[Bug 3598580]: Tcl_ListObjReplace may release deleted elements too early

2 files changed, 10 insertions, 4 deletions

diff --git a/ChangeLog b/ChangeLog
index 147224d..f1eb346 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2012-12-27  Jan Nijtmans  <nijtmans@users.sf.net>
+
+	* generic/tclListObj.c: [Bug 3598580]: Tcl_ListObjReplace may release
+	deleted elements too early
+
 2012-12-21  Jan Nijtmans  <nijtmans@users.sf.net>
 
 	* unix/dltest/pkgb.c:  Make pkgb.so loadable in Tcl 8.4 as well.
diff --git a/generic/tclListObj.c b/generic/tclListObj.c
index 17aa256..1166759 100644
--- a/generic/tclListObj.c
+++ b/generic/tclListObj.c
@@ -857,6 +857,10 @@ Tcl_ListObjReplace(
     isShared = (listRepPtr->refCount > 1);
     numRequired = numElems - count + objc;
 
+    for (i = 0;  i < objc;  i++) {
+	Tcl_IncrRefCount(objv[i]);
+    }
+
     if ((numRequired <= listRepPtr->maxElemCount) && !isShared) {
 	int shift;
 
@@ -964,14 +968,11 @@ Tcl_ListObjReplace(
     }
 
     /*
-     * Insert the new elements into elemPtrs before "first". We don't do a
-     * memcpy here because we must increment the reference counts for the
-     * added elements, so we must explicitly loop anyway.
+     * Insert the new elements into elemPtrs before "first".
      */
 
     for (i=0,j=first ; i<objc ; i++,j++) {
 	elemPtrs[j] = objv[i];
-	Tcl_IncrRefCount(objv[i]);
     }
 
     /*