Attempted bug fix.

1 files changed, 8 insertions, 5 deletions

diff --git a/generic/tclHash.c b/generic/tclHash.c
index 256b073..b553c68 100644
--- a/generic/tclHash.c
+++ b/generic/tclHash.c
@@ -1013,12 +1013,18 @@ static void
 RebuildTable(
     register Tcl_HashTable *tablePtr)	/* Table to enlarge. */
 {
-    int oldSize, count, index;
-    Tcl_HashEntry **oldBuckets;
+    int count, index, oldSize = tablePtr->numBuckets;
+    Tcl_HashEntry **oldBuckets = tablePtr->buckets;
     register Tcl_HashEntry **oldChainPtr, **newChainPtr;
     register Tcl_HashEntry *hPtr;
     const Tcl_HashKeyType *typePtr;
 
+    /* Avoid outgrowing capability of the memory allocators */
+    if (oldSize > UINT_MAX / (4 * sizeof(Tcl_HashEntry *))) {
+	tablePtr->rebuildSize = INT_MAX;
+	return;
+    }
+
     if (tablePtr->keyType == TCL_STRING_KEYS) {
 	typePtr = &tclStringHashKeyType;
     } else if (tablePtr->keyType == TCL_ONE_WORD_KEYS) {
@@ -1030,9 +1036,6 @@ RebuildTable(
 	typePtr = &tclArrayHashKeyType;
     }
 
-    oldSize = tablePtr->numBuckets;
-    oldBuckets = tablePtr->buckets;
-
     /*
      * Allocate and initialize the new bucket array, and set up hashing
      * constants for new array size.