From df75b9195608f60545ced2c165c87ad65288c66d Mon Sep 17 00:00:00 2001
From: apnadkarni <apnmbx-wits@yahoo.com>
Date: Tue, 2 May 2023 16:33:39 +0000
Subject: Fix [ab123cfd3d] - scan ubsan. Tx chrstphrchvz for patch

---
 generic/tclScan.c | 15 +++++++++------
 tests/scan.test   |  5 +++++
 2 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/generic/tclScan.c b/generic/tclScan.c
index f37f596..ba3d90f 100644
--- a/generic/tclScan.c
+++ b/generic/tclScan.c
@@ -305,7 +305,7 @@ ValidateFormat(
 	     * format string.
 	     */
 
-	    value = strtoul(format-1, &end, 10);	/* INTL: "C" locale. */
+	    unsigned long ul = strtoul(format-1, &end, 10);	/* INTL: "C" locale. */
 	    if (*end != '$') {
 		goto notXpg;
 	    }
@@ -315,17 +315,20 @@ ValidateFormat(
 	    if (gotSequential) {
 		goto mixedXPG;
 	    }
-	    objIndex = value - 1;
-	    if ((objIndex < 0) || (numVars && (objIndex >= numVars))) {
+	    if (ul == 0 || ul >= INT_MAX) {
+		goto badIndex;
+	    }
+	    objIndex = (int) ul - 1;
+	    if (numVars && (objIndex >= numVars)) {
 		goto badIndex;
 	    } else if (numVars == 0) {
 		/*
 		 * In the case where no vars are specified, the user can
 		 * specify %9999$ legally, so we have to consider special
-		 * rules for growing the assign array. 'value' is guaranteed
-		 * to be > 0.
+		 * rules for growing the assign array. 'ul' is guaranteed
+		 * to be > 0 and < INT_MAX as per checks above.
 		 */
-		xpgSize = (xpgSize > value) ? xpgSize : value;
+		xpgSize = (xpgSize > (int)ul) ? xpgSize : (int)ul;
 	    }
 	    goto xpgCheckDone;
 	}
diff --git a/tests/scan.test b/tests/scan.test
index 300335e..cd2ba63 100644
--- a/tests/scan.test
+++ b/tests/scan.test
@@ -852,6 +852,11 @@ test scan-13.8 {Tcl_ScanObjCmd, inline XPG case lots of arguments} {
     set msg [scan "10 20 30" {%100$d %5$d %200$d}]
     list [llength $msg] [lindex $msg 99] [lindex $msg 4] [lindex $msg 199]
 } {200 10 20 30}
+test scan-13.9 {Tcl_ScanObjCmd, inline XPG case limit error} -body {
+    # Note this applies to 64-bit builds as well so long as max number of
+    # command line arguments allowed for scan command is INT_MAX
+    scan abc {%2147483648$s}
+} -result {"%n$" argument index out of range} -returnCodes error
 
 # scan infinities - not working
 
-- 
cgit v0.12