Try harder to avoid zero-length malloc()s... [Bug 404421]

2 files changed, 40 insertions, 25 deletions

diff --git a/ChangeLog b/ChangeLog
index 507fd54..3400674 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -4,6 +4,8 @@
 	to never jump to the end of the switch.  I find that confusing as
 	I can't see whether there's processing still to be done from a
 	quick glance at the code, unlike with a direct return. [Bug 771988]
+	(ImgPhotoCmd, ImgPhotoSetSize, ImgPhotoInstanceSetSize): Try harder
+	to avoid zero-length mallocs()... [Bug 404421]
 
 2003-07-16  Don Porter  <dgp@users.sourceforge.net>
 
diff --git a/generic/tkImgPhoto.c b/generic/tkImgPhoto.c
index 02ab477..b39893f 100644
--- a/generic/tkImgPhoto.c
+++ b/generic/tkImgPhoto.c
@@ -16,7 +16,7 @@
  *	   Department of Computer Science,
  *	   Australian National University.
  *
- * RCS: @(#) $Id: tkImgPhoto.c,v 1.38 2003/07/17 10:11:03 dkf Exp $
+ * RCS: @(#) $Id: tkImgPhoto.c,v 1.39 2003/07/17 12:59:52 dkf Exp $
  */
 
 #include "tkInt.h"
@@ -1066,6 +1066,12 @@ ImgPhotoCmd(clientData, interp, objc, objv)
 		break;
 	    }
 	    if (y == 0) {
+		if (listArgc == 0) {
+		    /*
+		     * Lines must be non-empty...
+		     */
+		    break;
+		}
 		dataWidth = listArgc;
 		pixelPtr = (unsigned char *)
 			ckalloc((unsigned) dataWidth * dataHeight * 3);
@@ -2663,13 +2669,16 @@ ImgPhotoSetSize(masterPtr, width, height)
 	 */
 	unsigned /*long*/ newPixSize = (unsigned /*long*/) (height * pitch);
 
-	newPix32 = (unsigned char *) attemptckalloc(newPixSize);
 	/*
-	 * The result could validly be NULL if the number of bytes
-	 * requested was 0. [Bug 619544]
+	 * Some mallocs() really hate allocating zero bytes. [Bug 619544]
 	 */
-	if (newPix32 == NULL && newPixSize != 0) {
-	    return TCL_ERROR;
+	if (newPixSize == 0) {
+	    newPix32 = NULL;
+	} else {
+	    newPix32 = (unsigned char *) attemptckalloc(newPixSize);
+	    if (newPix32 == NULL) {
+		return TCL_ERROR;
+	    }
 	}
     }
 
@@ -2867,30 +2876,34 @@ ImgPhotoInstanceSetSize(instancePtr)
 	    || (instancePtr->height != masterPtr->height)
 	    || (instancePtr->error == NULL)) {
 
-	newError = (schar *) ckalloc((unsigned)
-		(masterPtr->height * masterPtr->width * 3 * sizeof(schar)));
+	if (masterPtr->height > 0 && masterPtr->width > 0) {
+	    newError = (schar *) ckalloc((unsigned)
+		    masterPtr->height * masterPtr->width * 3 * sizeof(schar));
 
-	/*
-	 * Zero the new array so that we don't get bogus error values
-	 * propagating into areas we dither later.
-	 */
+	    /*
+	     * Zero the new array so that we don't get bogus error
+	     * values propagating into areas we dither later.
+	     */
 
-	if ((instancePtr->error != NULL)
-	    && ((instancePtr->width == masterPtr->width)
-		|| (validBox.width == masterPtr->width))) {
-	    if (validBox.y > 0) {
+	    if ((instancePtr->error != NULL)
+		    && ((instancePtr->width == masterPtr->width)
+		    || (validBox.width == masterPtr->width))) {
+		if (validBox.y > 0) {
+		    memset((VOID *) newError, 0, (size_t)
+			    validBox.y * masterPtr->width * 3 * sizeof(schar));
+		}
+		h = validBox.y + validBox.height;
+		if (h < masterPtr->height) {
+		    memset((VOID *) (newError + h * masterPtr->width * 3), 0,
+			    (size_t) (masterPtr->height - h)
+			    * masterPtr->width * 3 * sizeof(schar));
+		}
+	    } else {
 		memset((VOID *) newError, 0, (size_t)
-			(validBox.y * masterPtr->width * 3 * sizeof(schar)));
-	    }
-	    h = validBox.y + validBox.height;
-	    if (h < masterPtr->height) {
-		memset((VOID *) (newError + h * masterPtr->width * 3), 0,
-			(size_t) ((masterPtr->height - h)
-			    * masterPtr->width * 3 * sizeof(schar)));
+			masterPtr->height * masterPtr->width * 3 * sizeof(schar));
 	    }
 	} else {
-	    memset((VOID *) newError, 0, (size_t)
-		    (masterPtr->height * masterPtr->width * 3 * sizeof(schar)));
+	    newError = NULL;
 	}
 
 	if (instancePtr->error != NULL) {