From 34d8945d9d1dbbb3f599cabcad75ec0305f7615d Mon Sep 17 00:00:00 2001
From: "jan.nijtmans" <nijtmans@users.sourceforge.net>
Date: Wed, 31 Aug 2016 08:50:23 +0000
Subject: Fix use of XMaxTransChars in stead of TCL_UTF_MAX in some places.
 This should prevent possible buffer overflow when TCL_UTF_MAX=6
 Micro-optimizations in tkEntry and ttkEntry

---
 generic/tkEntry.c      | 3 ++-
 generic/ttk/ttkEntry.c | 3 ++-
 win/tkWinFont.c        | 2 +-
 win/tkWinKey.c         | 4 ++--
 win/tkWinX.c           | 4 ++--
 5 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/generic/tkEntry.c b/generic/tkEntry.c
index ea8d7f1..c0ce47b 100644
--- a/generic/tkEntry.c
+++ b/generic/tkEntry.c
@@ -1943,7 +1943,8 @@ EntryComputeGeometry(
 	entryPtr->displayString = p;
 
 	for (i = entryPtr->numChars; --i >= 0; ) {
-	    p += Tcl_UniCharToUtf(ch, p);
+	    memcpy(p, buf, size);
+	    p += size;
 	}
 	*p = '\0';
     }
diff --git a/generic/ttk/ttkEntry.c b/generic/ttk/ttkEntry.c
index f395649..533637d 100644
--- a/generic/ttk/ttkEntry.c
+++ b/generic/ttk/ttkEntry.c
@@ -290,7 +290,8 @@ static char *EntryDisplayString(const char *showChar, int numChars)
     p = displayString = ckalloc(numChars * size + 1);
 
     while (numChars--) {
-	p += Tcl_UniCharToUtf(ch, p);
+	memcpy(p, buf, size);
+	p += size;
     }
     *p = '\0';
 
diff --git a/win/tkWinFont.c b/win/tkWinFont.c
index 9172b00..940bc10 100644
--- a/win/tkWinFont.c
+++ b/win/tkWinFont.c
@@ -2188,7 +2188,7 @@ FontMapLoadPage(
 {
     FontFamily *familyPtr;
     Tcl_Encoding encoding;
-    char src[TCL_UTF_MAX], buf[16];
+    char src[XMaxTransChars], buf[16];
     USHORT *startCount, *endCount;
     int i, j, bitOffset, end, segCount;
 
diff --git a/win/tkWinKey.c b/win/tkWinKey.c
index ed546f7..5591133 100644
--- a/win/tkWinKey.c
+++ b/win/tkWinKey.c
@@ -102,7 +102,7 @@ TkpGetString(
 	 */
 
 	int unichar;
-	char buf[TCL_UTF_MAX];
+	char buf[XMaxTransChars];
 	int len;
 
 	unichar = keyEv->trans_chars[1] & 0xff;
@@ -129,7 +129,7 @@ TkpGetString(
 
 	if (((keysym != NoSymbol) && (keysym > 0) && (keysym < 256))
 		|| (keysym == XK_Return) || (keysym == XK_Tab)) {
-	    char buf[TCL_UTF_MAX];
+	    char buf[XMaxTransChars];
 	    int len;
 
 	    len = Tcl_UniCharToUtf((Tcl_UniChar) (keysym & 255), buf);
diff --git a/win/tkWinX.c b/win/tkWinX.c
index 6c44059..99102cb 100644
--- a/win/tkWinX.c
+++ b/win/tkWinX.c
@@ -1215,13 +1215,13 @@ GenerateXEvent(
 	    break;
 
 	case WM_UNICHAR: {
-	    char buffer[TCL_UTF_MAX+1];
+	    char buffer[XMaxTransChars];
 	    int i;
 	    event.type = KeyPress;
 	    event.xany.send_event = -3;
 	    event.xkey.keycode = wParam;
 	    event.xkey.nbytes = Tcl_UniCharToUtf((int)wParam, buffer);
-	    for (i=0; i<event.xkey.nbytes && i<TCL_UTF_MAX; ++i) {
+	    for (i=0; i<event.xkey.nbytes && i<XMaxTransChars; ++i) {
 		event.xkey.trans_chars[i] = buffer[i];
 	    }
 	    Tk_QueueWindowEvent(&event, TCL_QUEUE_TAIL);
-- 
cgit v0.12