Tcl Source Code

Artifact 8d52dc20b1ec486b524781cc499e1d92ae1b2aa52e0102fde169d4d3e478209c:

Attachment "a30d273cfb.diff" to ticket [a30d273cfb] added by chrstphrchvz 2022-02-19 09:07:04. (unpublished)

---

diff --git generic/tclExecute.c generic/tclExecute.c
index 97ac1f0b8..7ccbb1868 100644
--- generic/tclExecute.c
+++ generic/tclExecute.c
@@ -2767,7 +2767,7 @@ TEBCresume(
 		    appendLen >= 0 && currPtr <= &OBJ_AT_TOS; currPtr++) {
 		if ((*currPtr)->bytes != tclEmptyStringRep) {
 		    Tcl_GetByteArrayFromObj(*currPtr, &length);
-		    appendLen += length;
+		    appendLen = (int)((unsigned int)appendLen + (unsigned int)length);
 		}
 	    }
 	} else {
@@ -2775,7 +2775,7 @@ TEBCresume(
 		    appendLen >= 0 && currPtr <= &OBJ_AT_TOS; currPtr++) {
 		bytes = TclGetStringFromObj(*currPtr, &length);
 		if (bytes != NULL) {
-		    appendLen += length;
+		    appendLen = (int)((unsigned int)appendLen + (unsigned int)length);
 		}
 	    }
 	}
@@ -2809,7 +2809,7 @@ TEBCresume(
 	objResultPtr = OBJ_AT_DEPTH(opnd-1);
 	if (!onlyb) {
 	    bytes = TclGetStringFromObj(objResultPtr, &length);
-	    if (length + appendLen < 0) {
+	    if (length > INT_MAX - appendLen) {
 		/* TODO: convert panic to error ? */
 		Tcl_Panic("max size for a Tcl value (%d bytes) exceeded",
 			INT_MAX);
@@ -2817,14 +2817,15 @@ TEBCresume(
 #ifndef TCL_COMPILE_DEBUG
 	    if (bytes != tclEmptyStringRep && !Tcl_IsShared(objResultPtr)) {
 		TclFreeIntRep(objResultPtr);
-		objResultPtr->bytes = ckrealloc(bytes, length+appendLen+1);
+		objResultPtr->bytes = ckrealloc(bytes,
+			(unsigned int)(length + appendLen) + 1U);
 		objResultPtr->length = length + appendLen;
 		p = TclGetString(objResultPtr) + length;
 		currPtr = &OBJ_AT_DEPTH(opnd - 2);
 	    } else
 #endif
 	    {
-		p = ckalloc(length + appendLen + 1);
+		p = ckalloc((unsigned int)(length + appendLen) + 1U);
 		TclNewObj(objResultPtr);
 		objResultPtr->bytes = p;
 		objResultPtr->length = length + appendLen;
@@ -2845,7 +2846,7 @@ TEBCresume(
 	    *p = '\0';
 	} else {
 	    bytes = (char *) Tcl_GetByteArrayFromObj(objResultPtr, &length);
-	    if (length + appendLen < 0) {
+	    if (length > INT_MAX - appendLen) {
 		/* TODO: convert panic to error ? */
 		Tcl_Panic("max size for a Tcl value (%d bytes) exceeded",
 			INT_MAX);