Fix [5239fd749b]: Segfault when copying a photo image to itself. Patch from Simon Bachmann.

2 files changed, 32 insertions, 14 deletions

diff --git a/generic/tkImgPhoto.c b/generic/tkImgPhoto.c
index 1fec208..cb46c41 100644
--- a/generic/tkImgPhoto.c
+++ b/generic/tkImgPhoto.c
@@ -625,7 +625,24 @@ ImgPhotoCmd(
 	}
 
 	/*
+	 * Copy the image data over using Tk_PhotoPutZoomedBlock.
+	 */
+
+	block.pixelPtr += options.fromX * block.pixelSize
+		+ options.fromY * block.pitch;
+	block.width = options.fromX2 - options.fromX;
+	block.height = options.fromY2 - options.fromY;
+	result = Tk_PhotoPutZoomedBlock(interp, (Tk_PhotoHandle) masterPtr,
+		&block, options.toX, options.toY, options.toX2 - options.toX,
+		options.toY2 - options.toY, options.zoomX, options.zoomY,
+		options.subsampleX, options.subsampleY,
+		options.compositingRule);
+	
+	/*
 	 * Set the destination image size if the -shrink option was specified.
+	 * This has to be done _after_ copying the data. Otherwise, if source 
+	 * and destination are the same image, block.pixelPtr would point to
+	 * an invalid memory block (bug [5239fd749b]).
 	 */
 
 	if (options.options & OPT_SHRINK) {
@@ -637,20 +654,9 @@ ImgPhotoCmd(
 		return TCL_ERROR;
 	    }
 	}
-
-	/*
-	 * Copy the image data over using Tk_PhotoPutZoomedBlock.
-	 */
-
-	block.pixelPtr += options.fromX * block.pixelSize
-		+ options.fromY * block.pitch;
-	block.width = options.fromX2 - options.fromX;
-	block.height = options.fromY2 - options.fromY;
-	return Tk_PhotoPutZoomedBlock(interp, (Tk_PhotoHandle) masterPtr,
-		&block, options.toX, options.toY, options.toX2 - options.toX,
-		options.toY2 - options.toY, options.zoomX, options.zoomY,
-		options.subsampleX, options.subsampleY,
-		options.compositingRule);
+	Tk_ImageChanged(masterPtr->tkMaster, 0, 0, 0, 0,
+		masterPtr->width, masterPtr->height);
+	return result;
 
     case PHOTO_DATA: {
 	char *data;
diff --git a/tests/imgPhoto.test b/tests/imgPhoto.test
index 4bff5cc..0126ad9 100644
--- a/tests/imgPhoto.test
+++ b/tests/imgPhoto.test
@@ -820,6 +820,18 @@ test imgPhoto-4.75 {<photo> read command: filename starting with '-'} -constrain
     image delete photo1
     file delete ./-teapotPhotoFile
 } -result {}
+test imgPhoto-4.76 {ImgPhotoCmd procedure: copy to same image} -constraints {
+    hasTeapotPhoto 
+} -setup {
+    imageCleanup
+    image create photo photo1 -file $teapotPhotoFile
+} -body {
+    # non-regression test for bug [5239fd749b] - shall just not crash
+    photo1 copy photo1 -to 0 0 2000 1000
+    photo1 copy photo1 -subsample 2 2 -shrink
+} -cleanup {
+    imageCleanup
+} -result {}
 
 test imgPhoto-5.1 {ImgPhotoGet/Free procedures, shared instances} -constraints {
     hasTeapotPhoto