Fix [d1434179b5]: avoid signed integer overflow in AppendUtfToUtfRep()

jan.nijtmans · jan.nijtmans · commit f3edde2f64fa · 2021-12-16T21:25:52.000Z
diff --git a/generic/tclStringObj.c b/generic/tclStringObj.c
@@ -1722,10 +1722,10 @@ AppendUtfToUtfRep(
 	objPtr->length = 0;
     }
     oldLength = objPtr->length;
-    newLength = numBytes + oldLength;
-    if (newLength < 0) {
+    if (numBytes > INT_MAX - oldLength) {
 	Tcl_Panic("max size for a Tcl value (%d bytes) exceeded", INT_MAX);
     }
+    newLength = numBytes + oldLength;
 
     stringPtr = GET_STRING(objPtr);
     if (newLength > stringPtr->allocated) {

Original file line number	Diff line number	Diff line change
`@@ -1722,10 +1722,10 @@ AppendUtfToUtfRep(`
`1722`	`1722`	`objPtr->length = 0;`
`1723`	`1723`	`}`
`1724`	`1724`	`oldLength = objPtr->length;`
`1725`		`- newLength = numBytes + oldLength;`
`1726`		`- if (newLength < 0) {`
	`1725`	`+ if (numBytes > INT_MAX - oldLength) {`
`1727`	`1726`	`Tcl_Panic("max size for a Tcl value (%d bytes) exceeded", INT_MAX);`
`1728`	`1727`	`}`
	`1728`	`+ newLength = numBytes + oldLength;`
`1729`	`1729`
`1730`	`1730`	`stringPtr = GET_STRING(objPtr);`
`1731`	`1731`	`if (newLength > stringPtr->allocated) {`