diff options
| author | dgp <dgp@users.sourceforge.net> | 2010-03-18 20:38:43 (GMT) |
|---|---|---|
| committer | dgp <dgp@users.sourceforge.net> | 2010-03-18 20:38:43 (GMT) |
| commit | 5255a10338236dc3adc27e5f3fd811546f4fc09e (patch) | |
| tree | 891debe41e41785e24733aec27b1ff525c3ae425 /generic/tclListObj.c | |
| parent | 82f9f4d9ac6ecb9764104e6e81e9596a0392009f (diff) | |
| download | tcl-5255a10338236dc3adc27e5f3fd811546f4fc09e.zip tcl-5255a10338236dc3adc27e5f3fd811546f4fc09e.tar.gz tcl-5255a10338236dc3adc27e5f3fd811546f4fc09e.tar.bz2 | |
* generic/tclListObj.c: Prevent in overflow trouble in [lreplace]
* generic/tclTestObj.c: operations. Thanks to kbk for fix and test.
* tests/listObj.test: [Bug 2971669].
Diffstat (limited to 'generic/tclListObj.c')
| -rw-r--r-- | generic/tclListObj.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/generic/tclListObj.c b/generic/tclListObj.c index 95e3f33..82ffa3d 100644 --- a/generic/tclListObj.c +++ b/generic/tclListObj.c @@ -10,7 +10,7 @@ * See the file "license.terms" for information on usage and redistribution of * this file, and for a DISCLAIMER OF ALL WARRANTIES. * - * RCS: @(#) $Id: tclListObj.c,v 1.49.2.2 2008/09/10 13:18:11 dkf Exp $ + * RCS: @(#) $Id: tclListObj.c,v 1.49.2.3 2010/03/18 20:38:43 dgp Exp $ */ #include "tclInt.h" @@ -832,7 +832,11 @@ Tcl_ListObjReplace( } if (count < 0) { count = 0; - } else if (numElems < first+count) { + } else if (numElems < first+count || first+count < 0) { + /* + * The 'first+count < 0' condition here guards agains integer + * overflow in determining 'first+count' + */ count = numElems - first; } |