Index: generic/tclCmdIL.c
===================================================================
RCS file: /cvsroot/tcl/tcl/generic/tclCmdIL.c,v
retrieving revision 1.55
diff -u -r1.55 tclCmdIL.c
--- generic/tclCmdIL.c	15 Oct 2003 13:15:45 -0000	1.55
+++ generic/tclCmdIL.c	23 Oct 2003 21:07:30 -0000
@@ -2689,8 +2689,12 @@
      * POSSIBLE FUTURE ENHANCEMENT: Build the resulting list object
      * directly and avoid a copy.
      */
+    if (elementCount > (INT_MAX / sizeof(Tcl_Obj *)) / objc ) {
+	Tcl_AppendResult(interp, "overflow of maximum list length", NULL);
+	return TCL_ERROR;
+    }
 
-    dataArray = (Tcl_Obj **) ckalloc(elementCount * objc * sizeof(Tcl_Obj));
+    dataArray = (Tcl_Obj **) ckalloc(elementCount * objc * sizeof(Tcl_Obj *));
 
     /*
      * Set the elements.  Note that this ends up setting k to the
