diff options
| author | jan.nijtmans <jan.nijtmans@noemail.net> | 2012-12-27 14:57:32 (GMT) |
|---|---|---|
| committer | jan.nijtmans <jan.nijtmans@noemail.net> | 2012-12-27 14:57:32 (GMT) |
| commit | 97a6a5df10f10a03c2511db7ac642eed1c10fb51 (patch) | |
| tree | 30f9805cad842d36d4e5474c555a4248fc2364db /generic/tclListObj.c | |
| parent | 2e25a2df68f91c0ba30b5ebfa6c61e64934f6e59 (diff) | |
| parent | 4a2e7c7103a09e0af5cba879be7adb6885556aeb (diff) | |
| download | tcl-97a6a5df10f10a03c2511db7ac642eed1c10fb51.zip tcl-97a6a5df10f10a03c2511db7ac642eed1c10fb51.tar.gz tcl-97a6a5df10f10a03c2511db7ac642eed1c10fb51.tar.bz2 | |
[Bug 3598580]: Tcl_ListObjReplace may release deleted elements too early
FossilOrigin-Name: 6d560f6812b4e10a19e04776d2df402a8d36a813
Diffstat (limited to 'generic/tclListObj.c')
| -rw-r--r-- | generic/tclListObj.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/generic/tclListObj.c b/generic/tclListObj.c index 17aa256..1166759 100644 --- a/generic/tclListObj.c +++ b/generic/tclListObj.c @@ -857,6 +857,10 @@ Tcl_ListObjReplace( isShared = (listRepPtr->refCount > 1); numRequired = numElems - count + objc; + for (i = 0; i < objc; i++) { + Tcl_IncrRefCount(objv[i]); + } + if ((numRequired <= listRepPtr->maxElemCount) && !isShared) { int shift; @@ -964,14 +968,11 @@ Tcl_ListObjReplace( } /* - * Insert the new elements into elemPtrs before "first". We don't do a - * memcpy here because we must increment the reference counts for the - * added elements, so we must explicitly loop anyway. + * Insert the new elements into elemPtrs before "first". */ for (i=0,j=first ; i<objc ; i++,j++) { elemPtrs[j] = objv[i]; - Tcl_IncrRefCount(objv[i]); } /* |