Subject: [Bug 3496014] Protect Tcl_SetByteArrayObj for invalid values (Backported from Tcl 8.6)

From: "jan.nijtmans" <[email-masked]>
Date: Thu, 23 Aug 2012 12:07:22 +0000

---
 ChangeLog           | 5 +++++
 generic/tclBinary.c | 7 ++++++-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index b1c9079..74ff19b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2012-08-23  Jan Nijtmans  <[email-masked]>
+
+	* generic/tclBinary.c: [Bug 3496014] (Backport from Tcl 8.6) Protect
+	Tcl_SetByteArrayObj for invalid values.
+
 2012-08-20  Don Porter  <[email-masked]>
 
 	* generic/tclPathObj.c:	[Bug 3559678] Fix bad filename normalization
diff --git a/generic/tclBinary.c b/generic/tclBinary.c
index f321b28..8c95305 100644
--- a/generic/tclBinary.c
+++ b/generic/tclBinary.c
@@ -273,10 +273,15 @@ Tcl_SetByteArrayObj(
     TclFreeIntRep(objPtr);
     Tcl_InvalidateStringRep(objPtr);
 
+    if (length < 0) {
+	length = 0;
+    }
     byteArrayPtr = (ByteArray *) ckalloc(BYTEARRAY_SIZE(length));
     byteArrayPtr->used = length;
     byteArrayPtr->allocated = length;
-    memcpy(byteArrayPtr->bytes, bytes, (size_t) length);
+    if (length && bytes) {
+	memcpy(byteArrayPtr->bytes, bytes, (size_t) length);
+    }
 
     objPtr->typePtr = &tclByteArrayType;
     SET_BYTEARRAY(objPtr, byteArrayPtr);
-- 
cgit v0.12