From 41d7976a599beb50796eb6a1316080825fb79047 Mon Sep 17 00:00:00 2001 From: dgp Date: Thu, 6 Sep 2012 19:01:32 +0000 Subject: 3564735 Protection against namespace var resolvers that unexpectedly return a pointer to Var while Tcl expects pointer to VarInHash. This may not be the total solution to Bug 3564735 (Itcl may be misbehaving), but this will prevent memory corruption. --- generic/tclInt.h | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/generic/tclInt.h b/generic/tclInt.h index e1ce6d5..cca9938 100644 --- a/generic/tclInt.h +++ b/generic/tclInt.h @@ -693,13 +693,17 @@ typedef struct VarInHash { #define TclSetVarNamespaceVar(varPtr) \ if (!TclIsVarNamespaceVar(varPtr)) {\ (varPtr)->flags |= VAR_NAMESPACE_VAR;\ - ((VarInHash *)(varPtr))->refCount++;\ + if (TclIsVarInHash(varPtr)) {\ + ((VarInHash *)(varPtr))->refCount++;\ + }\ } #define TclClearVarNamespaceVar(varPtr) \ if (TclIsVarNamespaceVar(varPtr)) {\ (varPtr)->flags &= ~VAR_NAMESPACE_VAR;\ - ((VarInHash *)(varPtr))->refCount--;\ + if (TclIsVarInHash(varPtr)) {\ + ((VarInHash *)(varPtr))->refCount--;\ + }\ } /* -- cgit v0.12