expr: Add better checks for invalid ternary expression

Reported-by: Ryan Whitworth <me@ryanwhitworth.com>
Signed-off-by: Steve Bennett <steveb@workware.net.au>

3 files changed, 19 insertions, 6 deletions

diff --git a/jim.c b/jim.c
index 99b8c16..6e34d48 100644
--- a/jim.c
+++ b/jim.c
@@ -8865,15 +8865,16 @@ static int ExprAddLazyOperator(Jim_Interp *interp, ExprByteCode * expr, ParseTok
 
     arity = 1;
     while (arity) {
+        if (leftindex < 0) {
+            return JIM_ERR;
+        }
         ScriptToken *tt = &expr->token[leftindex];
 
         if (tt->type >= JIM_TT_EXPR_OP) {
             arity += JimExprOperatorInfoByOpcode(tt->type)->arity;
         }
         arity--;
-        if (--leftindex < 0) {
-            return JIM_ERR;
-        }
+        leftindex--;
     }
     leftindex++;
 
@@ -9032,7 +9033,7 @@ static int ExprTernaryGetMoveIndices(ExprByteCode *expr, int right_index, int *p
 *
 * Note: care has to be taken for nested ternary constructs!!!
 */
-static void ExprTernaryReorderExpression(Jim_Interp *interp, ExprByteCode *expr)
+static int ExprTernaryReorderExpression(Jim_Interp *interp, ExprByteCode *expr)
 {
     int i;
 
@@ -9050,6 +9051,9 @@ static void ExprTernaryReorderExpression(Jim_Interp *interp, ExprByteCode *expr)
         if (ExprTernaryGetMoveIndices(expr, i, &prev_right_index, &prev_left_index) == 0) {
             continue;
         }
+        if (prev_left_index < 0) {
+            return -1;
+        }
 
         /*
         ** rotate tokens down
@@ -9084,6 +9088,7 @@ static void ExprTernaryReorderExpression(Jim_Interp *interp, ExprByteCode *expr)
         /* Adjust for i-- in the loop */
         i++;
     }
+    return 0;
 }
 
 static ExprByteCode *ExprCreateByteCode(Jim_Interp *interp, const ParseTokenList *tokenlist, Jim_Obj *exprObjPtr, Jim_Obj *fileNameObj)
@@ -9260,7 +9265,10 @@ static ExprByteCode *ExprCreateByteCode(Jim_Interp *interp, const ParseTokenList
     }
 
     if (have_ternary) {
-        ExprTernaryReorderExpression(interp, expr);
+        if (ExprTernaryReorderExpression(interp, expr) != 0) {
+            ok = 0;
+            Jim_SetResultString(interp, "Invalid ternary expression", -1);
+        }
     }
 
   err:
diff --git a/regtest.tcl b/regtest.tcl
index 682255b..5eada12 100644
--- a/regtest.tcl
+++ b/regtest.tcl
@@ -283,6 +283,11 @@ set b(-1) 5
 set a $b($(-1))
 puts "TEST 38 PASSED"
 
+# REGTEST 39
+# invalid ternary expr
+catch {set a $(5?6,7?8:?9:10%11:12)}
+puts "TEST 39 PASSED"
+
 # TAKE THE FOLLOWING puts AS LAST LINE
 
 puts "--- ALL TESTS PASSED ---"
diff --git a/tests/misc.test b/tests/misc.test
index 60dcf78..6eeb648 100644
--- a/tests/misc.test
+++ b/tests/misc.test
@@ -550,7 +550,7 @@ test lmap-1.1 {lmap} {
 test exprerr-1.1 {Error message with bad expr} {
 	catch {expr {5 ||}} msg
 	set msg
-} {Expression has bad operands to ||}
+} {syntax error in expression "5 ||": premature end of expression}
 
 test eval-list-1.1 {Lost string rep with list} {
 	set x {set y 1; incr y}