diff options
| -rw-r--r-- | ChangeLog | 5 | ||||
| -rw-r--r-- | generic/tclListObj.c | 9 |
2 files changed, 10 insertions, 4 deletions
@@ -1,3 +1,8 @@ +2012-12-27 Jan Nijtmans <nijtmans@users.sf.net> + + * generic/tclListObj.c: [Bug 3598580]: Tcl_ListObjReplace may release + deleted elements too early + 2012-12-21 Jan Nijtmans <nijtmans@users.sf.net> * unix/dltest/pkgb.c: Make pkgb.so loadable in Tcl 8.4 as well. diff --git a/generic/tclListObj.c b/generic/tclListObj.c index 17aa256..1166759 100644 --- a/generic/tclListObj.c +++ b/generic/tclListObj.c @@ -857,6 +857,10 @@ Tcl_ListObjReplace( isShared = (listRepPtr->refCount > 1); numRequired = numElems - count + objc; + for (i = 0; i < objc; i++) { + Tcl_IncrRefCount(objv[i]); + } + if ((numRequired <= listRepPtr->maxElemCount) && !isShared) { int shift; @@ -964,14 +968,11 @@ Tcl_ListObjReplace( } /* - * Insert the new elements into elemPtrs before "first". We don't do a - * memcpy here because we must increment the reference counts for the - * added elements, so we must explicitly loop anyway. + * Insert the new elements into elemPtrs before "first". */ for (i=0,j=first ; i<objc ; i++,j++) { elemPtrs[j] = objv[i]; - Tcl_IncrRefCount(objv[i]); } /* |