do not reference freed memory region. found by mallof.conf=AJ

1 files changed, 40 insertions, 0 deletions

diff --git a/chat/icb/patches/patch-at b/chat/icb/patches/patch-at
new file mode 100644
index 00000000000..8e2d0b608eb
--- /dev/null
+++ b/chat/icb/patches/patch-at
@@ -0,0 +1,40 @@
+$NetBSD: patch-at,v 1.1 2001/02/12 00:53:14 itojun Exp $
+
+--- tcl/tclProc.c-	Mon Feb 12 09:46:23 2001
++++ tcl/tclProc.c	Mon Feb 12 09:49:35 2001
+@@ -690,7 +690,7 @@
+     char **argv;		/* Argument values. */
+ {
+     char **args;
+-    register Var *formalPtr, *argPtr;
++    register Var *formalPtr, *argPtr, *nextPtr;
+     register Interp *iPtr = (Interp *) interp;
+     CallFrame frame;
+     char *value, *end;
+@@ -700,6 +700,7 @@
+      * Set up a call frame for the new procedure invocation.
+      */
+ 
++    memset(&frame, 0, sizeof(frame));
+     iPtr = procPtr->iPtr;
+     frame.varPtr = NULL;
+     if (iPtr->varFramePtr != NULL) {
+@@ -793,7 +794,8 @@
+      */
+ 
+     procDone:
+-    for (argPtr = frame.varPtr; argPtr != NULL; argPtr = argPtr->nextPtr) {
++    for (argPtr = frame.varPtr; argPtr != NULL; argPtr = nextPtr) {
++	nextPtr = argPtr->nextPtr;
+ 	if (argPtr->flags & VAR_DYNAMIC) {
+ 	    free(argPtr->value);
+ 	}
+@@ -919,7 +921,7 @@
+     if (valueLength < 20) {
+ 	valueLength = 20;
+     }
+-    varPtr = (Var *) malloc(VAR_SIZE(nameLength, valueLength));
++    varPtr = (Var *) calloc(1, VAR_SIZE(nameLength, valueLength));
+     strcpy(varPtr->name, name);
+     varPtr->value = varPtr->name + nameLength + 1;
+     strcpy(varPtr->value, value);