From 0412ec4e2320bfbfc765c14ddd9aab36e79cb278 Mon Sep 17 00:00:00 2001
From: sebres <sebres@users.sourceforge.net>
Date: Fri, 17 May 2024 09:51:41 +0000
Subject: fixes yet another segfault (if write handler doesn't generate an
 error, but returns normally with length of written bytes)

---
 generic/tclIO.c  | 17 +++++++++--------
 tests/ioCmd.test |  1 +
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/generic/tclIO.c b/generic/tclIO.c
index 2df8696..c3844af 100644
--- a/generic/tclIO.c
+++ b/generic/tclIO.c
@@ -9964,19 +9964,20 @@ DoRead(
 	    }
 
 	    if (code || !bufPtr) {
-		/*
-	     * Read error
-	     */
-
-		UpdateInterest(chanPtr);
-		TclChannelRelease((Tcl_Channel)chanPtr);
-		return -1;
+		/* Read error (or channel dead/closed) */
+		goto readErr;
 	    }
 
 	    assert(IsBufferFull(bufPtr));
 	}
 
-	assert(bufPtr != NULL);
+	if (!bufPtr) {
+	  readErr:
+
+	    UpdateInterest(chanPtr);
+	    TclChannelRelease((Tcl_Channel)chanPtr);
+	    return -1;
+	}
 
 	bytesRead = BytesLeft(bufPtr);
 	bytesWritten = bytesToRead;
diff --git a/tests/ioCmd.test b/tests/ioCmd.test
index 3dbb3cc..e56260b 100644
--- a/tests/ioCmd.test
+++ b/tests/ioCmd.test
@@ -2123,6 +2123,7 @@ test iocmd-32.3 {prevent copy-state against segfault by finalize, bug [79474c588
       lappend ::ret $mode
       switch -exact $mode {
         read {puts $chan "Test" ; close $chan}
+        write {set data [lindex $rest 0]; string length $data}
         finalize {after 20 {set ::done done}}
         initialize {return "initialize watch finalize read write"}
       }
-- 
cgit v0.12