summaryrefslogtreecommitdiffstats
path: root/generic
diff options
context:
space:
mode:
authordgp <dgp@users.sourceforge.net>2015-07-29 03:06:30 (GMT)
committerdgp <dgp@users.sourceforge.net>2015-07-29 03:06:30 (GMT)
commit96585a0ae4cf7d41417955b92a4491510101b38e (patch)
treeff330788f36aed09bec54d44ad583b68678569eb /generic
parent61947d12ec0d917d65a31b72dd14c2ee52c2ce5a (diff)
downloadtcl-96585a0ae4cf7d41417955b92a4491510101b38e.zip
tcl-96585a0ae4cf7d41417955b92a4491510101b38e.tar.gz
tcl-96585a0ae4cf7d41417955b92a4491510101b38e.tar.bz2
[3e7eca8c8c] Prevent overflow in the size value passed to ckrealloc().
Diffstat (limited to 'generic')
-rw-r--r--generic/tclCompExpr.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/generic/tclCompExpr.c b/generic/tclCompExpr.c
index 23dc0a4..abb917f 100644
--- a/generic/tclCompExpr.c
+++ b/generic/tclCompExpr.c
@@ -659,11 +659,13 @@ ParseExpr(
if (nodesUsed >= nodesAvailable) {
int size = nodesUsed * 2;
- OpNode *newPtr;
+ OpNode *newPtr = NULL;
do {
+ if (size <= UINT_MAX/sizeof(OpNode)) {
newPtr = (OpNode *) attemptckrealloc((char *) nodes,
(unsigned int) size * sizeof(OpNode));
+ }
} while ((newPtr == NULL)
&& ((size -= (size - nodesUsed) / 2) > nodesUsed));
if (newPtr == NULL) {