Index: generic/tclIndexObj.c
===================================================================
--- generic/tclIndexObj.c
+++ generic/tclIndexObj.c
@@ -1111,17 +1111,19 @@
     int objc;			/* # arguments in objv still to process. */
     int length;			/* Number of characters in current argument */
 
     if (remObjv != NULL) {
 	/*
+	 * Upper bound is known: *objcPtr + 1 for (undocumented but
+	 * historical) NULL terminator
+	 */
+	leftovers = ckalloc((1 + *objcPtr) * sizeof(Tcl_Obj *));
+	/*
 	 * Then we should copy the name of the command (0th argument).
 	 */
-
 	nrem = 1;
-	leftovers = ckalloc((nrem + 1) * sizeof(Tcl_Obj *));
-	leftovers[nrem-1] = objv[0];
-	leftovers[nrem] = NULL;
+	leftovers[0] = objv[0];
     } else {
 	nrem = 0;
 	leftovers = NULL;
     }
 
@@ -1180,18 +1182,11 @@
 			"\"", NULL);
 		goto error;
 	    }
 
 	    dstIndex++;		/* This argument is now handled */
-	    nrem++;
-
-	    /*
-	     * Allocate nrem (+1 extra for NULL terminator) pointers.
-	     */
-
-	    leftovers = ckrealloc(leftovers, (nrem+1) * sizeof(Tcl_Obj *));
-	    leftovers[nrem-1] = curArg;
+	    leftovers[nrem++] = curArg;
 	    continue;
 	}
 
 	/*
 	 * Take the appropriate action based on the option type
@@ -1293,21 +1288,19 @@
 
 	return TCL_OK;
     }
 
     if (objc > 0) {
-	leftovers = ckrealloc(leftovers, (nrem+objc+1) * sizeof(Tcl_Obj *));
 	while (objc) {
 	    leftovers[nrem] = objv[srcIndex];
 	    nrem++;
 	    srcIndex++;
 	    objc--;
 	}
-    } else if (leftovers != NULL) {
-	ckfree(leftovers);
     }
-    leftovers[nrem] = NULL;
+    leftovers[nrem++] = NULL;
+    leftovers = ckrealloc(leftovers, nrem * sizeof(Tcl_Obj *));
     *objcPtr = nrem;
     *remObjv = leftovers;
     return TCL_OK;
 
     /*

