diff options
| author | dkf <donal.k.fellows@manchester.ac.uk> | 2006-03-27 12:13:55 (GMT) |
|---|---|---|
| committer | dkf <donal.k.fellows@manchester.ac.uk> | 2006-03-27 12:13:55 (GMT) |
| commit | 48f8897514dfdffe09f50cd9e1bbdacb6434a40d (patch) | |
| tree | 352879db063311986533bfb6d6d50a3cde1fc25e | |
| parent | 3f5bb1cb572e896aec5df11c69c79803556190e1 (diff) | |
| download | tk-48f8897514dfdffe09f50cd9e1bbdacb6434a40d.zip tk-48f8897514dfdffe09f50cd9e1bbdacb6434a40d.tar.gz tk-48f8897514dfdffe09f50cd9e1bbdacb6434a40d.tar.bz2 | |
Fix (and add test for) [Bug 1458234]
| -rw-r--r-- | ChangeLog | 5 | ||||
| -rw-r--r-- | generic/tkImgGIF.c | 28 | ||||
| -rw-r--r-- | tests/imgPhoto.test | 15 |
3 files changed, 33 insertions, 15 deletions
@@ -1,3 +1,8 @@ +2006-03-27 Donal K. Fellows <donal.k.fellows@man.ac.uk> + + * generic/tkImgGIF.c (FileReadGIF): Stop crashes when the first GIF + frame does not define the overall size of the image. [Bug 1458234] + 2006-03-22 Don Porter <dgp@users.sourceforge.net> *** 8.4.13 TAGGED FOR RELEASE *** diff --git a/generic/tkImgGIF.c b/generic/tkImgGIF.c index 42a3132..d4e5d39 100644 --- a/generic/tkImgGIF.c +++ b/generic/tkImgGIF.c @@ -29,7 +29,7 @@ * | provided "as is" without express or implied warranty. | * +-------------------------------------------------------------------+ * - * RCS: @(#) $Id: tkImgGIF.c,v 1.24.2.3 2005/12/01 03:22:10 hobbs Exp $ + * RCS: @(#) $Id: tkImgGIF.c,v 1.24.2.4 2006/03/27 12:13:56 dkf Exp $ */ /* @@ -243,7 +243,7 @@ FileReadGIF(interp, chan, fileName, format, imageHandle, destX, destY, int srcX, srcY; /* Coordinates of top-left pixel to be used * in image being read. */ { - int fileWidth, fileHeight; + int fileWidth, fileHeight, imageWidth, imageHeight; int nBytes, index = 0, argc = 0, i; Tcl_Obj **objv; Tk_PhotoImageBlock block; @@ -376,8 +376,8 @@ FileReadGIF(interp, chan, fileName, format, imageHandle, destX, destY, goto error; } - fileWidth = LM_to_uint(buf[4],buf[5]); - fileHeight = LM_to_uint(buf[6],buf[7]); + imageWidth = LM_to_uint(buf[4],buf[5]); + imageHeight = LM_to_uint(buf[6],buf[7]); bitPixel = 1<<((buf[8]&0x07)+1); @@ -419,8 +419,8 @@ FileReadGIF(interp, chan, fileName, format, imageHandle, destX, destY, * of the less frequent case, I chose to maintain high * performance for the common case. */ - if (ReadImage(interp, (char *) trashBuffer, chan, fileWidth, - fileHeight, colorMap, 0, 0, 0, 0, 0, -1) != TCL_OK) { + if (ReadImage(interp, (char *) trashBuffer, chan, imageWidth, + imageHeight, colorMap, 0, 0, 0, 0, 0, -1) != TCL_OK) { goto error; } continue; @@ -441,8 +441,8 @@ FileReadGIF(interp, chan, fileName, format, imageHandle, destX, destY, srcX = 0; } - if (width > fileWidth) { - width = fileWidth; + if (width > imageWidth) { + width = imageWidth; } index = LM_to_uint(buf[2],buf[3]); @@ -451,8 +451,8 @@ FileReadGIF(interp, chan, fileName, format, imageHandle, destX, destY, destY -= srcY; height += srcY; srcY = 0; } - if (height > fileHeight) { - height = fileHeight; + if (height > imageHeight) { + height = imageHeight; } if ((width <= 0) || (height <= 0)) { @@ -464,12 +464,12 @@ FileReadGIF(interp, chan, fileName, format, imageHandle, destX, destY, block.height = height; block.pixelSize = (transparent>=0) ? 4 : 3; block.offset[3] = (transparent>=0) ? 3 : 0; - block.pitch = block.pixelSize * fileWidth; - nBytes = block.pitch * fileHeight; + block.pitch = block.pixelSize * imageWidth; + nBytes = block.pitch * imageHeight; block.pixelPtr = (unsigned char *) ckalloc((unsigned) nBytes); - if (ReadImage(interp, (char *) block.pixelPtr, chan, fileWidth, - fileHeight, colorMap, fileWidth, fileHeight, srcX, srcY, + if (ReadImage(interp, (char *) block.pixelPtr, chan, imageWidth, + imageHeight, colorMap, fileWidth, fileHeight, srcX, srcY, BitSet(buf[8], INTERLACE), transparent) != TCL_OK) { goto error; } diff --git a/tests/imgPhoto.test b/tests/imgPhoto.test index b568477..341e82a 100644 --- a/tests/imgPhoto.test +++ b/tests/imgPhoto.test @@ -9,7 +9,7 @@ # # Author: Paul Mackerras (paulus@cs.anu.edu.au) # -# RCS: @(#) $Id: imgPhoto.test,v 1.15.2.2 2004/02/17 20:40:41 dgp Exp $ +# RCS: @(#) $Id: imgPhoto.test,v 1.15.2.3 2006/03/27 12:13:56 dkf Exp $ package require tcltest 2.1 namespace import -force tcltest::configure @@ -653,6 +653,19 @@ hciva9/Ovbv37+BzBgEEADs= catch {file delete -force $filename} set result } 1 +test imgPhoto-14.2 {GIF -index handler buffer sizing} { + # Bug 1458234 makes this crash when trying to access buffers of the + # wrong size, caused when the initial frame is not the largest frame. + set data { + R0lGODlhIAAgAKEAAPkOSQsi7////////yH/C05FVFNDQVBFMi4wAwEAAAAh + +QQJMgAAACwGAAYAFAAUAAACEYyPqcvtD6OctNqLs968+68VACH5BAkyAAEA + LAMAAwAaABoAAAI0jH+gq+gfmFzQzUsr3gBybn1gIm5kaUaoubbuC8fyTNel + Ohv1CSO533u8KrgbUfc5Ci/EAgA7 + } + set i [image create photo] + $i configure -data $data -format {gif -index 2} + image delete $i +} {} test imgPhoto-15.1 {photo images can fail to allocate memory gracefully} \ {nonPortable} { |