summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authordkf <donal.k.fellows@manchester.ac.uk>2006-03-27 10:55:49 (GMT)
committerdkf <donal.k.fellows@manchester.ac.uk>2006-03-27 10:55:49 (GMT)
commit525f1a7466a169620c320643214fa1bc50809d30 (patch)
tree4d3ca2a0f7a67ad4a4dfd0ce531833fa5a90fe57
parent5f87593323244e86ce48d4aa8c21ad14f5d91db3 (diff)
downloadtk-525f1a7466a169620c320643214fa1bc50809d30.zip
tk-525f1a7466a169620c320643214fa1bc50809d30.tar.gz
tk-525f1a7466a169620c320643214fa1bc50809d30.tar.bz2
Fix (and add test for) [Bug 1458234]
-rw-r--r--ChangeLog21
-rw-r--r--generic/tkImgGIF.c26
-rw-r--r--tests/imgPhoto.test18
3 files changed, 41 insertions, 24 deletions
diff --git a/ChangeLog b/ChangeLog
index 76e0957..c88d7dd 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,11 +1,16 @@
+2006-03-27 Donal K. Fellows <dkf@users.sf.net>
+
+ * generic/tkImgGIF.c (FileReadGIF): Stop crashes when the first GIF
+ frame does not define the overall size of the image. [Bug 1458234]
+
2006-03-26 Vince Darley <vincentdarley@users.sourceforge.net>
* generic/tkText.c:
* generic/tkText.h:
* generic/tkTextBTree.c:
- * tests/text.test: Fix for [Bug 1414171] for '$text dump
- -command <script>' where 'script' actually modifies the
- widget during the process.
+ * tests/text.test: Fix for [Bug 1414171] for '$text dump -command
+ <script>' where 'script' actually modifies the widget during the
+ process.
2006-03-25 Daniel Steffen <das@users.sourceforge.net>
@@ -15,11 +20,11 @@
2006-03-24 Daniel Steffen <das@users.sourceforge.net>
- * generic/tkTextDisp.c: moved #ifdef MAC_OSX_TK code added by
- * macosx/tkMacOSXColor.c: Patch #638966 into platform specific
- * macosx/tkMacOSXInt.h: files.
+ * generic/tkTextDisp.c: Moved #ifdef MAC_OSX_TK code added by
+ * macosx/tkMacOSXColor.c: [Patch 638966] into platform specific files.
+ * macosx/tkMacOSXInt.h:
- * macosx/tkMacOSX.h: cleaned up & rationalized order of
+ * macosx/tkMacOSX.h: Cleaned up & rationalized order of
* macosx/tkMacOSXBitmap.c: #includes of tk and carbon headers.
* macosx/tkMacOSXButton.c:
* macosx/tkMacOSXCarbonEvents.c:
@@ -117,7 +122,7 @@
2006-03-17 Pat Thoyts <patthoyts@users.sourceforge.net>
- * library/clrpick.tcl: bug #1451587: avoid using abbreviated
+ * library/clrpick.tcl: [Bug 1451587] Avoid using abbreviated
* library/palette.tcl: sub-commands in core scripts as this
* library/scale.tcl: can cause problems with mega-widget
* library/scrlbar.tcl: libraries like snit.
diff --git a/generic/tkImgGIF.c b/generic/tkImgGIF.c
index 1e2bd64..70f77b0 100644
--- a/generic/tkImgGIF.c
+++ b/generic/tkImgGIF.c
@@ -32,7 +32,7 @@
* This file also contains code from miGIF. See lower down in file for the
* applicable copyright notice for that portion.
