From 20253b8c7d3f3c59314380703be48df859cdf9e6 Mon Sep 17 00:00:00 2001
From: "jan.nijtmans" <nijtmans@users.sourceforge.net>
Date: Thu, 27 Dec 2012 14:41:15 +0000
Subject: [Bug 3598580]: Tcl_ListObjReplace may release deleted elements too
early
Tests!? Where are the tests!?!
They are in test listobj-11.1
---
ChangeLog | 5 +++++
generic/tclListObj.c | 6 ++++--
2 files changed, 9 insertions(+), 2 deletions(-)
diff --git a/ChangeLog b/ChangeLog
index 204275f..728b677 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2012-12-27 Jan Nijtmans <nijtmans@users.sf.net>
+
+ * generic/tclListObj.c: [Bug 3598580]: Tcl_ListObjReplace may release
+ deleted elements too early
+
2012-12-21 Jan Nijtmans <nijtmans@users.sf.net>
* unix/dltest/pkgb.c: Turn pkgb.so into a Tcl9 interoperability test
diff --git a/generic/tclListObj.c b/generic/tclListObj.c
index fffe6a2..b4af98a 100644
--- a/generic/tclListObj.c
+++ b/generic/tclListObj.c
@@ -655,6 +655,10 @@ Tcl_ListObjReplace(interp, listPtr, first, count, objc, objv)
count = 0;
}
+ for (i = 0; i < objc; i++) {
+ Tcl_IncrRefCount(objv[i]);
+ }
+
numRequired = (numElems - count + objc);
if (numRequired <= listRepPtr->maxElemCount) {
/*
@@ -689,7 +693,6 @@ Tcl_ListObjReplace(interp, listPtr, first, count, objc, objv)
for (i = 0, j = first; i < objc; i++, j++) {
elemPtrs[j] = objv[i];
- Tcl_IncrRefCount(objv[i]);
}
/*
@@ -745,7 +748,6 @@ Tcl_ListObjReplace(interp, listPtr, first, count, objc, objv)
for (i = 0, j = first; i < objc; i++, j++) {
newPtrs[j] = objv[i];
- Tcl_IncrRefCount(objv[i]);
}
listRepPtr->elemCount = numRequired;
--
cgit v0.12