diff options
| author | jan.nijtmans <nijtmans@users.sourceforge.net> | 2012-08-23 12:07:22 (GMT) |
|---|---|---|
| committer | jan.nijtmans <nijtmans@users.sourceforge.net> | 2012-08-23 12:07:22 (GMT) |
| commit | 77e356e2cee812b76dd325d0f34ad239eb75f82a (patch) | |
| tree | 3b39a4abf553fc24d1fe25b10cb3b153c4653403 /generic | |
| parent | 843b8497d3c972540e5b12b26ae3055d9df4bf77 (diff) | |
| download | tcl-77e356e2cee812b76dd325d0f34ad239eb75f82a.zip tcl-77e356e2cee812b76dd325d0f34ad239eb75f82a.tar.gz tcl-77e356e2cee812b76dd325d0f34ad239eb75f82a.tar.bz2 | |
[Bug 3496014] Protect Tcl_SetByteArrayObj for invalid values
(Backported from Tcl 8.6)
Diffstat (limited to 'generic')
| -rw-r--r-- | generic/tclBinary.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/generic/tclBinary.c b/generic/tclBinary.c index f321b28..8c95305 100644 --- a/generic/tclBinary.c +++ b/generic/tclBinary.c @@ -273,10 +273,15 @@ Tcl_SetByteArrayObj( TclFreeIntRep(objPtr); Tcl_InvalidateStringRep(objPtr); + if (length < 0) { + length = 0; + } byteArrayPtr = (ByteArray *) ckalloc(BYTEARRAY_SIZE(length)); byteArrayPtr->used = length; byteArrayPtr->allocated = length; - memcpy(byteArrayPtr->bytes, bytes, (size_t) length); + if (length && bytes) { + memcpy(byteArrayPtr->bytes, bytes, (size_t) length); + } objPtr->typePtr = &tclByteArrayType; SET_BYTEARRAY(objPtr, byteArrayPtr); |