#2144 Tcl/Tk crashes while using logic canvas-tag expressions

[Ayd]

Hello,

if I run the following script Tcl/Tk crashes.

-------------------------------------------------------
-

proc objbbox { canvas tag } {

#
# following line leads to the crash
#
switch -- [$canvas type ($tag)&&!@text&&!
@stemline&&!@gridrow&&!@gridcolumn] {

rectangle{
# ...do something...
}

default {
# ...do something else...
}
}/* end of switch */
}/* end of proc */

canvas .canv
pack .canv
.canv create rectangle 1 1 100 100 -tags myRect
objbbox .canv myRect

-------------------------------------------------------
-

Simple logic expressions like

.canvas type tag1&&tag2&&tag3&&....and so on

never crash but if I use a logic expression that
includes brackets as follows

.canvas type ($tag)&&tag2&&tag3&&tag4&&tag5

a memory overrun occurs and causes Tcl/Tk to crash.

The reason is a wrong if-statement embedded in a while-
loop inside the function "TagSearchScanExpr.
The function is part of "./tk8.4.14/generic/tkCanvas.c"

A possible fix is:

static int
TagSearchScanExpr(interp, searchPtr, expr)
Tcl_Interp *interp; /* Current interpreter. */
TagSearch *searchPtr; /* Search data */
TagSearchExpr *expr; /* compiled expression result */
{
...
if (expr->allocated == expr->index) {
...
}

should be changed into

static int
TagSearchScanExpr(interp, searchPtr, expr)
Tcl_Interp *interp; /* Current interpreter. */
TagSearch *searchPtr; /* Search data */
TagSearchExpr *expr; /* compiled expression result */
{
...
// e.g
if (expr->allocated <= expr->index+1) {
...
}

I hope this helps.

Regards, Ayd