Attachment "2845535.patch" to
ticket [2845535fff]
added by
dgp
2009-08-28 02:21:58.
? 1522803.patch
? 1969717-85.patch
? 1969717.patch
? 1999716.patch
? 2251175.patch
? 2385549.patch
? 2571597.patch
? 2629338.patch
? 2710920.patch
? 2801413.patch
? 2806250.patch
? 2837800.patch
? 2845535.patch
? a.out
? adsfasd
? debug
? lrange_cleanup.patch
? merge.patch
? mips
? saaz
? sgi
? sift
? tbug
? tcl.diff
? tclNamesp.c.patch
? temp.patch
? thread
? tm-safe-base.patch
? try.c
? undo
? undoi
? unix64
? xanadu
? generic/2251175.patch
? generic/dgp.patch
? generic/exam
? generic/revised.c
? generic/tclFileName.c.aside
? generic/tclStrToD.c.ip
? generic/tclStringObj.c.hacked
? generic/tclTrace.c.tmp
? generic/tclVar.c.tmp
? unix/2806250.tcl
? unix/2834453.tcl
? unix/bar.tcl
? unix/demo.tcl
? unix/dltest.marker
? unix/fff.tcl
? unix/sdf
? unix/sift
? unix/sol10-intel-configure.patch
? unix/stXXXXF14x74
? unix/trofs.arch
? unix/trofstest
Index: generic/tclStringObj.c
===================================================================
RCS file: /cvsroot/tcl/tcl/generic/tclStringObj.c,v
retrieving revision 1.70.2.17
diff -u -r1.70.2.17 tclStringObj.c
--- generic/tclStringObj.c 31 Jul 2009 16:56:32 -0000 1.70.2.17
+++ generic/tclStringObj.c 27 Aug 2009 19:17:56 -0000
@@ -2363,6 +2363,10 @@
if (gotPrecision) {
*p++ = '.';
p += sprintf(p, "%d", precision);
+ if (precision > INT_MAX - length) {
+ msg=overflow;
+ goto errorMsg;
+ }
length += precision;
}
@@ -2375,9 +2379,15 @@
segment = Tcl_NewObj();
allocSegment = 1;
- Tcl_SetObjLength(segment, length);
+ if (!Tcl_AttemptSetObjLength(segment, length)) {
+ msg = overflow;
+ goto errorMsg;
+ }
bytes = TclGetString(segment);
- Tcl_SetObjLength(segment, sprintf(bytes, spec, d));
+ if (!Tcl_AttemptSetObjLength(segment, sprintf(bytes, spec, d))) {
+ msg = overflow;
+ goto errorMsg;
+ }
break;
}
default:
