summaryrefslogtreecommitdiffstats
path: root/generic
diff options
context:
space:
mode:
authordgp <dgp@users.sourceforge.net>2009-03-20 14:35:05 (GMT)
committerdgp <dgp@users.sourceforge.net>2009-03-20 14:35:05 (GMT)
commitae500c24671537445c8f784f45e71f05c5b95bf6 (patch)
treeffdf5102c9194f48e40c6660ad25c85747e2276f /generic
parentba8ebbff1d8a0c56faa5687b97762896372a7d97 (diff)
downloadtcl-ae500c24671537445c8f784f45e71f05c5b95bf6.zip
tcl-ae500c24671537445c8f784f45e71f05c5b95bf6.tar.gz
tcl-ae500c24671537445c8f784f45e71f05c5b95bf6.tar.bz2
* generic/tclExecute.c (INST_CONCAT1): Panic when appends overflow
the max length of a Tcl value. [Bug 2669109]
Diffstat (limited to 'generic')
-rw-r--r--generic/tclExecute.c12
1 files changed, 10 insertions, 2 deletions
diff --git a/generic/tclExecute.c b/generic/tclExecute.c
index 26cfba3..3bf099e 100644
--- a/generic/tclExecute.c
+++ b/generic/tclExecute.c
@@ -13,7 +13,7 @@
* See the file "license.terms" for information on usage and redistribution of
* this file, and for a DISCLAIMER OF ALL WARRANTIES.
*
- * RCS: @(#) $Id: tclExecute.c,v 1.369.2.6 2008/12/16 22:04:00 ferrieux Exp $
+ * RCS: @(#) $Id: tclExecute.c,v 1.369.2.7 2009/03/20 14:35:06 dgp Exp $
*/
#include "tclInt.h"
@@ -2112,13 +2112,18 @@ TclExecuteByteCode(
* Compute the length to be appended.
*/
- for (currPtr=&OBJ_AT_DEPTH(opnd-2); currPtr<=&OBJ_AT_TOS; currPtr++) {
+ for (currPtr=&OBJ_AT_DEPTH(opnd-2);
+ appendLen >= 0 && currPtr<=&OBJ_AT_TOS; currPtr++) {
bytes = TclGetStringFromObj(*currPtr, &length);
if (bytes != NULL) {
appendLen += length;
}
}
+ if (appendLen < 0) {
+ Tcl_Panic("max size for a Tcl value (%d bytes) exceeded", INT_MAX);
+ }
+
/*
* If nothing is to be appended, just return the first object by
* dropping all the others from the stack; this saves both the
@@ -2142,6 +2147,9 @@ TclExecuteByteCode(
objResultPtr = OBJ_AT_DEPTH(opnd-1);
bytes = TclGetStringFromObj(objResultPtr, &length);
+ if (length + appendLen < 0) {
+ Tcl_Panic("max size for a Tcl value (%d bytes) exceeded", INT_MAX);
+ }
#if !TCL_COMPILE_DEBUG
if (bytes != tclEmptyStringRep && !Tcl_IsShared(objResultPtr)) {
TclFreeIntRep(objResultPtr);