[Bug 3496014] Protect Tcl_SetByteArrayObj for invalid values

(Backported from Tcl 8.6)

2 files changed, 11 insertions, 1 deletions

diff --git a/ChangeLog b/ChangeLog
index b1c9079..74ff19b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2012-08-23  Jan Nijtmans  <nijtmans@users.sf.net>
+
+	* generic/tclBinary.c: [Bug 3496014] (Backport from Tcl 8.6) Protect
+	Tcl_SetByteArrayObj for invalid values.
+
 2012-08-20  Don Porter  <dgp@users.sourceforge.net>
 
 	* generic/tclPathObj.c:	[Bug 3559678] Fix bad filename normalization
diff --git a/generic/tclBinary.c b/generic/tclBinary.c
index f321b28..8c95305 100644
--- a/generic/tclBinary.c
+++ b/generic/tclBinary.c
@@ -273,10 +273,15 @@ Tcl_SetByteArrayObj(
     TclFreeIntRep(objPtr);
     Tcl_InvalidateStringRep(objPtr);
 
+    if (length < 0) {
+	length = 0;
+    }
     byteArrayPtr = (ByteArray *) ckalloc(BYTEARRAY_SIZE(length));
     byteArrayPtr->used = length;
     byteArrayPtr->allocated = length;
-    memcpy(byteArrayPtr->bytes, bytes, (size_t) length);
+    if (length && bytes) {
+	memcpy(byteArrayPtr->bytes, bytes, (size_t) length);
+    }
 
     objPtr->typePtr = &tclByteArrayType;
     SET_BYTEARRAY(objPtr, byteArrayPtr);