Tcl Source Code

These were found by Claude doing mutation testing of the Tcl_ObjType v2 hooks. I tested each and got either seg faults or the wrong info as detailed below. The diagnosis is Claudes.

They use the test-only lstring type (tclTestABSList.c), so they need a tcltest shell built from the Tcl sources (make tcltest, then ./tcltest). Start a fresh shell for each snippet, because F1 to F3 crash the shell. No shipped type has a setElementProc, so F1 and F3 only affect extensions that supply that hook. F1 to F4 were each run on a tcltest 9.1.1 build and reproduce as described.

F1. lpop segfaults (tclCmdIL.c ~2670-2682).

set l [lstring abcd]; lpop l 1; set r [list $l]; set l 5; lappend r x; puts $r

Result: segfault. (On another build it printed {} x instead of the correct {a c d} x, so the symptom depends on memory reuse.) Cause (from reading the source, not confirmed in a debugger): the setElementProc branch calls TclUndoRefCount(listPtr) without a prior Tcl_IncrRefCount (tclObj.c: "The caller must have previously incremented the refCount"), so the reference count ends up one too low. lset (tclCmdIL.c ~4295) does increment.

F2. join of a one-element list segfaults (tclCmdIL.c ~2169-2196). For a type with getElementsProc but no indexProc (the manual requires only lengthProc):

join [lstring -not INDEX a] :

Result: segfault. The listLen > 1 test skips getElementsProc for length 1, and the single-element branch then calls TclObjTypeIndex, which has no proc.

F3. lset with a list of indices segfaults, compiled and uncompiled.

set l [lstring abc]; lset l {1 0} X

Result: segfault. Path: Tcl_LsetObjCmd -> TclLsetList -> TclLsetFlat -> Tcl_ListObjGetElements -> SetListFromAny -> Tcl_GetStringFromObj. lset l 1 0 X is refused politely; the one-argument index list is not. (Possibly related to ticket 1, as both go through TclLsetFlat.)

F4. lindex with a non-literal negative index (INST_LIST_INDEX, tclExecute.c ~5037-5047). The negative index is passed to the type's indexProc, unlike the literal-index instruction and Tcl_ListObjIndex. lstring's indexProc does not check it either and reads the byte before its buffer:

proc idx {l i} {lindex $l $i}
string length [idx [lstring abcde] -1]
binary encode hex [encoding convertto utf-8 [idx [lstring abcde] -1]]

Expected: 0 (empty string). Actual: 1, and the hex is 00, a NUL byte read from before the buffer. The value of that byte depends on memory contents.

A test file covering these (47 tests) is available on request.