diff options
| author | dgp <dgp@users.sourceforge.net> | 2017-05-05 17:12:52 (GMT) |
|---|---|---|
| committer | dgp <dgp@users.sourceforge.net> | 2017-05-05 17:12:52 (GMT) |
| commit | 71a9a4406a6d1f7e004030f8e928d42fa18c3e3c (patch) | |
| tree | a88cfd4f910da63336af1d7604d7ca26502b3099 /generic/tclBinary.c | |
| parent | 6f18f8d37545e22e2a21d6e7b54e4318ab0c4c98 (diff) | |
| download | tcl-71a9a4406a6d1f7e004030f8e928d42fa18c3e3c.zip tcl-71a9a4406a6d1f7e004030f8e928d42fa18c3e3c.tar.gz tcl-71a9a4406a6d1f7e004030f8e928d42fa18c3e3c.tar.bz2 | |
[6015221f59] Segfault after overflow of [binary] field specifier numeric count.
Diffstat (limited to 'generic/tclBinary.c')
| -rw-r--r-- | generic/tclBinary.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/generic/tclBinary.c b/generic/tclBinary.c index 68289f2..cbe4970 100644 --- a/generic/tclBinary.c +++ b/generic/tclBinary.c @@ -1528,7 +1528,15 @@ GetFormatSpec( (*formatPtr)++; (*countPtr) = BINARY_ALL; } else if (isdigit(UCHAR(**formatPtr))) { /* INTL: digit */ - (*countPtr) = strtoul(*formatPtr, formatPtr, 10); + unsigned long int count; + + errno = 0; + count = strtoul(*formatPtr, formatPtr, 10); + if (errno || (count > (unsigned long) INT_MAX)) { + (*countPtr) = INT_MAX; + } else { + (*countPtr) = (int) count; + } } else { (*countPtr) = BINARY_NOCOUNT; } |