From f60e1647996f8494c8eb64899086f74a43dc0120 Mon Sep 17 00:00:00 2001
From: "jan.nijtmans" <nijtmans@users.sourceforge.net>
Date: Sat, 18 Dec 2021 18:55:50 +0000
Subject: [PATCH] Make it impossible for the indexType object to cache negative
 index values. And - if it happens - at least don't crash on it.

---
 generic/tclIndexObj.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/generic/tclIndexObj.c b/generic/tclIndexObj.c
index efa737330bf6..8911f0093015 100644
--- a/generic/tclIndexObj.c
+++ b/generic/tclIndexObj.c
@@ -73,7 +73,7 @@ typedef struct {
 #define NEXT_ENTRY(table, offset) \
 	(&(STRING_AT(table, offset)))
 #define EXPAND_OF(indexRep) \
-	STRING_AT((indexRep)->tablePtr, (indexRep)->offset*(indexRep)->index)
+	(((indexRep)->index >= 0) ? STRING_AT((indexRep)->tablePtr, (indexRep)->offset*(indexRep)->index) : "")
 
 /*
  *----------------------------------------------------------------------
@@ -280,7 +280,9 @@ Tcl_GetIndexFromObjStruct(
 
     if (objPtr && (objPtr->typePtr == &indexType)) {
 	indexRep = objPtr->internalRep.twoPtrValue.ptr1;
-	if (indexRep->tablePtr==tablePtr && indexRep->offset==offset) {
+	if ((indexRep->tablePtr == tablePtr)
+		&& (indexRep->offset == offset)
+		&& (indexRep->index >= 0)) {
 	    *indexPtr = indexRep->index;
 	    return TCL_OK;
 	}
@@ -339,7 +341,7 @@ Tcl_GetIndexFromObjStruct(
      * operation.
      */
 
-    if (objPtr) {
+    if (objPtr && (index >= 0)) {
 	if (objPtr->typePtr == &indexType) {
 	    indexRep = objPtr->internalRep.twoPtrValue.ptr1;
 	} else {