Tcl Source Code

Although it only makes sense to provide nonnegative argc to Tcl_Merge(), the function is a public API currently making no effort to guard against negative argc.

• When argc is negative, there is signed integer overflow in the expression INT_MAX - argc + 1.

• (Assuming 32-bit int.) If argc == INT_MIN, the current behavior is to allocate a 2GiB buffer and then write '\0' to the byte prior to the beginning of buffer. Otherwise, if INT_MIN < argc && argc < 0, then the function panics, claiming max size for a Tcl value (2147483647 bytes) exceeded.

At a minimum, I would suggest changing the behavior of the function slightly so that it always panics to prevent the out-of-bounds write; panicking is already possible in that case during the ckalloc(INT_MIN) call. Maybe a more helpful panic message can be used. See attached patch for a possible solution.

Should be better now: [63b0443866958521]

I meant argc == INT_MIN in the previous comment.

[0e2b23ff845b] does fix quite a few issues, including some I had suspected or had not yet reported.

However there is still the issue of argc == INT_MAX leading to an out-of-bounds write. Is this won't-fix for Tcl < 9.0?

Should be fixed [0e2b23ff845b1e1b|here]