summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authordkf <donal.k.fellows@manchester.ac.uk>2003-07-17 13:05:52 (GMT)
committerdkf <donal.k.fellows@manchester.ac.uk>2003-07-17 13:05:52 (GMT)
commit6975412d3b85ae353784b46da6204b629cd07b5d (patch)
tree2e38c633789410e66c89640b37acfb91d07221aa
parente4f1f83a7bade235b9bf9b51ef349ce33ccf2b5c (diff)
downloadtk-6975412d3b85ae353784b46da6204b629cd07b5d.zip
tk-6975412d3b85ae353784b46da6204b629cd07b5d.tar.gz
tk-6975412d3b85ae353784b46da6204b629cd07b5d.tar.bz2
Try harder to avoid zero-length mallocs()... [Bug 404421]
-rw-r--r--ChangeLog2
-rw-r--r--generic/tkImgPhoto.c63
2 files changed, 40 insertions, 25 deletions
diff --git a/ChangeLog b/ChangeLog
index 4baff2a..2d31bc2 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -4,6 +4,8 @@
to never jump to the end of the switch. I find that confusing as
I can't see whether there's processing still to be done from a
quick glance at the code, unlike with a direct return. [Bug 771988]
+ (ImgPhotoCmd, ImgPhotoSetSize, ImgPhotoInstanceSetSize): Try harder
+ to avoid zero-length mallocs()... [Bug 404421]
2003-07-16 Don Porter <dgp@users.sourceforge.net>
diff --git a/generic/tkImgPhoto.c b/generic/tkImgPhoto.c
index 4153648..b0ea9d8 100644
--- a/generic/tkImgPhoto.c
+++ b/generic/tkImgPhoto.c
@@ -16,7 +16,7 @@
* Department of Computer Science,
* Australian National University.
*
- * RCS: @(#) $Id: tkImgPhoto.c,v 1.36.2.1 2003/07/17 09:58:14 dkf Exp $
+ * RCS: @(#) $Id: tkImgPhoto.c,v 1.36.2.2 2003/07/17 13:05:53 dkf Exp $
*/
#include "tkInt.h"
@@ -1067,6 +1067,12 @@ ImgPhotoCmd(clientData, interp, objc, objv)
break;
}
if (y == 0) {
+ if (listArgc == 0) {
+ /*
+ * Lines must be non-empty...
+ */
+ break;
+ }
dataWidth = listArgc;
pixelPtr = (unsigned char *)
ckalloc((unsigned) dataWidth * dataHeight * 3);
@@ -2663,13 +2669,16 @@ ImgPhotoSetSize(masterPtr, width, height)
*/
unsigned /*long*/ newPixSize = (unsigned /*long*/) (height * pitch);
- newPix32 = (unsigned char *) attemptckalloc(newPixSize);
/*
- * The result could validly be NULL if the number of bytes
- * requested was 0. [Bug 619544]
+ * Some mallocs() really hate allocating zero bytes. [Bug 619544]
*/
- if (newPix32 == NULL && newPixSize != 0) {
- return TCL_ERROR;
+ if (newPixSize == 0) {
+ newPix32 = NULL;
+ } else {
+ newPix32 = (unsigned char *) attemptckalloc(newPixSize);
+ if (newPix32 == NULL) {
+ return TCL_ERROR;
+ }
}
}
@@ -2867,30 +2876,34 @@ ImgPhotoInstanceSetSize(instancePtr)
|| (instancePtr->height != masterPtr->height)
|| (instancePtr->error == NULL)) {
- newError = (schar *) ckalloc((unsigned)
- (masterPtr->height * masterPtr->width * 3 * sizeof(schar)));
+ if (masterPtr->height > 0 && masterPtr->width > 0) {
+ newError = (schar *) ckalloc((unsigned)
+ masterPtr->height * masterPtr->width * 3 * sizeof(schar));
- /*
- * Zero the new array so that we don't get bogus error values
- * propagating into areas we dither later.
- */
+ /*
+ * Zero the new array so that we don't get bogus error
+ * values propagating into areas we dither later.
+ */
- if ((instancePtr->error != NULL)
- && ((instancePtr->width == masterPtr->width)
- || (validBox.width == masterPtr->width))) {
- if (validBox.y > 0) {
+ if ((instancePtr->error != NULL)
+ && ((instancePtr->width == masterPtr->width)
+ || (validBox.width == masterPtr->width))) {
+ if (validBox.y > 0) {
+ memset((VOID *) newError, 0, (size_t)
+ validBox.y * masterPtr->width * 3 * sizeof(schar));
+ }
+ h = validBox.y + validBox.height;
+ if (h < masterPtr->height) {
+ memset((VOID *) (newError + h * masterPtr->width * 3), 0,
+ (size_t) (masterPtr->height - h)
+ * masterPtr->width * 3 * sizeof(schar));
+ }
+ } else {
memset((VOID *) newError, 0, (size_t)
- (validBox.y * masterPtr->width * 3 * sizeof(schar)));
- }
- h = validBox.y + validBox.height;
- if (h < masterPtr->height) {
- memset((VOID *) (newError + h * masterPtr->width * 3), 0,
- (size_t) ((masterPtr->height - h)
- * masterPtr->width * 3 * sizeof(schar)));
+ masterPtr->height * masterPtr->width * 3 * sizeof(schar));
}
} else {
- memset((VOID *) newError, 0, (size_t)
- (masterPtr->height * masterPtr->width * 3 * sizeof(schar)));
+ newError = NULL;
}
if (instancePtr->error != NULL) {