Fixed [3512539fff] - .. is silently accepted in widget paths

2 files changed, 12 insertions, 3 deletions

diff --git a/generic/tkWindow.c b/generic/tkWindow.c
index b5cbbab..3797c23 100644
--- a/generic/tkWindow.c
+++ b/generic/tkWindow.c
@@ -1173,10 +1173,12 @@ Tk_CreateWindowFromPath(
 
     /*
      * Strip the parent's name out of pathName (it's everything up to the last
-     * dot). There are two tricky parts: (a) must copy the parent's name
+     * dot). There are three tricky parts: (a) must copy the parent's name
      * somewhere else to avoid modifying the pathName string (for large names,
      * space for the copy will have to be malloc'ed); (b) must special-case
-     * the situation where the parent is ".".
+     * the situation where the parent is "."; (c) the parent's name cannot be
+     * only 1 character long because it should include both a leading dot and
+     * at least one additional characters.
      */
 
     p = strrchr(pathName, '.');
@@ -1195,6 +1197,11 @@ Tk_CreateWindowFromPath(
     if (numChars == 0) {
 	*p = '.';
 	p[1] = '\0';
+    } else if (numChars == 1) {
+	Tcl_SetObjResult(interp, Tcl_ObjPrintf(
+		"bad window path name \"%s\"", pathName));
+	Tcl_SetErrorCode(interp, "TK", "VALUE", "WINDOW_PATH", NULL);
+	return NULL;
     } else {
 	strncpy(p, pathName, (size_t) numChars);
 	p[numChars] = '\0';
diff --git a/tests/window.test b/tests/window.test
index fea695a..f02db3e 100644
--- a/tests/window.test
+++ b/tests/window.test
@@ -39,7 +39,9 @@ test window-1.1 {Tk_CreateWindowFromPath procedure, parent dead} -setup {
     while executing
 "button .t.b -text hello"
     (command bound to event)}}
-
+test window-1.2 {Tk_CreateWindowFromPath procedure, pathname starting with two dots} -body {
+    label ..mylabel
+} -returnCodes error -result {bad window path name "..mylabel"}
 
 # Most of the tests below don't produce meaningful results;  they
 # will simply dump core if there are bugs.