diff options
| -rw-r--r-- | ChangeLog | 6 | ||||
| -rw-r--r-- | generic/tclBinary.c | 7 |
2 files changed, 11 insertions, 2 deletions
@@ -1,3 +1,9 @@ +2010-04-30 Don Porter <dgp@users.sourceforge.net> + + * generic/tclBinary.c (UpdateStringOfByteArray): Add panic + when the generated string representation would grow beyond Tcl's + size limits. [Bug 2994924] + 2010-04-29 Andreas Kupries <andreask@activestate.com> * library/platform/platform.tcl: Another stab at getting the /lib, diff --git a/generic/tclBinary.c b/generic/tclBinary.c index baea4ba..8708294 100644 --- a/generic/tclBinary.c +++ b/generic/tclBinary.c @@ -10,7 +10,7 @@ * See the file "license.terms" for information on usage and redistribution of * this file, and for a DISCLAIMER OF ALL WARRANTIES. * - * RCS: @(#) $Id: tclBinary.c,v 1.41 2008/03/24 03:10:06 patthoyts Exp $ + * RCS: @(#) $Id: tclBinary.c,v 1.41.2.1 2010/04/30 20:59:20 dgp Exp $ */ #include "tclInt.h" @@ -518,11 +518,14 @@ UpdateStringOfByteArray( */ size = length; - for (i = 0; i < length; i++) { + for (i = 0; i < length && size >= 0; i++) { if ((src[i] == 0) || (src[i] > 127)) { size++; } } + if (size < 0) { + Tcl_Panic("max size for a Tcl value (%d bytes) exceeded", INT_MAX); + } dst = (char *) ckalloc((unsigned) (size + 1)); objPtr->bytes = dst; |