summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authordas <das>2009-04-10 15:53:24 (GMT)
committerdas <das>2009-04-10 15:53:24 (GMT)
commit2699354ccc53dd1987f0f37e7f29365cef776c0b (patch)
treea5c090afce11bdef6aab8133b0ae81de8662b558
parent3249b503d4f3fdedf35e9fb6f6e6449e69c7ee97 (diff)
downloadtk-2699354ccc53dd1987f0f37e7f29365cef776c0b.zip
tk-2699354ccc53dd1987f0f37e7f29365cef776c0b.tar.gz
tk-2699354ccc53dd1987f0f37e7f29365cef776c0b.tar.bz2
* generic/tkTextBTree.c (TkBTreeDeleteIndexRange): add bounds check
to startEnd array access (fixes testsuite crash).
-rw-r--r--generic/tkTextBTree.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/generic/tkTextBTree.c b/generic/tkTextBTree.c
index 1afcf76..381f72c 100644
--- a/generic/tkTextBTree.c
+++ b/generic/tkTextBTree.c
@@ -11,7 +11,7 @@
* See the file "license.terms" for information on usage and redistribution of
* this file, and for a DISCLAIMER OF ALL WARRANTIES.
*
- * RCS: @(#) $Id: tkTextBTree.c,v 1.28 2008/11/08 18:44:40 dkf Exp $
+ * RCS: @(#) $Id: tkTextBTree.c,v 1.29 2009/04/10 15:53:24 das Exp $
*/
#include "tkInt.h"
@@ -1517,7 +1517,8 @@ TkBTreeDeleteIndexRange(
if (treePtr->startEnd != NULL) {
int checkCount = 0;
- while (treePtr->startEnd[checkCount] != NULL) {
+ while (checkCount < treePtr->startEndCount &&
+ treePtr->startEnd[checkCount] != NULL) {
if (treePtr->startEnd[checkCount] == index2Ptr->linePtr) {
TkText *peer = treePtr->startEndRef[checkCount];