* unix/tkUnixMenu.c (DrawMenuUnderline): bound Tcl_UtfAtIndex usage

	* tests/menu.test (menu-36.1): [Bug 1599877]

1 files changed, 23 insertions, 17 deletions

diff --git a/unix/tkUnixMenu.c b/unix/tkUnixMenu.c
index 6eafd91..bc64db5 100644
--- a/unix/tkUnixMenu.c
+++ b/unix/tkUnixMenu.c
@@ -8,7 +8,7 @@
  * See the file "license.terms" for information on usage and redistribution of
  * this file, and for a DISCLAIMER OF ALL WARRANTIES.
  *
- * RCS: @(#) $Id: tkUnixMenu.c,v 1.14 2005/11/27 02:36:16 das Exp $
+ * RCS: @(#) $Id: tkUnixMenu.c,v 1.15 2006/11/24 18:11:32 hobbs Exp $
  */
 
 #include "tkPort.h"
@@ -864,25 +864,31 @@ DrawMenuUnderline(
     int width,
     int height)
 {
-    int indicatorSpace = mePtr->indicatorSpace;
+    if ((mePtr->underline >= 0) && (mePtr->labelPtr != NULL)) {
+	int len;
 
-    if (mePtr->underline >= 0) {
-	int activeBorderWidth;
-	int leftEdge;
-	char *label = Tcl_GetStringFromObj(mePtr->labelPtr, NULL);
-	CONST char *start = Tcl_UtfAtIndex(label, mePtr->underline);
-	CONST char *end = Tcl_UtfNext(start);
+	/* do the unicode call just to prevent overruns */
+	Tcl_GetUnicodeFromObj(mePtr->labelPtr, &len);
+	if (mePtr->underline < len) {
+	    int activeBorderWidth;
+	    int leftEdge;
+	    CONST char *label, *start, *end;
 
-	Tk_GetPixelsFromObj(NULL, menuPtr->tkwin,
-		menuPtr->activeBorderWidthPtr, &activeBorderWidth);
-	leftEdge = x + indicatorSpace + activeBorderWidth;
-	if (menuPtr->menuType == MENUBAR) {
-	    leftEdge += 5;
-	}
+	    label = Tcl_GetStringFromObj(mePtr->labelPtr, NULL);
+	    start = Tcl_UtfAtIndex(label, mePtr->underline);
+	    end = Tcl_UtfNext(start);
 
-	Tk_UnderlineChars(menuPtr->display, d, gc, tkfont, label,
-    		leftEdge, y + (height + fmPtr->ascent - fmPtr->descent) / 2,
-		start - label, end - label);
+	    Tk_GetPixelsFromObj(NULL, menuPtr->tkwin,
+		    menuPtr->activeBorderWidthPtr, &activeBorderWidth);
+	    leftEdge = x + mePtr->indicatorSpace + activeBorderWidth;
+	    if (menuPtr->menuType == MENUBAR) {
+		leftEdge += 5;
+	    }
+
+	    Tk_UnderlineChars(menuPtr->display, d, gc, tkfont, label, leftEdge,
+		    y + (height + fmPtr->ascent - fmPtr->descent) / 2,
+		    start - label, end - label);
+	}
     }
 }