Bug 49406

Summary: tcl crashes because of object corrupted by call to "gets"
Product: [Retired] Red Hat Linux Reporter: Jonathan Kamens <jik>
Component: tcltkAssignee: Jens Petersen <petersen>
Status: CLOSED RAWHIDE QA Contact: David Lawrence <dkl>
Severity: medium Docs Contact:
Priority: medium    
Version: 7.1   
Target Milestone: ---   
Target Release: ---   
Hardware: i386   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2001-07-19 20:44:23 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
patch to fix tcl crash none

Description Jonathan Kamens 2001-07-19 06:23:08 UTC 
Please see
<URL:https://sourceforge.net/tracker/index.php?func=detail&aid=442665&group_id=10894&atid=110894>
-- I filed this bug with the TCL maintainers too.  Here's what I told them:

                   The function Tcl_GetsObjCmd in tclIOCmd.c can corrupt a 
                   freed object if it is called with objc == 3. This is 
                   because it retrieves resultPtr and does not increment 
                   its reference count, but then calls Tcl_ObjSetVar2, 
                   which causes the retrieved resultPtr object to be 
                   released. I will attach a patch, which I hope is 
                   correct (if not, please E-mail me and let me know why, 
                   so I can understand all of this better; I barely 
                   understand it).

I'll attach the same patch I sent to them.
Comment 1 Jonathan Kamens 2001-07-19 06:23:26 UTC 
Created attachment 24087 [details]
patch to fix tcl crash
Comment 2 Eido Inoue 2001-07-24 04:44:55 UTC 
I've looked at the patch and it indeed seems to fix and obvious logic problem.
I'll watch the comp.lang.tcl and sourceforge to see the progress of this patch.

I'm putting it in the next public beta because the fix seems to make sense.