* generic/tclIO.c (ReadChars): Added check and panic and

	  commentary to a piece of code which relies on BUFFER_PADDING to
	  create enough space at the beginning of each buffer forthe
	  insertion of partial multi-byte data at the beginning of a
	  buffer. To explain why this code is ok, and as precaution if
	  someone twiddled the BUFFER_PADDING into uselessness.

	* generic/tclIO.c (ReadChars): [SF Tcl Bug 1462248]. Added code
	  temporarily suppress the use of TCL_ENCODING_END set when eof
	  was reached while the buffer we are converting is not truly the
	  last buffer in the queue. together with the Utf bug below it was
	  possible to completely bollox the buffer data structures,
	  eventually crashing Tcl.

	* generic/tclEncoding.c (UtfToUtfProc): Fixed problem where the
	  function accessed memory beyond the end of the input
	  buffer. When TCL_ENCODING_END is set and the last bytes of the
	  buffer start a multi-byte sequence. This bug contributed to [SF
	  Tcl Bug 1462248].

1 files changed, 12 insertions, 2 deletions

diff --git a/generic/tclEncoding.c b/generic/tclEncoding.c
index 5fa799e..2a3698f 100644
--- a/generic/tclEncoding.c
+++ b/generic/tclEncoding.c
@@ -8,7 +8,7 @@
  * See the file "license.terms" for information on usage and redistribution
  * of this file, and for a DISCLAIMER OF ALL WARRANTIES.
  *
- * RCS: @(#) $Id: tclEncoding.c,v 1.16.2.9 2006/03/13 20:57:09 dgp Exp $
+ * RCS: @(#) $Id: tclEncoding.c,v 1.16.2.10 2006/04/05 00:06:02 andreas_kupries Exp $
  */
 
 #include "tclInt.h"
@@ -2083,13 +2083,23 @@ UtfToUtfProc(clientData, src, srcLen, flags, statePtr, dst, dstLen,
 	     */
 	    *dst++ = 0;
 	    src += 2;
+	} else if (!Tcl_UtfCharComplete(src, srcEnd - src)) {
+	    /* Always check before using Tcl_UtfToUniChar. Not doing
+	     * can so cause it run beyond the endof the buffer!  If we
+	     * * happen such an incomplete char its byts are made to *
+	     * represent themselves.
+	     */
+
+	    ch = (Tcl_UniChar) *src;
+	    src += 1;
+	    dst += Tcl_UniCharToUtf(ch, dst);
 	} else {
 	    src += Tcl_UtfToUniChar(src, &ch);
 	    dst += Tcl_UniCharToUtf(ch, dst);
 	}
     }
 
-    *srcReadPtr = src - srcStart;
+    *srcReadPtr  = src - srcStart;
     *dstWrotePtr = dst - dstStart;
     *dstCharsPtr = numChars;
     return result;