Menu

#1811 Buffer overrun in TclCompileTokens()

obsolete: 8.4a5
closed-fixed
5
2002-03-15
2002-03-15
Anonymous
No

Bug found in Tcl 8.4a4, but also in 8.3.

Reproductible script:

proc bug {} {
puts $array([expr {a+2}])
}

In generic/tclCompile.c, function TclCompileTokens(),
line 1242:

sprintf(buffer,
"\n (parsing index for array \"%.*s\")",
((nameBytes > 100)? 100 : nameBytes), name);

but buffer is large enough to contains TCL_UTF_MAX :(.

Discussion

  • Donal K. Fellows

    • milestone: --> obsolete: 8.4a5
    • assigned_to: msofer --> dkf
    • status: open --> closed-fixed
     
  • miguel sofer

    miguel sofer - 2002-03-15

    Logged In: YES
    user_id=148712

    Donal fixed it in 8.4; I just patched core-8-3-1-branch.