* generic/tclBasic.c:

	* generic/tclCmdMZ.c: fix for freed memory r/w in delete traces
	[Bug 589863], patch by Hemang Lavana.

3 files changed, 27 insertions, 13 deletions

diff --git a/ChangeLog b/ChangeLog
index 152bac6..0a9c91a 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2002-08-22  Miguel Sofer  <msofer@users.sourceforge.net>
+
+	* generic/tclBasic.c:
+	* generic/tclCmdMZ.c: fix for freed memory r/w in delete traces
+	[Bug 589863], patch by Hemang Lavana.
+
 2002-08-20  Andreas Kupries  <andreas_kupries@users.sourceforge.net>
 
 	* win/Makefile.in (CFLAGS): 
diff --git a/generic/tclBasic.c b/generic/tclBasic.c
index b1da3ad..379d290 100644
--- a/generic/tclBasic.c
+++ b/generic/tclBasic.c
@@ -13,7 +13,7 @@
  * See the file "license.terms" for information on usage and redistribution
  * of this file, and for a DISCLAIMER OF ALL WARRANTIES.
  *
- * RCS: @(#) $Id: tclBasic.c,v 1.68 2002/08/05 03:24:40 dgp Exp $
+ * RCS: @(#) $Id: tclBasic.c,v 1.69 2002/08/22 15:57:53 msofer Exp $
  */
 
 #include "tclInt.h"
@@ -5023,8 +5023,7 @@ Tcl_DeleteTrace(interp, trace)
 
     /* Delete the trace object */
 
-    ckfree( (char*) tracePtr );
-
+    Tcl_EventuallyFree( (char*) tracePtr, TCL_DYNAMIC);
 }
 
 /*
diff --git a/generic/tclCmdMZ.c b/generic/tclCmdMZ.c
index 5dd8786..f053f33 100644
--- a/generic/tclCmdMZ.c
+++ b/generic/tclCmdMZ.c
@@ -14,7 +14,7 @@
  * See the file "license.terms" for information on usage and redistribution
  * of this file, and for a DISCLAIMER OF ALL WARRANTIES.
  *
- * RCS: @(#) $Id: tclCmdMZ.c,v 1.75 2002/08/12 12:23:39 msofer Exp $
+ * RCS: @(#) $Id: tclCmdMZ.c,v 1.76 2002/08/22 15:57:54 msofer Exp $
  */
 
 #include "tclInt.h"
@@ -4135,17 +4135,25 @@ TclCheckInterpTraces(interp, command, numChars, cmdPtr, code, traceFlags, objc,
 	    continue;
 	}
 	if (!(tracePtr->flags & TCL_TRACE_EXEC_IN_PROGRESS)) {
+            /*
+	     * The proc invoked might delete the traced command which 
+	     * which might try to free tracePtr.  We want to use tracePtr
+	     * until the end of this if section, so we use
+	     * Tcl_Preserve() and Tcl_Release() to be sureit is not
+	     * freed while we still need it.
+	     */
+	    Tcl_Preserve((ClientData) tracePtr);
 	    tracePtr->flags |= TCL_TRACE_EXEC_IN_PROGRESS;
 	    if ((tracePtr->flags != TCL_TRACE_EXEC_IN_PROGRESS) &&
-		((tracePtr->flags & traceFlags) != 0)) {
-	            tcmdPtr = (TraceCommandInfo*)tracePtr->clientData;
-                    tcmdPtr->curFlags = traceFlags;
-                    tcmdPtr->curCode  = code;
-		    traceCode = (tracePtr->proc)((ClientData)tcmdPtr, 
-                                                (Tcl_Interp*)interp,
-                                                curLevel, command,
-					        (Tcl_Command)cmdPtr,
-                                                objc, objv);
+		    ((tracePtr->flags & traceFlags) != 0)) {
+		tcmdPtr = (TraceCommandInfo*)tracePtr->clientData;
+		tcmdPtr->curFlags = traceFlags;
+		tcmdPtr->curCode  = code;
+		traceCode = (tracePtr->proc)((ClientData)tcmdPtr, 
+		        (Tcl_Interp*)interp,
+			curLevel, command,
+			(Tcl_Command)cmdPtr,
+                        objc, objv);
 	    } else {
 		if (traceFlags & TCL_TRACE_ENTER_EXEC) {
 		    /* 
@@ -4157,6 +4165,7 @@ TclCheckInterpTraces(interp, command, numChars, cmdPtr, code, traceFlags, objc,
 		}
 	    }
 	    tracePtr->flags &= ~TCL_TRACE_EXEC_IN_PROGRESS;
+	    Tcl_Release((ClientData) tracePtr);
 	}
         lastTracePtr = tracePtr;
     }