diff options
author | dgp <dgp@users.sourceforge.net> | 2013-04-08 20:07:07 (GMT) |
---|---|---|
committer | dgp <dgp@users.sourceforge.net> | 2013-04-08 20:07:07 (GMT) |
commit | 1ba9a90c6e8c7c639399891e60cdc5a09c0f0acd (patch) | |
tree | 95837b1887eda849b2873c00caaf5337bbfc18dd /generic/regc_color.c | |
parent | 93b8f2696af89601f0c9f980088df04bfef5d593 (diff) | |
parent | 55102c2b83a91074eb32c07fb5930ccc9ca00c44 (diff) | |
download | tcl-1ba9a90c6e8c7c639399891e60cdc5a09c0f0acd.zip tcl-1ba9a90c6e8c7c639399891e60cdc5a09c0f0acd.tar.gz tcl-1ba9a90c6e8c7c639399891e60cdc5a09c0f0acd.tar.bz2 |
3610026 Stop crash when the number of "colors" in a regular expression
overflows a short int. Thanks to Heikki Linnakangas for the report and
the patch.
Diffstat (limited to 'generic/regc_color.c')
-rw-r--r-- | generic/regc_color.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/generic/regc_color.c b/generic/regc_color.c index b7a571c..f5d6dfd 100644 --- a/generic/regc_color.c +++ b/generic/regc_color.c @@ -254,7 +254,14 @@ newcolor( * Oops, must allocate more. */ + if (cm->max == MAX_COLOR) { + CERR(REG_ECOLORS); + return COLORLESS; /* too many colors */ + } n = cm->ncds * 2; + if (n < MAX_COLOR + 1) { + n = MAX_COLOR + 1; + } if (cm->cd == cm->cdspace) { newCd = (struct colordesc *) MALLOC(n * sizeof(struct colordesc)); if (newCd != NULL) { |