diff options
| author | das <das> | 2009-04-10 15:53:24 (GMT) |
|---|---|---|
| committer | das <das> | 2009-04-10 15:53:24 (GMT) |
| commit | 2699354ccc53dd1987f0f37e7f29365cef776c0b (patch) | |
| tree | a5c090afce11bdef6aab8133b0ae81de8662b558 /generic | |
| parent | 3249b503d4f3fdedf35e9fb6f6e6449e69c7ee97 (diff) | |
| download | tk-2699354ccc53dd1987f0f37e7f29365cef776c0b.zip tk-2699354ccc53dd1987f0f37e7f29365cef776c0b.tar.gz tk-2699354ccc53dd1987f0f37e7f29365cef776c0b.tar.bz2 | |
* generic/tkTextBTree.c (TkBTreeDeleteIndexRange): add bounds check
to startEnd array access (fixes testsuite crash).
Diffstat (limited to 'generic')
| -rw-r--r-- | generic/tkTextBTree.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/generic/tkTextBTree.c b/generic/tkTextBTree.c index 1afcf76..381f72c 100644 --- a/generic/tkTextBTree.c +++ b/generic/tkTextBTree.c @@ -11,7 +11,7 @@ * See the file "license.terms" for information on usage and redistribution of * this file, and for a DISCLAIMER OF ALL WARRANTIES. * - * RCS: @(#) $Id: tkTextBTree.c,v 1.28 2008/11/08 18:44:40 dkf Exp $ + * RCS: @(#) $Id: tkTextBTree.c,v 1.29 2009/04/10 15:53:24 das Exp $ */ #include "tkInt.h" @@ -1517,7 +1517,8 @@ TkBTreeDeleteIndexRange( if (treePtr->startEnd != NULL) { int checkCount = 0; - while (treePtr->startEnd[checkCount] != NULL) { + while (checkCount < treePtr->startEndCount && + treePtr->startEnd[checkCount] != NULL) { if (treePtr->startEnd[checkCount] == index2Ptr->linePtr) { TkText *peer = treePtr->startEndRef[checkCount]; |