diff options
| author | Kevin B Kenny <kennykb@acm.org> | 2007-11-26 20:53:57 (GMT) |
|---|---|---|
| committer | Kevin B Kenny <kennykb@acm.org> | 2007-11-26 20:53:57 (GMT) |
| commit | 04d59cbc4af657da97a836a24ed6f952bb1a3633 (patch) | |
| tree | 1f3a435ace170a7ccfe7ee18e33f9f2fab8f2dc3 /generic/tkImgPPM.c | |
| parent | 86cb489f9d555eb126bc7af0aed33123a9c1742c (diff) | |
| download | tk-04d59cbc4af657da97a836a24ed6f952bb1a3633.zip tk-04d59cbc4af657da97a836a24ed6f952bb1a3633.tar.gz tk-04d59cbc4af657da97a836a24ed6f952bb1a3633.tar.bz2 | |
Backport from HEAD of [Bug #1822391]:
* generic/tkImgPPM.c (StringReadPPM): Corrected a comparison
whose sense was reversed that resulted in reading beyond the
end of the input buffer on malformed PPM data. [Bug #1822391]
* tests/imgPPM.test (imgPPM-4.1): Added test case that
exercises [Bug #1822391].
Diffstat (limited to 'generic/tkImgPPM.c')
| -rw-r--r-- | generic/tkImgPPM.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/generic/tkImgPPM.c b/generic/tkImgPPM.c index 3469fcc..ad07913 100644 --- a/generic/tkImgPPM.c +++ b/generic/tkImgPPM.c @@ -13,7 +13,7 @@ * Department of Computer Science, * Australian National University. * - * RCS: @(#) $Id: tkImgPPM.c,v 1.10.2.2 2004/03/27 00:40:39 dkf Exp $ + * RCS: @(#) $Id: tkImgPPM.c,v 1.10.2.3 2007/11/26 20:53:57 kennykb Exp $ */ #include "tkInt.h" @@ -540,7 +540,7 @@ StringReadPPM(interp, dataObj, format, imageHandle, destX, destY, * We have all the data in memory, so write everything in one * go. */ - if (block.pitch*height < dataSize) { + if (block.pitch*height > dataSize) { Tcl_AppendResult(interp, "truncated PPM data", NULL); return TCL_ERROR; } |