Subject: 3564735 Protection against namespace var resolvers that unexpectedly return a pointer to Var while Tcl expects pointer to VarInHash. This may not be the total solution to Bug 3564735 (Itcl may be misbehaving), but this will prevent memory corruption.

From: dgp <[email-masked]>
Date: Thu, 6 Sep 2012 19:01:32 +0000

---
 generic/tclInt.h | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/generic/tclInt.h b/generic/tclInt.h
index e1ce6d5..cca9938 100644
--- a/generic/tclInt.h
+++ b/generic/tclInt.h
@@ -693,13 +693,17 @@ typedef struct VarInHash {
 #define TclSetVarNamespaceVar(varPtr) \
     if (!TclIsVarNamespaceVar(varPtr)) {\
 	(varPtr)->flags |= VAR_NAMESPACE_VAR;\
-	((VarInHash *)(varPtr))->refCount++;\
+	if (TclIsVarInHash(varPtr)) {\
+	    ((VarInHash *)(varPtr))->refCount++;\
+	}\
     }
 
 #define TclClearVarNamespaceVar(varPtr) \
     if (TclIsVarNamespaceVar(varPtr)) {\
 	(varPtr)->flags &= ~VAR_NAMESPACE_VAR;\
-	((VarInHash *)(varPtr))->refCount--;\
+	if (TclIsVarInHash(varPtr)) {\
+	    ((VarInHash *)(varPtr))->refCount--;\
+	}\
     }
 
 /*
-- 
cgit v0.12