diff options
| author | dgp <dgp@users.sourceforge.net> | 2011-07-13 17:53:58 (GMT) |
|---|---|---|
| committer | dgp <dgp@users.sourceforge.net> | 2011-07-13 17:53:58 (GMT) |
| commit | 965e4bbab2201076c8c2bc6ae5baca705ab889b0 (patch) | |
| tree | f1620db0ed8edabd97357b78ee3e6acb96377b72 /generic | |
| parent | 15d2827a35e23f3221491e1cfc89efa5545e9e9f (diff) | |
| download | tcl-965e4bbab2201076c8c2bc6ae5baca705ab889b0.zip tcl-965e4bbab2201076c8c2bc6ae5baca705ab889b0.tar.gz tcl-965e4bbab2201076c8c2bc6ae5baca705ab889b0.tar.bz2 | |
3366265 Buffer allocated one byte too small caused overrun.
Diffstat (limited to 'generic')
| -rw-r--r-- | generic/tclProc.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/generic/tclProc.c b/generic/tclProc.c index be35bab..abfd152 100644 --- a/generic/tclProc.c +++ b/generic/tclProc.c @@ -1155,7 +1155,7 @@ TclObjInterpProc(clientData, interp, objc, objv) len = Tcl_ScanCountedElement(procName, nameLen, &flags); if (len != nameLen) { - char *procName1 = ckalloc((unsigned) len); + char *procName1 = ckalloc((unsigned) len + 1); len = Tcl_ConvertCountedElement(procName, nameLen, procName1, flags); Tcl_AppendToObj(objResult, procName1, len); ckfree(procName1); |