diff options
| author | dgp <dgp@users.sourceforge.net> | 2015-11-20 16:59:55 (GMT) |
|---|---|---|
| committer | dgp <dgp@users.sourceforge.net> | 2015-11-20 16:59:55 (GMT) |
| commit | 67929efb233a934a2d625216ee8d3b1d8022d33e (patch) | |
| tree | 920bfb5bca1221572d6f4a11a7a2c1732df367c9 /generic/tclListObj.c | |
| parent | b043297e8b02ea12c45a49b4cea4dcaa50da99b3 (diff) | |
| parent | dfbac0054227702fab645e6c03d08c35a8dd9b7c (diff) | |
| download | tcl-67929efb233a934a2d625216ee8d3b1d8022d33e.zip tcl-67929efb233a934a2d625216ee8d3b1d8022d33e.tar.gz tcl-67929efb233a934a2d625216ee8d3b1d8022d33e.tar.bz2 | |
Tcl_ListObjReplace() early out when > LIST_MAX attempted.
Diffstat (limited to 'generic/tclListObj.c')
| -rw-r--r-- | generic/tclListObj.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/generic/tclListObj.c b/generic/tclListObj.c index fa67ee6..0dfa845 100644 --- a/generic/tclListObj.c +++ b/generic/tclListObj.c @@ -906,8 +906,13 @@ Tcl_ListObjReplace( count = numElems - first; } + if (objc > LIST_MAX - (numElems - count)) { + Tcl_SetObjResult(interp, Tcl_ObjPrintf( + "max length of a Tcl list (%d elements) exceeded", LIST_MAX)); + return TCL_ERROR; + } isShared = (listRepPtr->refCount > 1); - numRequired = numElems - count + objc; + numRequired = numElems - count + objc; /* Known <= LIST_MAX */ for (i = 0; i < objc; i++) { Tcl_IncrRefCount(objv[i]); |