Artifact
427efc96b901ce9fc459228737010814a5ffa394:
Ticket change
[427efc96b9]
- New ticket
[c2d22775ce] Fix signed integer overflow in Tcl_ListObjReplace.
by
anonymous
2017-08-02 06:35:08.
D 2017-08-02T06:35:08.911
J assignee nobody
J closer nobody
J cmimetype text/plain
J comment Tcl_ListObjReplace\scontains\scode:\r\nint\sfirst;\r\nint\scount\r\n....\r\nif\s(numElems\s<\sfirst+count\s||\sfirst+count\s<\s0)\s{\r\n/*\r\n*\sThe\s'first+count\s<\s0'\scondition\shere\sguards\sagains\sinteger\r\n*\soverflow\sin\sdetermining\s'first+count'.\r\n*/\r\n\r\nSo\soverflow\sis\sexpected\sbut\sit's\scalculated\swith\ssigned\stype\swhich\sis\s"undefined\sbehavior"\r\n\r\nProposed\sfix:\r\n\r\n---\sold/generic/tclListObj.c\t2015-11-17\s17:03:00.000000000\s-0800\r\n+++\snew/generic/tclListObj.c\t2017-08-01\s23:22:59.000000000\s-0700\r\n@@\s-897,13\s+897,16\s@@\r\n\s\s\s\s\s}\r\n\s\s\s\s\sif\s(count\s<\s0)\s{\r\n\s\tcount\s=\s0;\r\n-\s\s\s\s}\selse\sif\s(numElems\s<\sfirst+count\s||\sfirst+count\s<\s0)\s{\r\n-\t/*\r\n-\t\s*\sThe\s'first+count\s<\s0'\scondition\shere\sguards\sagains\sinteger\r\n-\t\s*\soverflow\sin\sdetermining\s'first+count'.\r\n-\t\s*/\r\n+\s\s\s\s}\selse\s{\r\n+\tint\sfirstWithCount\s=\s(unsigned)\sfirst\s+\scount;\r\n+\tif\s(numElems\s<\sfirstWithCount\s||\sfirstWithCount\s<\s0)\s{\r\n+\t\s\s\s\s/*\r\n+\t\s\s\s\s\s*\sThe\s'first+count\s<\s0'\scondition\shere\sguards\sagains\sinteger\r\n+\t\s\s\s\s\s*\soverflow\sin\sdetermining\s'first+count'.\r\n+\t\s\s\s\s\s*/\r\n\s\r\n-\tcount\s=\snumElems\s-\sfirst;\r\n+\t\s\s\s\scount\s=\snumElems\s-\sfirst;\r\n+\t}\r\n\s\s\s\s\s}\r\n\s\r\n\s\s\s\s\sisShared\s=\s(listRepPtr->refCount\s>\s1);
J foundin 8.6.4
J is_private 0
J login anonymous
J priority 5\sMedium
J private_contact 61ec11df7062b717a200d064063aa94b7b27781c
J resolution None
J severity Minor
J status Open
J submitter anonymous
J subsystem None
J title Fix\ssigned\sinteger\soverflow\sin\sTcl_ListObjReplace
J type Patch
K c2d22775ce4c6b53e57f3450ab935e1f87a64d23
U anonymous
Z 3a52881022e18c41f00e39933ae00773
