summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorrmax <rmax>2008-02-01 16:59:57 (GMT)
committerrmax <rmax>2008-02-01 16:59:57 (GMT)
commit03def044c94d5a92a5120296510cd2bfa8c9e3fe (patch)
tree8d1b1136c1077fc11fc759459a79faa36a791377
parent76d7d5362c5289ee5bedbb7005c6ec11f89c21f4 (diff)
downloadtk-03def044c94d5a92a5120296510cd2bfa8c9e3fe.zip
tk-03def044c94d5a92a5120296510cd2bfa8c9e3fe.tar.gz
tk-03def044c94d5a92a5120296510cd2bfa8c9e3fe.tar.bz2
* generic/tkImgGIF.c: Fixed a buffer overflow (CVE-2006-4484).
* tests/imgPhoto.test: Added a test for the above.
-rw-r--r--ChangeLog5
-rw-r--r--generic/tkImgGIF.c8
-rw-r--r--tests/imgPhoto.test31
3 files changed, 42 insertions, 2 deletions
diff --git a/ChangeLog b/ChangeLog
index b05e26c..0f4b5b0 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2008-02-01 Reinhard Max <max@suse.de>
+
+ * generic/tkImgGIF.c: Fixed a buffer overflow (CVE-2006-4484).
+ * tests/imgPhoto.test: Added a test for the above.
+
2007-12-31 Don Porter <dgp@users.sourceforge.net>
*** 8.4.17 TAGGED FOR RELEASE ***
diff --git a/generic/tkImgGIF.c b/generic/tkImgGIF.c
index c8588bc..b095414 100644
--- a/generic/tkImgGIF.c
+++ b/generic/tkImgGIF.c
@@ -29,7 +29,7 @@
* | provided "as is" without express or implied warranty. |
* +-------------------------------------------------------------------+
*
- * RCS: @(#) $Id: tkImgGIF.c,v 1.24.2.5 2007/09/11 18:01:45 rmax Exp $
+ * RCS: @(#) $Id: tkImgGIF.c,v 1.24.2.6 2008/02/01 16:59:58 rmax Exp $
*/
/*
@@ -826,6 +826,12 @@ ReadImage(interp, imagePtr, chan, len, rows, cmap,
Tcl_PosixError(interp), (char *) NULL);
return TCL_ERROR;
}
+
+ if (initialCodeSize > MAX_LWZ_BITS) {
+ Tcl_SetResult(interp, "malformed image", TCL_STATIC);
+ return TCL_ERROR;
+ }
+
if (transparent != -1) {
cmap[transparent][CM_RED] = 0;
cmap[transparent][CM_GREEN] = 0;
diff --git a/tests/imgPhoto.test b/tests/imgPhoto.test
index 4118f74..244f0bb 100644
--- a/tests/imgPhoto.test
+++ b/tests/imgPhoto.test
@@ -9,7 +9,7 @@
#
# Author: Paul Mackerras (paulus@cs.anu.edu.au)
#
-# RCS: @(#) $Id: imgPhoto.test,v 1.15.2.5 2007/09/11 18:01:46 rmax Exp $
+# RCS: @(#) $Id: imgPhoto.test,v 1.15.2.6 2008/02/01 16:59:58 rmax Exp $
package require tcltest 2.1
namespace import -force tcltest::configure
@@ -681,6 +681,35 @@ test imgPhoto-14.3 {GIF -index interleaving and small frames} -setup {
image delete $i
}
+test imgPhoto-14.4 {GIF buffer overflow} -setup {
+ set i [image create photo]
+} -body {
+ # This crashes Tk up to 8.4.17 and 8.5.0
+ $i configure -data {
+ R0lGODlhCgAKAPcAAAAAAIAAAACAAICAAAAAgIAAgACAgICAgMDAwP8AAAD/
+ AP//AAAA//8A/wD//////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+ AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+ AAAAMwAAZgAAmQAAzAAA/wAzAAAzMwAzZgAzmQAzzAAz/wBmAABmMwBmZgBm
+ mQBmzABm/wCZAACZMwCZZgCZmQCZzACZ/wDMAADMMwDMZgDMmQDMzADM/wD/
+ AAD/MwD/ZgD/mQD/zAD//zMAADMAMzMAZjMAmTMAzDMA/zMzADMzMzMzZjMz
+ mTMzzDMz/zNmADNmMzNmZjNmmTNmzDNm/zOZADOZMzOZZjOZmTOZzDOZ/zPM
+ ADPMMzPMZjPMmTPMzDPM/zP/ADP/MzP/ZjP/mTP/zDP//2YAAGYAM2YAZmYA
+ mWYAzGYA/2YzAGYzM2YzZmYzmWYzzGYz/2ZmAGZmM2ZmZmZmmWZmzGZm/2aZ
+ AGaZM2aZZmaZmWaZzGaZ/2bMAGbMM2bMZmbMmWbMzGbM/2b/AGb/M2b/Zmb/
+ mWb/zGb//5kAAJkAM5kAZpkAmZkAzJkA/5kzAJkzM5kzZpkzmZkzzJkz/5lm
+ AJlmM5lmZplmmZlmzJlm/5mZAJmZM5mZZpmZmZmZzJmZ/5nMAJnMM5nMZpnM
+ mZnMzJnM/5n/AJn/M5n/Zpn/mZn/zJn//8wAAMwAM8wAZswAmcwAzMwA/8wz
+ AMwzM8wzZswzmcwzzMwz/8xmAMxmM8xmZsxmmcxmzMxm/8yZAMyZM8yZZsyZ
+ mcyZzMyZ/8zMAMzMM8zMZszMmczMzMzM/8z/AMz/M8z/Zsz/mcz/zMz///8A
+ AP8AM/8AZv8Amf8AzP8A//8zAP8zM/8zZv8zmf8zzP8z//9mAP9mM/9mZv9m
+ mf9mzP9m//+ZAP+ZM/+ZZv+Zmf+ZzP+Z///MAP/MM//MZv/Mmf/MzP/M////
+ AP//M///Zv//mf//zP///yH5BAEAABAALAAAAAAKAAoAABUSAAD/HEiwoMGD
+ CBMqXMiwYcKAADs=
+ }
+} -cleanup {
+ image delete $i
+} -returnCodes error -result {malformed image}
+
test imgPhoto-15.1 {photo images can fail to allocate memory gracefully} \
{nonPortable} {
# This is not portable to very large machines with more around