summaryrefslogtreecommitdiffstats
path: root/generic/tclListObj.c
diff options
context:
space:
mode:
authordgp <dgp@users.sourceforge.net>2015-11-20 16:58:11 (GMT)
committerdgp <dgp@users.sourceforge.net>2015-11-20 16:58:11 (GMT)
commit7e6cdc9cc44c2cbf916639ff537171bd10c175dd (patch)
treec017d91bb480b148b21901dc15d6208e37ac6b96 /generic/tclListObj.c
parentf4b65459ef36d86c50bf8b28aabd416c013b1022 (diff)
downloadtcl-7e6cdc9cc44c2cbf916639ff537171bd10c175dd.zip
tcl-7e6cdc9cc44c2cbf916639ff537171bd10c175dd.tar.gz
tcl-7e6cdc9cc44c2cbf916639ff537171bd10c175dd.tar.bz2
[3293874] Simplified fix (not backport). Also detect >LIST_MAX early.
Diffstat (limited to 'generic/tclListObj.c')
-rw-r--r--generic/tclListObj.c10
1 files changed, 9 insertions, 1 deletions
diff --git a/generic/tclListObj.c b/generic/tclListObj.c
index 289cf2d..c4b5cfc 100644
--- a/generic/tclListObj.c
+++ b/generic/tclListObj.c
@@ -854,8 +854,13 @@ Tcl_ListObjReplace(
count = numElems - first;
}
+ if (objc > LIST_MAX - (numElems - count)) {
+ Tcl_SetObjResult(interp, Tcl_ObjPrintf(
+ "max length of a Tcl list (%d elements) exceeded", LIST_MAX));
+ return TCL_ERROR;
+ }
isShared = (listRepPtr->refCount > 1);
- numRequired = numElems - count + objc;
+ numRequired = numElems - count + objc; /* Known <= LIST_MAX */
for (i = 0; i < objc; i++) {
Tcl_IncrRefCount(objv[i]);
@@ -906,6 +911,8 @@ Tcl_ListObjReplace(
listRepPtr = AttemptNewList(interp, newMax, NULL);
if (listRepPtr == NULL) {
+ listRepPtr = AttemptNewList(interp, numRequired, NULL);
+ if (listRepPtr == NULL) {
for (i = 0; i < objc; i++) {
/* See bug 3598580 */
#if TCL_MAJOR_VERSION > 8
@@ -916,6 +923,7 @@ Tcl_ListObjReplace(
}
return TCL_ERROR;
}
+ }
listPtr->internalRep.twoPtrValue.ptr1 = (void *) listRepPtr;
listRepPtr->refCount++;