From 66c29096944ef5a69468c0fd188382deadcb0e03 Mon Sep 17 00:00:00 2001 From: "jan.nijtmans" Date: Thu, 27 Dec 2012 14:41:15 +0000 Subject: [Bug 3598580]: Tcl_ListObjReplace may release deleted elements too early Tests!? Where are the tests!?! They are in test listobj-11.1 --- ChangeLog | 5 +++++ generic/tclListObj.c | 6 ++++-- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 204275f..728b677 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,8 @@ +2012-12-27 Jan Nijtmans + + * generic/tclListObj.c: [Bug 3598580]: Tcl_ListObjReplace may release + deleted elements too early + 2012-12-21 Jan Nijtmans * unix/dltest/pkgb.c: Turn pkgb.so into a Tcl9 interoperability test diff --git a/generic/tclListObj.c b/generic/tclListObj.c index fffe6a2..b4af98a 100644 --- a/generic/tclListObj.c +++ b/generic/tclListObj.c @@ -655,6 +655,10 @@ Tcl_ListObjReplace(interp, listPtr, first, count, objc, objv) count = 0; } + for (i = 0; i < objc; i++) { + Tcl_IncrRefCount(objv[i]); + } + numRequired = (numElems - count + objc); if (numRequired <= listRepPtr->maxElemCount) { /* @@ -689,7 +693,6 @@ Tcl_ListObjReplace(interp, listPtr, first, count, objc, objv) for (i = 0, j = first; i < objc; i++, j++) { elemPtrs[j] = objv[i]; - Tcl_IncrRefCount(objv[i]); } /* @@ -745,7 +748,6 @@ Tcl_ListObjReplace(interp, listPtr, first, count, objc, objv) for (i = 0, j = first; i < objc; i++, j++) { newPtrs[j] = objv[i]; - Tcl_IncrRefCount(objv[i]); } listRepPtr->elemCount = numRequired; -- cgit v0.12