* generic/tclUtil.c (TclReToGlob): Added missing set of the

        *exactPtr value to really fix [Bug 2065115].  Also avoid possible
        DString overflow.

2 files changed, 17 insertions, 10 deletions

diff --git a/ChangeLog b/ChangeLog
index cab7cd7..a3a47e8 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,7 +1,8 @@
 2008-08-22  Don Porter  <dgp@users.sourceforge.net>
 
 	* generic/tclUtil.c (TclReToGlob):      Added missing set of the
-	*exactPtr value to really fix [Bug 2065115].
+	*exactPtr value to really fix [Bug 2065115].  Also avoid possible
+	DString overflow.
 	* tests/regexpComp.test:        Correct duplicate test names.
 
 2008-08-21  Miguel Sofer  <msofer@users.sf.net>
diff --git a/generic/tclUtil.c b/generic/tclUtil.c
index 6f74ad8..22b9e73 100644
--- a/generic/tclUtil.c
+++ b/generic/tclUtil.c
@@ -11,7 +11,7 @@
  * See the file "license.terms" for information on usage and redistribution of
  * this file, and for a DISCLAIMER OF ALL WARRANTIES.
  *
- * RCS: @(#) $Id: tclUtil.c,v 1.102 2008/08/22 17:26:46 dgp Exp $
+ * RCS: @(#) $Id: tclUtil.c,v 1.103 2008/08/22 18:01:00 dgp Exp $
  */
 
 #include "tclInt.h"
@@ -3275,18 +3275,16 @@ TclReToGlob(
     Tcl_DStringInit(dsPtr);
 
     /*
-     * Write to the ds directly without the function overhead.
-     * An equivalent glob pattern can be no more than reStrLen+2 in size.
-     */
-
-    Tcl_DStringSetLength(dsPtr, reStrLen + 2);
-    dsStr = dsStrStart = Tcl_DStringValue(dsPtr);
-
-    /*
      * "***=xxx" == "*xxx*", watch for glob-sensitive chars.
      */
 
     if ((reStrLen >= 4) && (memcmp("***=", reStr, 4) == 0)) {
+	/*
+	 * At most, the glob pattern has length 2*reStrLen + 2 to
+	 * backslash escape every character and have * at each end.
+	 */
+	Tcl_DStringSetLength(dsPtr, reStrLen + 2);
+	dsStr = dsStrStart = Tcl_DStringValue(dsPtr);
 	*dsStr++ = '*';
 	for (p = reStr + 4; p < strEnd; p++) {
 	    switch (*p) {
@@ -3308,6 +3306,14 @@ TclReToGlob(
     }
 
     /*
+     * At most, the glob pattern has length reStrLen + 2 to account
+     * for possible * at each end.
+     */
+
+    Tcl_DStringSetLength(dsPtr, reStrLen + 2);
+    dsStr = dsStrStart = Tcl_DStringValue(dsPtr);
+
+    /*
      * Check for anchored REs (ie ^foo$), so we can use string equal if
      * possible. Do not alter the start of str so we can free it correctly.
      *