From cc83b696b6b5e4cef4e312782a3fff23d5cdb8ad Mon Sep 17 00:00:00 2001
From: Steve Bennett <steveb@workware.net.au>
Date: Fri, 7 Apr 2017 09:16:35 +1000
Subject: [PATCH] expr: fix crash on invalid ternary order

expr {1 : 2 ? 3}

Reported-by: Ryan Whitworth <me@ryanwhitworth.com>
Signed-off-by: Steve Bennett <steveb@workware.net.au>
---
 jim.c       | 6 +++++-
 regtest.tcl | 5 +++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/jim.c b/jim.c
index 74c16d3..71c5d55 100644
--- a/jim.c
+++ b/jim.c
@@ -8791,7 +8791,11 @@ static int ExprCheckCorrectness(Jim_Interp *interp, Jim_Obj *exprObjPtr, ExprByt
             ternary++;
         }
         else if (t->type == JIM_EXPROP_COLON || t->type == JIM_EXPROP_COLON_LEFT) {
-            ternary--;
+            if (--ternary < 0) {
+                /* got : without preceding ? */
+                stacklen = 1;
+                break;
+            }
         }
 
         /* All operations and operands add one to the stack */
diff --git a/regtest.tcl b/regtest.tcl
index d84e72c..8bc6962 100644
--- a/regtest.tcl
+++ b/regtest.tcl
@@ -272,6 +272,11 @@ puts "TEST 35 PASSED"
 catch {/ 1 0}
 puts "TEST 36 PASSED"
 
+# REGTEST 37
+# ternary operator order
+catch {expr {1 : 2 ? 3}}
+puts "TEST 37 PASSED"
+
 # TAKE THE FOLLOWING puts AS LAST LINE
 
 puts "--- ALL TESTS PASSED ---"
-- 
2.11.4.GIT