Subject: 3564735 Protect against mem corruption when var resolvers misbehave.

From: dgp <[email-masked]>
Date: Tue, 11 Sep 2012 14:07:27 +0000

---
 generic/tclInt.h | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/generic/tclInt.h b/generic/tclInt.h
index 53a88d6..6c6e664 100644
--- a/generic/tclInt.h
+++ b/generic/tclInt.h
@@ -801,13 +801,17 @@ typedef struct VarInHash {
 #define TclSetVarNamespaceVar(varPtr) \
     if (!TclIsVarNamespaceVar(varPtr)) {\
 	(varPtr)->flags |= VAR_NAMESPACE_VAR;\
-	((VarInHash *)(varPtr))->refCount++;\
+	if (TclIsVarInHash(varPtr)) {\
+	    ((VarInHash *)(varPtr))->refCount++;\
+	}\
     }
 
 #define TclClearVarNamespaceVar(varPtr) \
     if (TclIsVarNamespaceVar(varPtr)) {\
 	(varPtr)->flags &= ~VAR_NAMESPACE_VAR;\
-	((VarInHash *)(varPtr))->refCount--;\
+	if (TclIsVarInHash(varPtr)) {\
+	    ((VarInHash *)(varPtr))->refCount--;\
+	}\
     }
 
 /*
-- 
cgit v0.12