diff options
| author | dkf <donal.k.fellows@manchester.ac.uk> | 2010-04-08 13:26:23 (GMT) |
|---|---|---|
| committer | dkf <donal.k.fellows@manchester.ac.uk> | 2010-04-08 13:26:23 (GMT) |
| commit | f10d81b895d8ca9d30428aac9884685fb284986a (patch) | |
| tree | 7f94efe33eb67e54166bcce1f6f00fe697506798 /ChangeLog | |
| parent | 9a41057f12f98c43dddf469be6d0822f1c90384c (diff) | |
| download | tcl-f10d81b895d8ca9d30428aac9884685fb284986a.zip tcl-f10d81b895d8ca9d30428aac9884685fb284986a.tar.gz tcl-f10d81b895d8ca9d30428aac9884685fb284986a.tar.bz2 | |
* generic/tclCompCmdsSZ.c (TclSubstCompile): If the first token does
not result in a *guaranteed* push of a Tcl_Obj on the stack, we must
push an empty object. Otherwise it is possible to get to a 'concat1'
or 'done' without enough values on the stack, resulting in a crash.
Thanks to Joe Mistachkin for identifying a script that could trigger
this case.
Diffstat (limited to 'ChangeLog')
| -rw-r--r-- | ChangeLog | 9 |
1 files changed, 9 insertions, 0 deletions
@@ -1,3 +1,12 @@ +2010-04-08 Donal K. Fellows <dkf@users.sf.net> + + * generic/tclCompCmdsSZ.c (TclSubstCompile): If the first token does + not result in a *guaranteed* push of a Tcl_Obj on the stack, we must + push an empty object. Otherwise it is possible to get to a 'concat1' + or 'done' without enough values on the stack, resulting in a crash. + Thanks to Joe Mistachkin for identifying a script that could trigger + this case. + 2010-04-07 Donal K. Fellows <dkf@users.sf.net> * doc/catch.n, doc/info.n, doc/return.n: Formatting. |