*
- * RCS: @(#) $Id: tkImgGIF.c,v 1.31 2005/12/01 03:21:37 hobbs Exp $
+ * RCS: @(#) $Id: tkImgGIF.c,v 1.32 2006/03/27 10:55:49 dkf Exp $
*/
/*
@@ -252,7 +252,7 @@ FileReadGIF(
int srcX, int srcY) /* Coordinates of top-left pixel to be used in
* image being read. */
{
- int fileWidth, fileHeight;
+ int fileWidth, fileHeight, imageWidth, imageHeight;
int nBytes, index = 0, argc = 0, i;
Tcl_Obj **objv;
Tk_PhotoImageBlock block;
@@ -399,8 +399,8 @@ FileReadGIF(
goto error;
}
- fileWidth = LM_to_uint(buf[4], buf[5]);
- fileHeight = LM_to_uint(buf[6], buf[7]);
+ imageWidth = LM_to_uint(buf[4], buf[5]);
+ imageHeight = LM_to_uint(buf[6], buf[7]);
bitPixel = 1<<((buf[8]&0x07)+1);
@@ -443,7 +443,7 @@ FileReadGIF(
*/
if (ReadImage(gifConfPtr, interp, (char *)trashBuffer, chan,
- fileWidth, fileHeight, colorMap, 0, 0, 0, 0, 0,
+ imageWidth, imageHeight, colorMap, 0, 0, 0, 0, 0,
-1) != TCL_OK) {
goto error;
}
@@ -464,8 +464,8 @@ FileReadGIF(
srcX = 0;
}
- if (width > fileWidth) {
- width = fileWidth;
+ if (width > imageWidth) {
+ width = imageWidth;
}
index = LM_to_uint(buf[2], buf[3]);
@@ -474,8 +474,8 @@ FileReadGIF(
destY -= srcY; height += srcY;
srcY = 0;
}
- if (height > fileHeight) {
- height = fileHeight;
+ if (height > imageHeight) {
+ height = imageHeight;
}
if ((width <= 0) || (height <= 0)) {
@@ -487,13 +487,13 @@ FileReadGIF(
block.height = height;
block.pixelSize = (transparent>=0) ? 4 : 3;
block.offset[3] = (transparent>=0) ? 3 : 0;
- block.pitch = block.pixelSize * fileWidth;
- nBytes = block.pitch * fileHeight;
+ block.pitch = block.pixelSize * imageWidth;
+ nBytes = block.pitch * imageHeight;
block.pixelPtr = (unsigned char *) ckalloc((unsigned) nBytes);
if (ReadImage(gifConfPtr, interp, (char *) block.pixelPtr, chan,
- fileWidth, fileHeight, colorMap, fileWidth, fileHeight, srcX,
- srcY, BitSet(buf[8], INTERLACE), transparent) != TCL_OK) {
+ imageWidth,imageHeight, colorMap, fileWidth,fileHeight,
+ srcX,srcY, BitSet(buf[8],INTERLACE), transparent) != TCL_OK) {
goto error;
}
break;
diff --git a/tests/imgPhoto.test b/tests/imgPhoto.test
index 1c371bc..31fd8cc 100644
--- a/tests/imgPhoto.test
+++ b/tests/imgPhoto.test
@@ -9,7 +9,7 @@
#
# Author: Paul Mackerras (paulus@cs.anu.edu.au)
#
-# RCS: @(#) $Id: imgPhoto.test,v 1.22 2005/10/12 09:29:21 dkf Exp $
+# RCS: @(#) $Id: imgPhoto.test,v 1.23 2006/03/27 10:55:49 dkf Exp $
package require tcltest 2.1
eval tcltest::configure $argv
@@ -558,7 +558,7 @@ test imgPhoto-12.1 {Tk_PhotoPutZoomedBlock} hasTeapotPhoto {
} {{19 92 192} {169 117 90} 512 512 {19 92 192}}
test imgPhoto-13.1 {check separation of images in different interpreters} {
- eval image delete [image names]
+ image delete {expand}[image names]
set data {
R0lGODlhQgBkAPUAANbWxs7Wxs7OxsbOxsbGxsbGvb3Gvca9vcDAwL21vbW1vbW1tbWtta2t
ta2ltaWltaWlraWctaWcrZycrZyUrZSUrZSMrZSMpYyMrYyMpYyEpYSEpYR7pYR7nHp7pYRz
@@ -601,7 +601,6 @@ test imgPhoto-13.1 {check separation of images in different interpreters} {
interp delete x2
} {}
-
test imgPhoto-14.1 {GIF writes work correctly} {
set data "R0lGODlhYwA5APcAAAAAAIAAAACAAICAAAAAgIAAgACAgICAgAysnGy8hKzM
hASs3MTcjAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
@@ -638,6 +637,19 @@ hciva9/Ovbv37+BzBgEEADs=
catch {file delete -force $filename}
set result
} 1
+test imgPhoto-14.2 {GIF -index handler buffer sizing} {
+ # Bug 1458234 makes this crash when trying to access buffers of the
+ # wrong size, caused when the initial frame is not the largest frame.
+ set data {
+ R0lGODlhIAAgAKEAAPkOSQsi7////////yH/C05FVFNDQVBFMi4wAwEAAAAh
+ +QQJMgAAACwGAAYAFAAUAAACEYyPqcvtD6OctNqLs968+68VACH5BAkyAAEA
+ LAMAAwAaABoAAAI0jH+gq+gfmFzQzUsr3gBybn1gIm5kaUaoubbuC8fyTNel
+ Ohv1CSO533u8KrgbUfc5Ci/EAgA7
+ }
+ set i [image create photo]
+ $i configure -data $data -format {gif -index 2}
+ image delete $i
+} {}
test imgPhoto-15.1 {photo images can fail to allocate memory gracefully} \
{nonPortable} {