* tests/panedwindow.test:

	* generic/tkPanedWindow.c: ensure that sash index is lower bounds
	checked. [Bug #548727]

1 files changed, 7 insertions, 61 deletions

diff --git a/generic/tkPanedWindow.c b/generic/tkPanedWindow.c
index 6091f91..be14e9c 100644
--- a/generic/tkPanedWindow.c
+++ b/generic/tkPanedWindow.c
@@ -12,70 +12,13 @@
  * See the file "license.terms" for information on usage and redistribution
  * of this file, and for a DISCLAIMER OF ALL WARRANTIES.
  *
- * RCS: @(#) $Id: tkPanedWindow.c,v 1.3 2002/04/12 06:37:20 hobbs Exp $
+ * RCS: @(#) $Id: tkPanedWindow.c,v 1.4 2002/06/19 23:17:17 hobbs Exp $
  */
 
 #include "tkPort.h"
 #include "default.h"
 #include "tkInt.h"
 
-#if ((TCL_MAJOR_VERSION > 8) || (TCL_MAJOR_VERSION == 8 && TCL_MINOR_VERSION >= 4))
-#define TCL_84
-#endif
-
-/*
- * We need to have TK_OPTION_CUSTOM, et al defined to compile with any
- * stubs-enable version of Tk, but we'll only allow the widget to
- * be created in 8.4+.  These are taken from 8.4+ tk.h.
- */
-#ifndef TCL_84
-
-/*
- * Generating code for accessing these parts of the stub table when
- * compiling against a core older than 8.4a2 is a hassle because
- * we have to write up some macros hiding some very hackish pointer
- * arithmetics to get at these fields. We assume that pointer to
- * functions are always of the same size.
- */
-
-#define STUB_BASE   ((char*)(&(tkStubsPtr->tk_GetAnchorFromObj))) /*field 200*/
-#define procPtrSize (sizeof(Tcl_DriverBlockModeProc *))
-#define IDX(n)      (((n)-200) * procPtrSize)
-#define SLOT(n)     (STUB_BASE + IDX(n))
-
-typedef Tk_Window (tk_CreateAnonymousWindow) _ANSI_ARGS_((Tcl_Interp * interp,
-	Tk_Window parent, char * screenName)); /* 241 */
-#define Tk_CreateAnonymousWindow (*((tk_CreateAnonymousWindow**) (SLOT(241))))
-
-#define TK_OPTION_CUSTOM (TK_OPTION_END + 1)
-typedef int (Tk_CustomOptionSetProc) _ANSI_ARGS_((ClientData clientData,
-	Tcl_Interp *interp, Tk_Window tkwin, Tcl_Obj **value, char *widgRec,
-	int offset, char *saveInternalPtr, int flags));
-typedef Tcl_Obj *(Tk_CustomOptionGetProc) _ANSI_ARGS_((ClientData clientData,
-	Tk_Window tkwin, char *widgRec, int offset));
-typedef void (Tk_CustomOptionRestoreProc) _ANSI_ARGS_((ClientData clientData,
-	Tk_Window tkwin, char *internalPtr, char *saveInternalPtr));
-typedef void (Tk_CustomOptionFreeProc) _ANSI_ARGS_((ClientData clientData,
-	Tk_Window tkwin, char *internalPtr));
-   
-typedef struct Tk_ObjCustomOption {
-    char *name;				/* Name of the custom option. */
-    Tk_CustomOptionSetProc *setProc;	/* Function to use to set a record's
-					 * option value from a Tcl_Obj */
-    Tk_CustomOptionGetProc *getProc;	/* Function to use to get a Tcl_Obj
-					 * representation from an internal
-					 * representation of an option. */
-    Tk_CustomOptionRestoreProc *restoreProc;	/* Function to use to restore a
-						 * saved value for the internal
-						 * representation. */
-    Tk_CustomOptionFreeProc *freeProc;	/* Function to use to free the internal
-					 * representation of an option. */
-    ClientData clientData;		/* Arbitrary one-word value passed to
-					 * the handling procs. */
-} Tk_ObjCustomOption;
-
-#endif
-
 /* Flag values for "sticky"ness  The 16 combinations subsume the packer's
  * notion of anchor and fill.
  *
@@ -253,6 +196,9 @@ static char *	ComputeSlotAddress _ANSI_ARGS_((char *recordPtr, int offset));
 static int	PanedWindowIdentifyCoords _ANSI_ARGS_((PanedWindow *pwPtr,
 			Tcl_Interp *interp, int x, int y));
 
+#define ValidSashIndex(pwPtr, sash) \
+	(((sash) >= 0) && ((sash) < (pwPtr)->numSlaves))
+
 static Tk_GeomMgr panedWindowMgrType = {
     "panedwindow",		/* name */
     PanedWindowReqProc,		/* requestProc */
@@ -1077,7 +1023,7 @@ PanedWindowSashCommand(pwPtr, interp, objc, objv)
 		return TCL_ERROR;
 	    }
 
-	    if (sash >= pwPtr->numSlaves - 1) {
+	    if (!ValidSashIndex(pwPtr, sash)) {
 		Tcl_ResetResult(interp);
 		Tcl_SetResult(interp, "invalid sash index", TCL_STATIC);
 		return TCL_ERROR;
@@ -1100,7 +1046,7 @@ PanedWindowSashCommand(pwPtr, interp, objc, objv)
 		return TCL_ERROR;
 	    }
 
-	    if (sash >= pwPtr->numSlaves - 1) {
+	    if (!ValidSashIndex(pwPtr, sash)) {
 		Tcl_ResetResult(interp);
 		Tcl_SetResult(interp, "invalid sash index", TCL_STATIC);
 		return TCL_ERROR;
@@ -1137,7 +1083,7 @@ PanedWindowSashCommand(pwPtr, interp, objc, objv)
 		return TCL_ERROR;
 	    }
 
-	    if (sash >= pwPtr->numSlaves - 1) {
+	    if (!ValidSashIndex(pwPtr, sash)) {
 		Tcl_ResetResult(interp);
 		Tcl_SetResult(interp, "invalid sash index", TCL_STATIC);
 		return TCL_ERROR;