summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authordas <das>2009-04-10 15:53:28 (GMT)
committerdas <das>2009-04-10 15:53:28 (GMT)
commit162e97f430fc274905a600f204f66b04ac92a574 (patch)
tree9f52527b131a660a5247cfafbf14bf4bd76f7b37
parentccfcfc095899812f05e6039e2c77282255a7ef1c (diff)
downloadtk-162e97f430fc274905a600f204f66b04ac92a574.zip
tk-162e97f430fc274905a600f204f66b04ac92a574.tar.gz
tk-162e97f430fc274905a600f204f66b04ac92a574.tar.bz2
* generic/tkTextBTree.c (TkBTreeDeleteIndexRange): add bounds check
to startEnd array access (fixes testsuite crash).
-rw-r--r--generic/tkTextBTree.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/generic/tkTextBTree.c b/generic/tkTextBTree.c
index cb608e4..b714546 100644
--- a/generic/tkTextBTree.c
+++ b/generic/tkTextBTree.c
@@ -11,7 +11,7 @@
* See the file "license.terms" for information on usage and redistribution of
* this file, and for a DISCLAIMER OF ALL WARRANTIES.
*
- * RCS: @(#) $Id: tkTextBTree.c,v 1.27 2007/12/13 15:24:17 dgp Exp $
+ * RCS: @(#) $Id: tkTextBTree.c,v 1.27.2.1 2009/04/10 15:53:28 das Exp $
*/
#include "tkInt.h"
@@ -1517,7 +1517,8 @@ TkBTreeDeleteIndexRange(
if (treePtr->startEnd != NULL) {
int checkCount = 0;
- while (treePtr->startEnd[checkCount] != NULL) {
+ while (checkCount < treePtr->startEndCount &&
+ treePtr->startEnd[checkCount] != NULL) {
if (treePtr->startEnd[checkCount] == index2Ptr->linePtr) {
TkText *peer = treePtr->startEndRef[checkCount];