diff options
| author | dgp <dgp@users.sourceforge.net> | 2012-09-06 19:01:32 (GMT) |
|---|---|---|
| committer | dgp <dgp@users.sourceforge.net> | 2012-09-06 19:01:32 (GMT) |
| commit | 41d7976a599beb50796eb6a1316080825fb79047 (patch) | |
| tree | 144b06b527e0bc0ae8420df93c1482f918544578 /generic | |
| parent | 96b1a87503f1da17ec4626ba78ef7a04030e98ce (diff) | |
| download | tcl-bug_3564735.zip tcl-bug_3564735.tar.gz tcl-bug_3564735.tar.bz2 | |
3564735 Protection against namespace var resolvers that unexpectedly returnbug_3564735
a pointer to Var while Tcl expects pointer to VarInHash. This may not be
the total solution to Bug 3564735 (Itcl may be misbehaving), but this will
prevent memory corruption.
Diffstat (limited to 'generic')
| -rw-r--r-- | generic/tclInt.h | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/generic/tclInt.h b/generic/tclInt.h index e1ce6d5..cca9938 100644 --- a/generic/tclInt.h +++ b/generic/tclInt.h @@ -693,13 +693,17 @@ typedef struct VarInHash { #define TclSetVarNamespaceVar(varPtr) \ if (!TclIsVarNamespaceVar(varPtr)) {\ (varPtr)->flags |= VAR_NAMESPACE_VAR;\ - ((VarInHash *)(varPtr))->refCount++;\ + if (TclIsVarInHash(varPtr)) {\ + ((VarInHash *)(varPtr))->refCount++;\ + }\ } #define TclClearVarNamespaceVar(varPtr) \ if (TclIsVarNamespaceVar(varPtr)) {\ (varPtr)->flags &= ~VAR_NAMESPACE_VAR;\ - ((VarInHash *)(varPtr))->refCount--;\ + if (TclIsVarInHash(varPtr)) {\ + ((VarInHash *)(varPtr))->refCount--;\ + }\ } /* |