[Bug 2918962]: Stop crash when -index and -stride are used together in [lsort].

1 files changed, 15 insertions, 11 deletions

diff --git a/generic/tclCmdIL.c b/generic/tclCmdIL.c
index 9f9fdda..313c368 100644
--- a/generic/tclCmdIL.c
+++ b/generic/tclCmdIL.c
@@ -16,7 +16,7 @@
  * See the file "license.terms" for information on usage and redistribution of
  * this file, and for a DISCLAIMER OF ALL WARRANTIES.
  *
- * RCS: @(#) $Id: tclCmdIL.c,v 1.175 2009/12/07 20:49:28 msofer Exp $
+ * RCS: @(#) $Id: tclCmdIL.c,v 1.176 2009/12/22 19:49:29 dkf Exp $
  */
 
 #include "tclInt.h"
@@ -3526,7 +3526,7 @@ Tcl_LsortObjCmd(
     Tcl_Obj *const objv[])	/* Argument values. */
 {
     int i, j, index, indices, length, nocase = 0, sortMode, indexc;
-    int group, groupSize, groupOffset, idx;
+    int group, groupSize, groupOffset, idx, allocatedIndexVector = 0;
     Tcl_Obj *resultPtr, *cmdPtr, **listObjPtrs, *listObj, *indexPtr;
     SortElement *elementArray, *elementPtr;
     SortInfo sortInfo;		/* Information about this sort that needs to
@@ -3640,6 +3640,9 @@ Tcl_LsortObjCmd(
 	    default:
 		sortInfo.indexv =
 			TclStackAlloc(interp, sizeof(int) * sortInfo.indexc);
+		allocatedIndexVector = 1;	/* Cannot use indexc field, as
+						 * it might be decreased by 1
+						 * later. */
 	    }
 
 	    /*
@@ -3782,16 +3785,16 @@ Tcl_LsortObjCmd(
 		sortInfo.indexc = 0;
 		sortInfo.indexv = NULL;
 	    } else {
-		int *new_indexv;
-
 		sortInfo.indexc--;
-		new_indexv =
-			TclStackAlloc(interp, sizeof(int) * sortInfo.indexc);
+
+		/*
+		 * Do not shrink the actual memory block used; that doesn't
+		 * work with TclStackAlloc-allocated memory. [Bug 2918962]
+		 */
+
 		for (i = 0; i < sortInfo.indexc; i++) {
-		    new_indexv[i] = sortInfo.indexv[i+1];
+		    sortInfo.indexv[i] = sortInfo.indexv[i+1];
 		}
-		TclStackFree(interp, sortInfo.indexv);
-		sortInfo.indexv = new_indexv;
 	    }
 	}
     }
@@ -3857,7 +3860,8 @@ Tcl_LsortObjCmd(
 	} else if (sortInfo.sortMode == SORTMODE_REAL) {
 	    double a;
 
-	    if (Tcl_GetDoubleFromObj(sortInfo.interp, indexPtr, &a) != TCL_OK) {
+	    if (Tcl_GetDoubleFromObj(sortInfo.interp, indexPtr,
+		    &a) != TCL_OK) {
 		sortInfo.resultCode = TCL_ERROR;
 		goto done1;
 	    }
@@ -3957,7 +3961,7 @@ Tcl_LsortObjCmd(
 	sortInfo.compareCmdPtr = NULL;
     }
   done2:
-    if (sortInfo.indexc > 1) {
+    if (allocatedIndexVector) {
 	TclStackFree(interp, sortInfo.indexv);
     }
     return sortInfo.resultCode;