summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authordgp <dgp@users.sourceforge.net>2015-07-29 10:03:46 (GMT)
committerdgp <dgp@users.sourceforge.net>2015-07-29 10:03:46 (GMT)
commite863ec8015f6bff1a8017b6557ba0b7cb9d7d039 (patch)
tree1e3ea3f23684b15df034aeddacfbcdd4d1039762
parent0dfed6948cae4e926c49b5fc888b4b74b247a262 (diff)
parent96585a0ae4cf7d41417955b92a4491510101b38e (diff)
downloadtcl-e863ec8015f6bff1a8017b6557ba0b7cb9d7d039.zip
tcl-e863ec8015f6bff1a8017b6557ba0b7cb9d7d039.tar.gz
tcl-e863ec8015f6bff1a8017b6557ba0b7cb9d7d039.tar.bz2
[3e7eca8c8c] Prevent overflow in the size value passed to ckrealloc().
-rw-r--r--generic/tclCompExpr.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/generic/tclCompExpr.c b/generic/tclCompExpr.c
index 38c1ceb..50edbec 100644
--- a/generic/tclCompExpr.c
+++ b/generic/tclCompExpr.c
@@ -663,10 +663,12 @@ ParseExpr(
if (nodesUsed >= nodesAvailable) {
int size = nodesUsed * 2;
- OpNode *newPtr;
+ OpNode *newPtr = NULL;
do {
+ if (size <= UINT_MAX/sizeof(OpNode)) {
newPtr = attemptckrealloc(nodes, size * sizeof(OpNode));
+ }
} while ((newPtr == NULL)
&& ((size -= (size - nodesUsed) / 2) > nodesUsed));
if (newPtr == NULL) {