expr: fix crash on invalid ternary order

expr {1 : 2 ? 3}

Reported-by: Ryan Whitworth <me@ryanwhitworth.com>
Signed-off-by: Steve Bennett <steveb@workware.net.au>

1 files changed, 5 insertions, 1 deletions

diff --git a/jim.c b/jim.c
index 74c16d3..71c5d55 100644
--- a/jim.c
+++ b/jim.c
@@ -8791,7 +8791,11 @@ static int ExprCheckCorrectness(Jim_Interp *interp, Jim_Obj *exprObjPtr, ExprByt
             ternary++;
         }
         else if (t->type == JIM_EXPROP_COLON || t->type == JIM_EXPROP_COLON_LEFT) {
-            ternary--;
+            if (--ternary < 0) {
+                /* got : without preceding ? */
+                stacklen = 1;
+                break;
+            }
         }
 
         /* All operations and operands add one to the stack */