? 1522803.patch
? 1969717-85.patch
? 1969717.patch
? 1999716.patch
? 2251175.patch
? 2385549.patch
? 2571597.patch
? 2629338.patch
? 2710920.patch
? 2801413.patch
? 2806250.patch
? 2837800.patch
? 2845535.patch
? a.out
? adsfasd
? debug
? lrange_cleanup.patch
? merge.patch
? mips
? saaz
? sgi
? sift
? tbug
? tcl.diff
? tclNamesp.c.patch
? temp.patch
? thread
? tm-safe-base.patch
? try.c
? undo
? undoi
? unix64
? xanadu
? generic/2251175.patch
? generic/dgp.patch
? generic/exam
? generic/revised.c
? generic/tclFileName.c.aside
? generic/tclStrToD.c.ip
? generic/tclStringObj.c.hacked
? generic/tclTrace.c.tmp
? generic/tclVar.c.tmp
? unix/2806250.tcl
? unix/2834453.tcl
? unix/bar.tcl
? unix/demo.tcl
? unix/dltest.marker
? unix/fff.tcl
? unix/sdf
? unix/sift
? unix/sol10-intel-configure.patch
? unix/stXXXXF14x74
? unix/trofs.arch
? unix/trofstest
Index: generic/tclStringObj.c
===================================================================
RCS file: /cvsroot/tcl/tcl/generic/tclStringObj.c,v
retrieving revision 1.70.2.17
diff -u -r1.70.2.17 tclStringObj.c
--- generic/tclStringObj.c	31 Jul 2009 16:56:32 -0000	1.70.2.17
+++ generic/tclStringObj.c	27 Aug 2009 19:17:56 -0000
@@ -2363,6 +2363,10 @@
 	    if (gotPrecision) {
 		*p++ = '.';
 		p += sprintf(p, "%d", precision);
+		if (precision > INT_MAX - length) {
+		    msg=overflow;
+		    goto errorMsg;
+		}
 		length += precision;
 	    }
 
@@ -2375,9 +2379,15 @@
 
 	    segment = Tcl_NewObj();
 	    allocSegment = 1;
-	    Tcl_SetObjLength(segment, length);
+	    if (!Tcl_AttemptSetObjLength(segment, length)) {
+		msg = overflow;
+		goto errorMsg;
+	    }
 	    bytes = TclGetString(segment);
-	    Tcl_SetObjLength(segment, sprintf(bytes, spec, d));
+	    if (!Tcl_AttemptSetObjLength(segment, sprintf(bytes, spec, d))) {
+		msg = overflow;
+		goto errorMsg;
+	    }
 	    break;
 	}
 	default:
