From 6dc6abffa7924bc7ef004be95916702634242133 Mon Sep 17 00:00:00 2001 From: ferrieux Date: Tue, 19 Jul 2011 18:13:53 +0000 Subject: Fix [bug 3371644] -- crash on Tcl_ConvertElement with leading pound. --- ChangeLog | 4 ++++ generic/tclUtil.c | 4 +++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index e97bb11..1a0e4dc 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,7 @@ +2011-07-19 Alexandre Ferrieux + + * generic/tclUtil.c: Fix [bug 3371644] -- crash on Tcl_ConvertElement with leading pound. + 2011-07-19 Donal K. Fellows * doc/*.3, doc/*.n: Many small fixes to documentation as part of diff --git a/generic/tclUtil.c b/generic/tclUtil.c index 6f36dad..55103e3 100644 --- a/generic/tclUtil.c +++ b/generic/tclUtil.c @@ -1261,7 +1261,9 @@ int TclConvertElement( p[1] = '#'; p += 2; src++; - length--; + if (length > 0) { + length--; + } } else { conversion = CONVERT_BRACE; } -- cgit v0.12 From 66bf88283d33ff4538e807214de979b630e80158 Mon Sep 17 00:00:00 2001 From: dgp Date: Tue, 19 Jul 2011 19:26:32 +0000 Subject: 3371644 Repair failure to properly handle (length == -1) in TclConvertElement(). --- ChangeLog | 5 +++++ generic/tclUtil.c | 2 +- tests/util.test | 8 +++++++- 3 files changed, 13 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 8e9dcff..d5a3648 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,8 @@ +2011-07-19 Don Porter + + * generic/tclUtil.c: [Bug 3371644] Repair failure to properly handle + * tests/util.test: (length == -1) scanning in TclConvertElement(). + 2011-07-15 Don Porter * generic/tclCompile.c: Avoid segfaults when RecordByteCodeStats() diff --git a/generic/tclUtil.c b/generic/tclUtil.c index f5c2926..eaa7eae 100644 --- a/generic/tclUtil.c +++ b/generic/tclUtil.c @@ -1253,7 +1253,7 @@ int TclConvertElement( p[1] = '#'; p += 2; src++; - length--; + length -= (length > 0); } else { conversion = CONVERT_BRACE; } diff --git a/tests/util.test b/tests/util.test index 6a0785e..c910b43 100644 --- a/tests/util.test +++ b/tests/util.test @@ -174,6 +174,12 @@ test util-3.5.1 {Tcl_ConverCountedElement procedure - quote leading '#'} { rename #\{ {} set result } {#} +test util-3.6 {Tcl_ConvertElement, Bug 3371644} { + interp create #\\ + interp alias {} x #\\ concat + interp target {} x ;# Crash if bug not fixed + interp delete #\\ +} {} test util-4.1 {Tcl_ConcatObj - backslash-space at end of argument} { concat a {b\ } c @@ -3889,4 +3895,4 @@ return # Local Variables: # mode: tcl -# End: \ No newline at end of file +# End: -- cgit v0.12