diff options
| author | dgp <dgp@users.sourceforge.net> | 2010-04-30 20:59:20 (GMT) |
|---|---|---|
| committer | dgp <dgp@users.sourceforge.net> | 2010-04-30 20:59:20 (GMT) |
| commit | 9d79f83b1c9d6697d68413130af8b676127a4aa6 (patch) | |
| tree | 1a4f3c7e1394116872f67673d587bfaa9113e790 /generic/tclBinary.c | |
| parent | 7729c41548b7f5a0c44917d11e9e67a05f98594f (diff) | |
| download | tcl-9d79f83b1c9d6697d68413130af8b676127a4aa6.zip tcl-9d79f83b1c9d6697d68413130af8b676127a4aa6.tar.gz tcl-9d79f83b1c9d6697d68413130af8b676127a4aa6.tar.bz2 | |
* generic/tclBinary.c (UpdateStringOfByteArray): Add panic
when the generated string representation would grow beyond Tcl's
size limits. [Bug 2994924]
Diffstat (limited to 'generic/tclBinary.c')
| -rw-r--r-- | generic/tclBinary.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/generic/tclBinary.c b/generic/tclBinary.c index baea4ba..8708294 100644 --- a/generic/tclBinary.c +++ b/generic/tclBinary.c @@ -10,7 +10,7 @@ * See the file "license.terms" for information on usage and redistribution of * this file, and for a DISCLAIMER OF ALL WARRANTIES. * - * RCS: @(#) $Id: tclBinary.c,v 1.41 2008/03/24 03:10:06 patthoyts Exp $ + * RCS: @(#) $Id: tclBinary.c,v 1.41.2.1 2010/04/30 20:59:20 dgp Exp $ */ #include "tclInt.h" @@ -518,11 +518,14 @@ UpdateStringOfByteArray( */ size = length; - for (i = 0; i < length; i++) { + for (i = 0; i < length && size >= 0; i++) { if ((src[i] == 0) || (src[i] > 127)) { size++; } } + if (size < 0) { + Tcl_Panic("max size for a Tcl value (%d bytes) exceeded", INT_MAX); + } dst = (char *) ckalloc((unsigned) (size + 1)); objPtr->bytes = dst; |