| Ticket UUID: | 2801413 | |||
| Title: | [format %llx] overflow | |||
| Type: | Bug | Version: | obsolete: 8.5.7 | |
| Submitter: | dgp | Created on: | 2009-06-04 22:06:02 | |
| Subsystem: | 10. Objects | Assigned To: | dgp | |
| Priority: | 5 Medium | Severity: | ||
| Status: | Closed | Last Modified: | 2009-06-11 04:40:21 | |
| Resolution: | Fixed | Closed By: | dgp | |
| Closed on: | 2009-06-10 21:40:21 | |||
| Description: |
% set x [expr {1<<(2**29)}]; concat
% set x [expr {$x<<(2**29)}]; concat
% set x [expr {$x<<(2**29)}]; concat
% set x [expr {$x<<(2**29)}]; concat
% incr x -1; concat
% set s [format %#llx $x]; concat
Tcl_SetObjLength: negative length requested: -536870912 (integer overflow?)
Computing the value of numDigits overflows
the int range.
| |||
| User Comments: |
dgp added on 2009-06-11 04:40:21:
allow_comments - 1 patch committed for 8.5.8 and 8.6b2. dgp added on 2009-06-11 04:23:23: Updated patch also converts all [format] panics due to string length overflow into simple Tcl errors. dgp added on 2009-06-11 04:22:37: File Added - 330526: 2801413.patch dgp added on 2009-06-11 04:21:37: File Deleted - 329932: dgp added on 2009-06-06 05:04:52: File Added - 329932: 2801413.patch dgp added on 2009-06-06 05:04:14:
After applying attached patch:
% set max [expr {(1<<(2**31-3)<<(2**31-3)<<(2**31-3)<<(2**31-3))-1}]; concat
% set s [format %#llx $max]; concat
% string length $s
2147483647
% incr max; concat
% set s [format %#llx $max]; concat
max size for a Tcl value (2147483647 bytes) exceeded
This demos ability of [format] to create a numeric
string up to Tcl's limits.
A panic when those limits are exceeded is a bit
jarring, but that's a separate bug/misfeature.
| |||
Attachments:
- 2801413.patch [download] added by dgp on 2009-06-11 04:22:37. [details]