merge 8.5

7 files changed, 30 insertions, 11 deletions

diff --git a/generic/tcl.decls b/generic/tcl.decls
index 28cee54..92ccdcf 100644
--- a/generic/tcl.decls
+++ b/generic/tcl.decls
@@ -2,8 +2,8 @@
 #
 #	This file contains the declarations for all supported public
 #	functions that are exported by the Tcl library via the stubs table.
-#	This file is used to generate the tclDecls.h, tclPlatDecls.h,
-#	tclStub.c, and tclPlatStub.c files.
+#	This file is used to generate the tclDecls.h, tclPlatDecls.h
+#	and tclStubInit.c files.
 #
 # Copyright (c) 1998-1999 by Scriptics Corporation.
 # Copyright (c) 2001, 2002 by Kevin B. Kenny.  All rights reserved.
diff --git a/generic/tclCmdIL.c b/generic/tclCmdIL.c
index ea9c1e4..02e5812 100644
--- a/generic/tclCmdIL.c
+++ b/generic/tclCmdIL.c
@@ -2233,7 +2233,10 @@ Tcl_LinsertObjCmd(
 
 	Tcl_ListObjAppendElement(NULL, listPtr, objv[3]);
     } else {
-	Tcl_ListObjReplace(NULL, listPtr, index, 0, (objc-3), &(objv[3]));
+	if (TCL_OK != Tcl_ListObjReplace(interp, listPtr, index, 0,
+		(objc-3), &(objv[3]))) {
+	    return TCL_ERROR;
+	}
     }
 
     /*
@@ -2598,7 +2601,10 @@ Tcl_LreplaceObjCmd(
      * optimize this case away.
      */
 
-    Tcl_ListObjReplace(NULL, listPtr, first, numToDelete, objc-4, &(objv[4]));
+    if (TCL_OK != Tcl_ListObjReplace(interp, listPtr, first, numToDelete,
+	    objc-4, &(objv[4]))) {
+	return TCL_ERROR;
+    }
 
     /*
      * Set the interpreter's object result.
diff --git a/generic/tclIO.c b/generic/tclIO.c
index 9a4735f..7bc849e 100644
--- a/generic/tclIO.c
+++ b/generic/tclIO.c
@@ -5938,7 +5938,7 @@ TranslateInputEOL(
 	break;
     default:
 	/* In other modes, at most 2 src bytes become a dst byte. */
-	if (srcLen > 2 * dstLen) {
+	if (srcLen/2 > dstLen) {
 	    srcLen = 2 * dstLen;
 	}
 	break;
diff --git a/generic/tclInt.decls b/generic/tclInt.decls
index 102d04b..920116c 100644
--- a/generic/tclInt.decls
+++ b/generic/tclInt.decls
@@ -2,9 +2,8 @@
 #
 #	This file contains the declarations for all unsupported
 #	functions that are exported by the Tcl library.  This file
-#	is used to generate the tclIntDecls.h, tclIntPlatDecls.h,
-#	tclIntStub.c, tclPlatStub.c, tclCompileDecls.h and tclCompileStub.c
-#	files
+#	is used to generate the tclIntDecls.h, tclIntPlatDecls.h
+#	and tclStubInit.c files
 #
 # Copyright (c) 1998-1999 by Scriptics Corporation.
 # Copyright (c) 2001 by Kevin B. Kenny.  All rights reserved.
diff --git a/generic/tclListObj.c b/generic/tclListObj.c
index 289cf2d..c4b5cfc 100644
--- a/generic/tclListObj.c
+++ b/generic/tclListObj.c
@@ -854,8 +854,13 @@ Tcl_ListObjReplace(
 	count = numElems - first;
     }
 
+    if (objc > LIST_MAX - (numElems - count)) {
+	Tcl_SetObjResult(interp, Tcl_ObjPrintf(
+		"max length of a Tcl list (%d elements) exceeded", LIST_MAX));
+	return TCL_ERROR;
+    }
     isShared = (listRepPtr->refCount > 1);
-    numRequired = numElems - count + objc;
+    numRequired = numElems - count + objc; /* Known <= LIST_MAX */
 
     for (i = 0;  i < objc;  i++) {
 	Tcl_IncrRefCount(objv[i]);
@@ -906,6 +911,8 @@ Tcl_ListObjReplace(
 
 	listRepPtr = AttemptNewList(interp, newMax, NULL);
 	if (listRepPtr == NULL) {
+	listRepPtr = AttemptNewList(interp, numRequired, NULL);
+	if (listRepPtr == NULL) {
 	    for (i = 0;  i < objc;  i++) {
 		/* See bug 3598580 */
 #if TCL_MAJOR_VERSION > 8
@@ -916,6 +923,7 @@ Tcl_ListObjReplace(
 	    }
 	    return TCL_ERROR;
 	}
+	}
 
 	listPtr->internalRep.twoPtrValue.ptr1 = (void *) listRepPtr;
 	listRepPtr->refCount++;
diff --git a/generic/tclTomMath.decls b/generic/tclTomMath.decls
index 1bfc443..ab39e83 100644
--- a/generic/tclTomMath.decls
+++ b/generic/tclTomMath.decls
@@ -3,7 +3,7 @@
 #	This file contains the declarations for the functions in
 #	'libtommath' that are contained within the Tcl library.
 #	This file is used to generate the 'tclTomMathDecls.h' and
-#	'tclTomMathStub.c' files.
+#	'tclStubInit.c' files.
 #
 # If you edit this file, advance the revision number (and the epoch
 # if the new stubs are not backward compatible) in tclTomMathDecls.h
diff --git a/generic/tclUtil.c b/generic/tclUtil.c
index 69d0b17..bc1490e 100644
--- a/generic/tclUtil.c
+++ b/generic/tclUtil.c
@@ -1791,7 +1791,12 @@ Tcl_ConcatObj(
 	    TclListObjGetElements(NULL, objPtr, &listc, &listv);
 	    if (listc) {
 		if (resPtr) {
-		    Tcl_ListObjReplace(NULL, resPtr, INT_MAX, 0, listc, listv);
+		    if (TCL_OK != Tcl_ListObjReplace(NULL, resPtr,
+			    INT_MAX, 0, listc, listv)) {
+			/* Abandon ship! */
+			Tcl_DecrRefCount(resPtr);
+			goto slow;
+		    }
 		} else {
 		    resPtr = TclListObjCopy(NULL, objPtr);
 		}
@@ -1808,6 +1813,7 @@ Tcl_ConcatObj(
      * the slow way, using the string representations.
      */
 
+  slow:
     /* First try to pre-allocate the size required */
     for (i = 0;  i < objc;  i++) {
 	element = TclGetStringFromObj(objv[i], &elemLength);