049aa74d5ec1c90c13b1d5148fb5af99664dc8 (patch) | |
| tree | 144b06b527e0bc0ae8420df93c1482f918544578 | |
| parent | 8a183f883e53f34be517210fb2a7ff39df1f0625 (diff) | |
| download | tcl-76049aa74d5ec1c90c13b1d5148fb5af99664dc8.zip tcl-76049aa74d5ec1c90c13b1d5148fb5af99664dc8.tar.gz tcl-76049aa74d5ec1c90c13b1d5148fb5af99664dc8.tar.bz2 | |
3564735 Protection against namespace var resolvers that unexpectedly return
a pointer to Var while Tcl expects pointer to VarInHash. This may not be
the total solution to Bug 3564735 (Itcl may be misbehaving), but this will
prevent memory corruption.
FossilOrigin-Name: b0ffeaec95e36676403fb68bd016656b4006fecd
| -rw-r--r-- | generic/tclInt.h | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/generic/tclInt.h b/generic/tclInt.h index e1ce6d5..cca9938 100644 --- a/generic/tclInt.h +++ b/generic/tclInt.h @@ -693,13 +693,17 @@ typedef struct VarInHash { #define TclSetVarNamespaceVar(varPtr) \ if (!TclIsVarNamespaceVar(varPtr)) {\ (varPtr)->flags |= VAR_NAMESPACE_VAR;\ - ((VarInHash *)(varPtr))->refCount++;\ + if (TclIsVarInHash(varPtr)) {\ + ((VarInHash *)(varPtr))->refCount++;\ + }\ } #define TclClearVarNamespaceVar(varPtr) \ if (TclIsVarNamespaceVar(varPtr)) {\ (varPtr)->flags &= ~VAR_NAMESPACE_VAR;\ - ((VarInHash *)(varPtr))->refCount--;\ + if (TclIsVarInHash(varPtr)) {\ + ((VarInHash *)(varPtr))->refCount--;\ + }\ } /* |