Fix null pointer dereference

If the condition expression of a for statement is invalid

2 files changed, 11 insertions, 1 deletions

diff --git a/jim.c b/jim.c
index 602f071..adad387 100644
--- a/jim.c
+++ b/jim.c
@@ -10062,7 +10062,7 @@ static int Jim_ForCoreCommand(Jim_Interp *interp, int argc,
         /* Ensure proper lengths to start */
         if (initScript->len != 6) goto evalstart;
         if (incrScript->len != 4) goto evalstart;
-        if (expr->len != 3) goto evalstart;
+        if (!expr || expr->len != 3) goto evalstart;
         /* Ensure proper token types. */
         if (initScript->token[2].type != JIM_TT_ESC ||
             initScript->token[4].type != JIM_TT_ESC ||
diff --git a/tests/misc.test b/tests/misc.test
index 3fffbf3..804e456 100644
--- a/tests/misc.test
+++ b/tests/misc.test
@@ -19,6 +19,16 @@ test regr-1.2 "Reference count shared literals" {
 	return 1
 } {1}
 
+test regr-1.3 "Invalid for expression" {
+	# Crashes with invalid expression
+	catch {
+		for {set i 0} {$i < n} {incr i} {
+			set a(b) $i
+			set a(c) $i
+		}
+	}
+} 1
+
 section "I/O Testing"
 
 test io-1.1 "Read last line with no newline" {