diff options
| author | apnadkarni <apnmbx-wits@yahoo.com> | 2023-09-05 06:10:23 (GMT) |
|---|---|---|
| committer | apnadkarni <apnmbx-wits@yahoo.com> | 2023-09-05 06:10:23 (GMT) |
| commit | 381c827ae8477c27cb4291cb0fa9c5f84581730c (patch) | |
| tree | 35411e4a59dd4e1245b92c6413f5ae03acdd6399 /generic/tclStringObj.c | |
| parent | 11de34bf3a27c72a010eb7e510241a27027c4c54 (diff) | |
| parent | 22f59c102a2c3880b0e8aa0b3cae623411e84b2f (diff) | |
| download | tcl-381c827ae8477c27cb4291cb0fa9c5f84581730c.zip tcl-381c827ae8477c27cb4291cb0fa9c5f84581730c.tar.gz tcl-381c827ae8477c27cb4291cb0fa9c5f84581730c.tar.bz2 | |
Fix [b5ac3e3786] - Tcl_GetUniChar oob read
Diffstat (limited to 'generic/tclStringObj.c')
| -rw-r--r-- | generic/tclStringObj.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/generic/tclStringObj.c b/generic/tclStringObj.c index b1046b1..975b991 100644 --- a/generic/tclStringObj.c +++ b/generic/tclStringObj.c @@ -575,6 +575,9 @@ Tcl_GetUniChar( if (stringPtr->numChars == -1) { TclNumUtfChars(stringPtr->numChars, objPtr->bytes, objPtr->length); } + if (index >= stringPtr->numChars) { + return 0xFFFD; + } if (stringPtr->numChars == objPtr->length) { return (unsigned char) objPtr->bytes[index]; } @@ -631,7 +634,11 @@ TclGetUCS4( if (stringPtr->numChars == -1) { TclNumUtfChars(stringPtr->numChars, objPtr->bytes, objPtr->length); } + if (index >= stringPtr->numChars) { + return -1; + } if (stringPtr->numChars == objPtr->length) { + /* Pure ascii, can directly index bytes */ return (unsigned char) objPtr->bytes[index]; } FillUnicodeRep(objPtr); |