1 files changed, 27 insertions, 0 deletions
diff --git a/patchsets/patches-2.2.7-r4/006_tcltk1.patch b/patchsets/patches-2.2.7-r4/006_tcltk1.patch
new file mode 100644
index 0000000..a0e7444
--- /dev/null
+++ b/patchsets/patches-2.2.7-r4/006_tcltk1.patch
@@ -0,0 +1,27 @@
+From ebd0fc80d62eeb7b8556522256f8d035e013eb65 Mon Sep 17 00:00:00 2001
+From: nobu <nobu@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
+Date: Sun, 2 Aug 2015 01:27:31 +0000
+Subject: [PATCH] tcltklib.c: check argument
+
+* ext/tk/tcltklib.c (ip_cancel_eval_core): check argument type and
+  length.
+
+git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@51468 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
+---
+ ext/tk/tcltklib.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/ext/tk/tcltklib.c b/ext/tk/tcltklib.c
+index afcee3b..e305c13 100644
+--- a/ext/tk/tcltklib.c
++++ b/ext/tk/tcltklib.c
+@@ -7745,7 +7745,8 @@ ip_cancel_eval_core(interp, msg, flag)
+     if (NIL_P(msg)) {
+       msg_obj = NULL;
+     } else {
+-      msg_obj = Tcl_NewStringObj(RSTRING_PTR(msg), RSTRING_LEN(msg));
++      char *s = StringValuePtr(msg);
++      msg_obj = Tcl_NewStringObj(s, RSTRING_LENINT(msg));
+       Tcl_IncrRefCount(msg_obj);
+     }
+