From 2699354ccc53dd1987f0f37e7f29365cef776c0b Mon Sep 17 00:00:00 2001
From: das <das>
Date: Fri, 10 Apr 2009 15:53:24 +0000
Subject: 	* generic/tkTextBTree.c (TkBTreeDeleteIndexRange): add bounds
 check 	to startEnd array access (fixes testsuite crash).

---
 generic/tkTextBTree.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/generic/tkTextBTree.c b/generic/tkTextBTree.c
index 1afcf76..381f72c 100644
--- a/generic/tkTextBTree.c
+++ b/generic/tkTextBTree.c
@@ -11,7 +11,7 @@
  * See the file "license.terms" for information on usage and redistribution of
  * this file, and for a DISCLAIMER OF ALL WARRANTIES.
  *
- * RCS: @(#) $Id: tkTextBTree.c,v 1.28 2008/11/08 18:44:40 dkf Exp $
+ * RCS: @(#) $Id: tkTextBTree.c,v 1.29 2009/04/10 15:53:24 das Exp $
  */
 
 #include "tkInt.h"
@@ -1517,7 +1517,8 @@ TkBTreeDeleteIndexRange(
 	if (treePtr->startEnd != NULL) {
 	    int checkCount = 0;
 
-	    while (treePtr->startEnd[checkCount] != NULL) {
+	    while (checkCount < treePtr->startEndCount &&
+		    treePtr->startEnd[checkCount] != NULL) {
 		if (treePtr->startEnd[checkCount] == index2Ptr->linePtr) {
 		    TkText *peer = treePtr->startEndRef[checkCount];
 
-- 
cgit v0.12