* generic/tclUtil.c (TclReToGlob): Added missing set of the

        *exactPtr value to really fix [Bug 2065115].  Also avoid possible
        DString overflow.

1 files changed, 15 insertions, 9 deletions

diff --git a/generic/tclUtil.c b/generic/tclUtil.c
index 3b59171..a2b4d84 100644
--- a/generic/tclUtil.c
+++ b/generic/tclUtil.c
@@ -11,7 +11,7 @@
  * See the file "license.terms" for information on usage and redistribution of
  * this file, and for a DISCLAIMER OF ALL WARRANTIES.
  *
- * RCS: @(#) $Id: tclUtil.c,v 1.97.2.4 2008/08/22 17:20:37 dgp Exp $
+ * RCS: @(#) $Id: tclUtil.c,v 1.97.2.5 2008/08/22 18:00:15 dgp Exp $
  */
 
 #include "tclInt.h"
@@ -3274,18 +3274,16 @@ TclReToGlob(
     Tcl_DStringInit(dsPtr);
 
     /*
-     * Write to the ds directly without the function overhead.
-     * An equivalent glob pattern can be no more than reStrLen+2 in size.
-     */
-
-    Tcl_DStringSetLength(dsPtr, reStrLen + 2);
-    dsStr = dsStrStart = Tcl_DStringValue(dsPtr);
-
-    /*
      * "***=xxx" == "*xxx*", watch for glob-sensitive chars.
      */
 
     if ((reStrLen >= 4) && (memcmp("***=", reStr, 4) == 0)) {
+	/*
+	 * At most, the glob pattern has length 2*reStrLen + 2 to
+	 * backslash escape every character and have * at each end.
+	 */
+	Tcl_DStringSetLength(dsPtr, 2*reStrLen + 2);
+	dsStr = dsStrStart = Tcl_DStringValue(dsPtr);
 	*dsStr++ = '*';
 	for (p = reStr + 4; p < strEnd; p++) {
 	    switch (*p) {
@@ -3307,6 +3305,14 @@ TclReToGlob(
     }
 
     /*
+     * At most, the glob pattern has length reStrLen + 2 to account
+     * for possible * at each end.
+     */
+
+    Tcl_DStringSetLength(dsPtr, reStrLen + 2);
+    dsStr = dsStrStart = Tcl_DStringValue(dsPtr);
+
+    /*
      * Check for anchored REs (ie ^foo$), so we can use string equal if
      * possible. Do not alter the start of str so we can free it correctly.
      *