summaryrefslogtreecommitdiffstats
path: root/generic/tkCanvas.c
diff options
context:
space:
mode:
authordkf <donal.k.fellows@manchester.ac.uk>2010-01-19 22:10:03 (GMT)
committerdkf <donal.k.fellows@manchester.ac.uk>2010-01-19 22:10:03 (GMT)
commit027efdef074cb8c116b5f9c888ad445ea692f654 (patch)
treeb76a1d95896b40e32c3f812596f7ccab45ec558c /generic/tkCanvas.c
parent18681848c901d1e0eb876c8b8c1b7d4106270326 (diff)
downloadtk-027efdef074cb8c116b5f9c888ad445ea692f654.zip
tk-027efdef074cb8c116b5f9c888ad445ea692f654.tar.gz
tk-027efdef074cb8c116b5f9c888ad445ea692f654.tar.bz2
[Bug 2931374]: Stop overflow of working buffer during construction of long
tag expressions.
Diffstat (limited to 'generic/tkCanvas.c')
-rw-r--r--generic/tkCanvas.c8
1 files changed, 6 insertions, 2 deletions
diff --git a/generic/tkCanvas.c b/generic/tkCanvas.c
index b489eb4..ade1374 100644
--- a/generic/tkCanvas.c
+++ b/generic/tkCanvas.c
@@ -12,7 +12,7 @@
* See the file "license.terms" for information on usage and redistribution of
* this file, and for a DISCLAIMER OF ALL WARRANTIES.
*
- * RCS: @(#) $Id: tkCanvas.c,v 1.63 2010/01/18 20:43:38 nijtmans Exp $
+ * RCS: @(#) $Id: tkCanvas.c,v 1.64 2010/01/19 22:10:03 dkf Exp $
*/
/* #define USE_OLD_TAG_SEARCH 1 */
@@ -3561,7 +3561,11 @@ TagSearchScanExpr(
while (searchPtr->stringIndex < searchPtr->stringLength) {
c = searchPtr->string[searchPtr->stringIndex++];
- if (expr->allocated == expr->index) {
+ /*
+ * Need two slots free at this point, not one. [Bug 2931374]
+ */
+
+ if (expr->index >= expr->allocated-1) {
expr->allocated += 15;
if (expr->uids) {
expr->uids = (Tk_Uid *) ckrealloc((char *) expr->uids,