diff options
| author | nijtmans@users.sourceforge.net <jan.nijtmans> | 2012-08-23 12:07:22 (GMT) |
|---|---|---|
| committer | nijtmans@users.sourceforge.net <jan.nijtmans> | 2012-08-23 12:07:22 (GMT) |
| commit | f6b23a705535045ab25719142939ba6a778d5dbd (patch) | |
| tree | 3b39a4abf553fc24d1fe25b10cb3b153c4653403 /generic/tclBinary.c | |
| parent | 7dc83ee2161ff6870f219fca0191c38daa7a32e5 (diff) | |
| download | tcl-f6b23a705535045ab25719142939ba6a778d5dbd.zip tcl-f6b23a705535045ab25719142939ba6a778d5dbd.tar.gz tcl-f6b23a705535045ab25719142939ba6a778d5dbd.tar.bz2 | |
[Bug 3496014] Protect Tcl_SetByteArrayObj for invalid values
(Backported from Tcl 8.6)
Diffstat (limited to 'generic/tclBinary.c')
| -rw-r--r-- | generic/tclBinary.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/generic/tclBinary.c b/generic/tclBinary.c index f321b28..8c95305 100644 --- a/generic/tclBinary.c +++ b/generic/tclBinary.c @@ -273,10 +273,15 @@ Tcl_SetByteArrayObj( TclFreeIntRep(objPtr); Tcl_InvalidateStringRep(objPtr); + if (length < 0) { + length = 0; + } byteArrayPtr = (ByteArray *) ckalloc(BYTEARRAY_SIZE(length)); byteArrayPtr->used = length; byteArrayPtr->allocated = length; - memcpy(byteArrayPtr->bytes, bytes, (size_t) length); + if (length && bytes) { + memcpy(byteArrayPtr->bytes, bytes, (size_t) length); + } objPtr->typePtr = &tclByteArrayType; SET_BYTEARRAY(objPtr, byteArrayPtr); |