From ff0738ff2d537d9c4d0d95d944bfd0a239baef8e Mon Sep 17 00:00:00 2001 From: mig Date: Wed, 13 Apr 2011 13:19:36 +0000 Subject: fix for [Bug 2662380], crash caused by appending to a variable with a write trace that unsets it --- ChangeLog | 5 +++++ generic/tclVar.c | 7 ++++--- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index 14fb1e4..e90ee9d 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,8 @@ +2011-04-13 Miguel Sofer + + * generic/tclVar.c: fix for [Bug 2662380], crash caused by + appending to a variable with a write trace that unsets it. + 2011-04-12 Don Porter * generic/tclStringObj.c: Repair corruption in [string reverse] diff --git a/generic/tclVar.c b/generic/tclVar.c index 9815469..a1885b5 100644 --- a/generic/tclVar.c +++ b/generic/tclVar.c @@ -2554,13 +2554,14 @@ Tcl_AppendObjCmd( /* * Note that we do not need to increase the refCount of the Var * pointers: should a trace delete the variable, the return value - * of TclPtrSetVar will be NULL, and we will not access the - * variable again. + * of TclPtrSetVar will be NULL or emptyObjPtr, and we will not + * access the variable again. */ varValuePtr = TclPtrSetVar(interp, varPtr, arrayPtr, objv[1], NULL, objv[i], TCL_APPEND_VALUE|TCL_LEAVE_ERR_MSG, -1); - if (varValuePtr == NULL) { + if ((varValuePtr == NULL) || + (varValuePtr == ((Interp *) interp)->emptyObjPtr)) { return TCL_ERROR; } } -- cgit v0.12