diff options
| author | dgp <dgp@users.sourceforge.net> | 2015-07-29 10:03:46 (GMT) |
|---|---|---|
| committer | dgp <dgp@users.sourceforge.net> | 2015-07-29 10:03:46 (GMT) |
| commit | e91db44e66d8ce99078d74df965ac25696149a8d (patch) | |
| tree | 1e3ea3f23684b15df034aeddacfbcdd4d1039762 /generic | |
| parent | 7578a2c2bd45b8bcb5111af7bf3eff02ae8dfedc (diff) | |
| parent | aa7b8f6ccb73b76e7d2590e642344e3bb0c1b9d9 (diff) | |
| download | tcl-e91db44e66d8ce99078d74df965ac25696149a8d.zip tcl-e91db44e66d8ce99078d74df965ac25696149a8d.tar.gz tcl-e91db44e66d8ce99078d74df965ac25696149a8d.tar.bz2 | |
[3e7eca8c8c] Prevent overflow in the size value passed to ckrealloc().
Diffstat (limited to 'generic')
| -rw-r--r-- | generic/tclCompExpr.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/generic/tclCompExpr.c b/generic/tclCompExpr.c index 38c1ceb..50edbec 100644 --- a/generic/tclCompExpr.c +++ b/generic/tclCompExpr.c @@ -663,10 +663,12 @@ ParseExpr( if (nodesUsed >= nodesAvailable) { int size = nodesUsed * 2; - OpNode *newPtr; + OpNode *newPtr = NULL; do { + if (size <= UINT_MAX/sizeof(OpNode)) { newPtr = attemptckrealloc(nodes, size * sizeof(OpNode)); + } } while ((newPtr == NULL) && ((size -= (size - nodesUsed) / 2) > nodesUsed)); if (newPtr == NULL) { |