[3298012] Stop RebuildTable asking ckalloc for more than it can give.

1 files changed, 8 insertions, 5 deletions

diff --git a/generic/tclHash.c b/generic/tclHash.c
index 1991aea..4fdd673 100644
--- a/generic/tclHash.c
+++ b/generic/tclHash.c
@@ -1014,12 +1014,18 @@ static void
 RebuildTable(
     register Tcl_HashTable *tablePtr)	/* Table to enlarge. */
 {
-    int oldSize, count, index;
-    Tcl_HashEntry **oldBuckets;
+    int count, index, oldSize = tablePtr->numBuckets;
+    Tcl_HashEntry **oldBuckets = tablePtr->buckets;
     register Tcl_HashEntry **oldChainPtr, **newChainPtr;
     register Tcl_HashEntry *hPtr;
     const Tcl_HashKeyType *typePtr;
 
+    /* Avoid outgrowing capability of the memory allocators */
+    if (oldSize > UINT_MAX / (4 * sizeof(Tcl_HashEntry *))) {
+	tablePtr->rebuildSize = INT_MAX;
+	return;
+    }
+
     if (tablePtr->keyType == TCL_STRING_KEYS) {
 	typePtr = &tclStringHashKeyType;
     } else if (tablePtr->keyType == TCL_ONE_WORD_KEYS) {
@@ -1031,9 +1037,6 @@ RebuildTable(
 	typePtr = &tclArrayHashKeyType;
     }
 
-    oldSize = tablePtr->numBuckets;
-    oldBuckets = tablePtr->buckets;
-
     /*
      * Allocate and initialize the new bucket array, and set up hashing
      * constants for new array size.