* generic/tclHash.c (AllocArrayEntry, AllocStringEntry):

	Before invoking ckalloc when creating a Tcl_HashEntry,
	check that the amount of memory being allocated is
	at least as large as sizeof(Tcl_HashEntry). The previous
	code was allocating memory regions that were one
	or two bytes short. [Bug #521950] (dejong)

1 files changed, 11 insertions, 5 deletions

diff --git a/generic/tclHash.c b/generic/tclHash.c
index 41593f6..e7bd472 100644
--- a/generic/tclHash.c
+++ b/generic/tclHash.c
@@ -10,7 +10,7 @@
  * See the file "license.terms" for information on usage and redistribution
  * of this file, and for a DISCLAIMER OF ALL WARRANTIES.
  *
- * RCS: @(#) $Id: tclHash.c,v 1.10 2002/01/25 21:36:09 dgp Exp $
+ * RCS: @(#) $Id: tclHash.c,v 1.11 2002/02/26 02:16:09 hobbs Exp $
  */
 
 #include "tclInt.h"
@@ -814,11 +814,14 @@ AllocArrayEntry(tablePtr, keyPtr)
     register int *iPtr1, *iPtr2;
     Tcl_HashEntry *hPtr;
     int count;
+    unsigned int size;
 
     count = tablePtr->keyType;
     
-    hPtr = (Tcl_HashEntry *) ckalloc((unsigned) (sizeof(Tcl_HashEntry)
-	    + (count*sizeof(int)) - sizeof(hPtr->key)));
+    size = sizeof(Tcl_HashEntry) + (count*sizeof(int)) - sizeof(hPtr->key);
+    if (size < sizeof(Tcl_HashEntry))
+	size = sizeof(Tcl_HashEntry);
+    hPtr = (Tcl_HashEntry *) ckalloc(size);
     
     for (iPtr1 = array, iPtr2 = hPtr->key.words;
 	    count > 0; count--, iPtr1++, iPtr2++) {
@@ -923,9 +926,12 @@ AllocStringEntry(tablePtr, keyPtr)
 {
     CONST char *string = (CONST char *) keyPtr;
     Tcl_HashEntry *hPtr;
+    unsigned int size;
 
-    hPtr = (Tcl_HashEntry *) ckalloc((unsigned)
-	    (sizeof(Tcl_HashEntry) + strlen(string) + 1 - sizeof(hPtr->key)));
+    size = sizeof(Tcl_HashEntry) + strlen(string) + 1 - sizeof(hPtr->key);
+    if (size < sizeof(Tcl_HashEntry))
+	size = sizeof(Tcl_HashEntry);
+    hPtr = (Tcl_HashEntry *) ckalloc(size);
     strcpy(hPtr->key.string, string);
 
     return hPtr;