From 6670acc974bc94845dc92e48f2789cbf6520f727 Mon Sep 17 00:00:00 2001
From: dgp <dgp@users.sourceforge.net>
Date: Wed, 15 Jul 2015 17:17:03 +0000
Subject: [b1534b438b] Prevent read outside buffer boundaries.

---
 generic/tclIO.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/generic/tclIO.c b/generic/tclIO.c
index 1b0d0ab..564df27 100644
--- a/generic/tclIO.c
+++ b/generic/tclIO.c
@@ -3899,7 +3899,18 @@ Write(
 		return -1;
 	    }
 	    flushed += statePtr->bufSize;
-	    if (saved == 0 || src[-1] != '\n') {
+
+	    /*
+ 	     * We just flushed.  So if we have needNlFlush set to record
+ 	     * that we need to flush because theres a (translated) newline
+ 	     * in the buffer, that's likely not true any more.  But there
+ 	     * is a tricky exception.  If we have saved bytes that did not
+ 	     * really get flushed and those bytes came from a translation
+ 	     * of a newline as the last thing taken from the src array,
+ 	     * then needNlFlush needs to remain set to flag that the
+ 	     * next buffer still needs a newline flush.
+ 	     */
+	    if (needNlFlush && (saved == 0 || src[-1] != '\n')) {
 		needNlFlush = 0;
 	    }
 	}
-- 
cgit v0.12