Subject: Restore panic check at and of the loop. Thanks! Don for noticing this.

From: "jan.nijtmans" <[email-masked]>
Date: Wed, 9 Jan 2013 15:37:27 +0000

---
 generic/tclUtil.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/generic/tclUtil.c b/generic/tclUtil.c
index c6dd464..68567b0 100644
--- a/generic/tclUtil.c
+++ b/generic/tclUtil.c
@@ -1509,10 +1509,13 @@ Tcl_Merge(
     for (i = 0; i < argc; i++) {
 	flagPtr[i] = ( i ? TCL_DONT_QUOTE_HASH : 0 );
 	bytesNeeded += TclScanElement(argv[i], -1, &flagPtr[i]);
-	if ((bytesNeeded < 0) || (bytesNeeded > INT_MAX - argc + 1)) {
+	if (bytesNeeded < 0) {
 	    Tcl_Panic("max size for a Tcl value (%d bytes) exceeded", INT_MAX);
 	}
     }
+    if (bytesNeeded > INT_MAX - argc + 1) {
+	Tcl_Panic("max size for a Tcl value (%d bytes) exceeded", INT_MAX);
+    }
     bytesNeeded += argc;
 
     /*
-- 
cgit v0.12