#3917 Bug in code of Tcl_GetAlias in tclInterp.c

obsolete: 8.5.0
closed-fixed
miguel sofer
9
2008-01-30
2008-01-30
an0
No

The last `for' loop in Tcl_GetAlias function:
for (i = 1; i < objc; i++) {
*argvPtr[i - 1] = TclGetString(objv[i]);
}

The bug spot is `*argvPtr[i - 1]'. Obviously, it should be `(*argvPtr)[i - 1]', otherwise, it causes invalid memory access when objc > 2, since it is only when idx is 0 that *argvPtr[idx] is the same as (*argvPtr)[idx] in effect.

Thus, the fixed code is:
for (i = 1; i < objc; i++) {
(*argvPtr)[i - 1] = TclGetString(objv[i]);
}

It is verified by our application product.

Discussion

    • priority: 5 --> 9
     
  • miguel sofer
    miguel sofer
    2008-01-30

    • assigned_to: hobbs --> msofer
    • status: open --> closed-fixed
     
  • miguel sofer
    miguel sofer
    2008-01-30

    Logged In: YES
    user_id=148712
    Originator: NO

    Fixed in HEAD and 8.4