* unix/tkUnixMenu.c (DrawMenuUnderline): bound Tcl_UtfAtIndex usage

	* tests/menu.test (menu-36.1): [Bug 1599877]

4 files changed, 42 insertions, 21 deletions

diff --git a/ChangeLog b/ChangeLog
index 1e2ea02..47ada67 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2006-11-24  Jeff Hobbs  <jeffh@ActiveState.com>
+
+	* unix/tkUnixMenu.c (DrawMenuUnderline): bound Tcl_UtfAtIndex usage
+	* tests/menu.test (menu-36.1): [Bug 1599877]
+
 2006-11-24  Joe English  <jenglish@users.sourceforge.net>
 
 	* library/ttk/altTheme.tcl, library/ttk/clamTheme.tcl, 
diff --git a/tests/menu.test b/tests/menu.test
index 15d055a..24e57cc 100644
--- a/tests/menu.test
+++ b/tests/menu.test
@@ -5,7 +5,7 @@
 # Copyright (c) 1998-1999 by Scriptics Corporation.
 # All rights reserved.
 #
-# RCS: @(#) $Id: menu.test,v 1.18 2006/03/20 15:27:47 dkf Exp $
+# RCS: @(#) $Id: menu.test,v 1.19 2006/11/24 18:11:32 hobbs Exp $
 
 package require tcltest 2.1
 eval tcltest::configure $argv
@@ -2493,6 +2493,16 @@ test menu-35.1 {menus on multiple screens - crashes tk8.3.1, Bug 5454} \
     destroy .two
 } {}
 
+test menu-36.1 {menu -underline string overruns Bug 1599877} {} {
+    # ensure that -underline does not do string overruns [Bug 1599877]
+    catch {destroy .m}
+    menu .m
+    .m add command -label "File" -underline [expr {1<<30}]
+    . configure -menu .m
+    update
+    tk::TraverseToMenu . "e"
+} {}
+
 # cleanup
 deleteWindows
 cleanupTests
diff --git a/unix/tkUnixMenu.c b/unix/tkUnixMenu.c
index 6eafd91..bc64db5 100644
--- a/unix/tkUnixMenu.c
+++ b/unix/tkUnixMenu.c
@@ -8,7 +8,7 @@
  * See the file "license.terms" for information on usage and redistribution of
  * this file, and for a DISCLAIMER OF ALL WARRANTIES.
  *
- * RCS: @(#) $Id: tkUnixMenu.c,v 1.14 2005/11/27 02:36:16 das Exp $
+ * RCS: @(#) $Id: tkUnixMenu.c,v 1.15 2006/11/24 18:11:32 hobbs Exp $
  */
 
 #include "tkPort.h"
@@ -864,25 +864,31 @@ DrawMenuUnderline(
     int width,
     int height)
 {
-    int indicatorSpace = mePtr->indicatorSpace;
+    if ((mePtr->underline >= 0) && (mePtr->labelPtr != NULL)) {
+	int len;
 
-    if (mePtr->underline >= 0) {
-	int activeBorderWidth;
-	int leftEdge;
-	char *label = Tcl_GetStringFromObj(mePtr->labelPtr, NULL);
-	CONST char *start = Tcl_UtfAtIndex(label, mePtr->underline);
-	CONST char *end = Tcl_UtfNext(start);
+	/* do the unicode call just to prevent overruns */
+	Tcl_GetUnicodeFromObj(mePtr->labelPtr, &len);
+	if (mePtr->underline < len) {
+	    int activeBorderWidth;
+	    int leftEdge;
+	    CONST char *label, *start, *end;
 
-	Tk_GetPixelsFromObj(NULL, menuPtr->tkwin,
-		menuPtr->activeBorderWidthPtr, &activeBorderWidth);
-	leftEdge = x + indicatorSpace + activeBorderWidth;
-	if (menuPtr->menuType == MENUBAR) {
-	    leftEdge += 5;
-	}
+	    label = Tcl_GetStringFromObj(mePtr->labelPtr, NULL);
+	    start = Tcl_UtfAtIndex(label, mePtr->underline);
+	    end = Tcl_UtfNext(start);
 
-	Tk_UnderlineChars(menuPtr->display, d, gc, tkfont, label,
-    		leftEdge, y + (height + fmPtr->ascent - fmPtr->descent) / 2,
-		start - label, end - label);
+	    Tk_GetPixelsFromObj(NULL, menuPtr->tkwin,
+		    menuPtr->activeBorderWidthPtr, &activeBorderWidth);
+	    leftEdge = x + mePtr->indicatorSpace + activeBorderWidth;
+	    if (menuPtr->menuType == MENUBAR) {
+		leftEdge += 5;
+	    }
+
+	    Tk_UnderlineChars(menuPtr->display, d, gc, tkfont, label, leftEdge,
+		    y + (height + fmPtr->ascent - fmPtr->descent) / 2,
+		    start - label, end - label);
+	}
     }
 }
 
diff --git a/win/tkWinMenu.c b/win/tkWinMenu.c
index 564cc7a..0424563 100644
--- a/win/tkWinMenu.c
+++ b/win/tkWinMenu.c
@@ -10,7 +10,7 @@
  * See the file "license.terms" for information on usage and redistribution of
  * this file, and for a DISCLAIMER OF ALL WARRANTIES.
  *
- * RCS: @(#) $Id: tkWinMenu.c,v 1.50 2006/11/24 01:51:51 hobbs Exp $
+ * RCS: @(#) $Id: tkWinMenu.c,v 1.51 2006/11/24 18:11:32 hobbs Exp $
  */
 
 #define OEMRESOURCE
@@ -1125,7 +1125,7 @@ TkWinHandleMenuEvent(phwnd, pMessage, pwParam, plParam, plResult)
 		    Tcl_GetUnicodeFromObj(labelPtr, &len);
 		    if (underline < len) {
 			char *label;
-			label = Tcl_GetStringFromObj(labelPtr, &len);
+			label = Tcl_GetStringFromObj(labelPtr, NULL);
 			if (CharUpper((LPTSTR) menuChar)
 				== CharUpper((LPTSTR)
 					*Tcl_UtfAtIndex(label, underline))) {
@@ -1912,7 +1912,7 @@ DrawMenuUnderline(
 	if (mePtr->underline < len) {
 	    CONST char *label, *start, *end;
 
-	    label = Tcl_GetStringFromObj(mePtr->labelPtr, &len);
+	    label = Tcl_GetStringFromObj(mePtr->labelPtr, NULL);
 	    start = Tcl_UtfAtIndex(label, mePtr->underline);
 	    end = Tcl_UtfNext(start);
 	    Tk_UnderlineChars(menuPtr->display, d,