From 9d79f83b1c9d6697d68413130af8b676127a4aa6 Mon Sep 17 00:00:00 2001 From: dgp Date: Fri, 30 Apr 2010 20:59:20 +0000 Subject: * generic/tclBinary.c (UpdateStringOfByteArray): Add panic when the generated string representation would grow beyond Tcl's size limits. [Bug 2994924] --- ChangeLog | 6 ++++++ generic/tclBinary.c | 7 +++++-- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index cc246f5..dd13e73 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,9 @@ +2010-04-30 Don Porter + + * generic/tclBinary.c (UpdateStringOfByteArray): Add panic + when the generated string representation would grow beyond Tcl's + size limits. [Bug 2994924] + 2010-04-29 Andreas Kupries * library/platform/platform.tcl: Another stab at getting the /lib, diff --git a/generic/tclBinary.c b/generic/tclBinary.c index baea4ba..8708294 100644 --- a/generic/tclBinary.c +++ b/generic/tclBinary.c @@ -10,7 +10,7 @@ * See the file "license.terms" for information on usage and redistribution of * this file, and for a DISCLAIMER OF ALL WARRANTIES. * - * RCS: @(#) $Id: tclBinary.c,v 1.41 2008/03/24 03:10:06 patthoyts Exp $ + * RCS: @(#) $Id: tclBinary.c,v 1.41.2.1 2010/04/30 20:59:20 dgp Exp $ */ #include "tclInt.h" @@ -518,11 +518,14 @@ UpdateStringOfByteArray( */ size = length; - for (i = 0; i < length; i++) { + for (i = 0; i < length && size >= 0; i++) { if ((src[i] == 0) || (src[i] > 127)) { size++; } } + if (size < 0) { + Tcl_Panic("max size for a Tcl value (%d bytes) exceeded", INT_MAX); + } dst = (char *) ckalloc((unsigned) (size + 1)); objPtr->bytes = dst; -- cgit v0.12