diff options
| author | das <das> | 2009-04-10 15:53:28 (GMT) |
|---|---|---|
| committer | das <das> | 2009-04-10 15:53:28 (GMT) |
| commit | 162e97f430fc274905a600f204f66b04ac92a574 (patch) | |
| tree | 9f52527b131a660a5247cfafbf14bf4bd76f7b37 | |
| parent | ccfcfc095899812f05e6039e2c77282255a7ef1c (diff) | |
| download | tk-162e97f430fc274905a600f204f66b04ac92a574.zip tk-162e97f430fc274905a600f204f66b04ac92a574.tar.gz tk-162e97f430fc274905a600f204f66b04ac92a574.tar.bz2 | |
* generic/tkTextBTree.c (TkBTreeDeleteIndexRange): add bounds check
to startEnd array access (fixes testsuite crash).
| -rw-r--r-- | generic/tkTextBTree.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/generic/tkTextBTree.c b/generic/tkTextBTree.c index cb608e4..b714546 100644 --- a/generic/tkTextBTree.c +++ b/generic/tkTextBTree.c @@ -11,7 +11,7 @@ * See the file "license.terms" for information on usage and redistribution of * this file, and for a DISCLAIMER OF ALL WARRANTIES. * - * RCS: @(#) $Id: tkTextBTree.c,v 1.27 2007/12/13 15:24:17 dgp Exp $ + * RCS: @(#) $Id: tkTextBTree.c,v 1.27.2.1 2009/04/10 15:53:28 das Exp $ */ #include "tkInt.h" @@ -1517,7 +1517,8 @@ TkBTreeDeleteIndexRange( if (treePtr->startEnd != NULL) { int checkCount = 0; - while (treePtr->startEnd[checkCount] != NULL) { + while (checkCount < treePtr->startEndCount && + treePtr->startEnd[checkCount] != NULL) { if (treePtr->startEnd[checkCount] == index2Ptr->linePtr) { TkText *peer = treePtr->startEndRef[checkCount]; |