Attachment "829027.patch" to
ticket [829027ffff]
added by
dgp
2003-10-24 04:11:54.
Index: generic/tclCmdIL.c
===================================================================
RCS file: /cvsroot/tcl/tcl/generic/tclCmdIL.c,v
retrieving revision 1.55
diff -u -r1.55 tclCmdIL.c
--- generic/tclCmdIL.c 15 Oct 2003 13:15:45 -0000 1.55
+++ generic/tclCmdIL.c 23 Oct 2003 21:07:30 -0000
@@ -2689,8 +2689,12 @@
* POSSIBLE FUTURE ENHANCEMENT: Build the resulting list object
* directly and avoid a copy.
*/
+ if (elementCount > (INT_MAX / sizeof(Tcl_Obj *)) / objc ) {
+ Tcl_AppendResult(interp, "overflow of maximum list length", NULL);
+ return TCL_ERROR;
+ }
- dataArray = (Tcl_Obj **) ckalloc(elementCount * objc * sizeof(Tcl_Obj));
+ dataArray = (Tcl_Obj **) ckalloc(elementCount * objc * sizeof(Tcl_Obj *));
/*
* Set the elements. Note that this ends up setting k to the
