diff options
| author | fvogel <fvogelnew1@free.fr> | 2020-06-27 09:21:10 (GMT) |
|---|---|---|
| committer | fvogel <fvogelnew1@free.fr> | 2020-06-27 09:21:10 (GMT) |
| commit | 02e4268c7f9c10b52f306dc56769f91dafd357a1 (patch) | |
| tree | e7db0029ca3f63ccafcbf5bcb4fd7b57c2403468 /generic/tkImgPhoto.c | |
| parent | 203ff9552023cd7b65630bf0a26a3a15a3c4f69b (diff) | |
| parent | 6032a8780a04056c38959835e506213718674a37 (diff) | |
| download | tk-02e4268c7f9c10b52f306dc56769f91dafd357a1.zip tk-02e4268c7f9c10b52f306dc56769f91dafd357a1.tar.gz tk-02e4268c7f9c10b52f306dc56769f91dafd357a1.tar.bz2 | |
Fix [5c51be6411]: Buffer over-read in Tk_PhotoPutBlock() and Tk_PhotoPutZoomedBlock(). Patch from Christopher Chavez.
Diffstat (limited to 'generic/tkImgPhoto.c')
| -rw-r--r-- | generic/tkImgPhoto.c | 40 |
1 files changed, 32 insertions, 8 deletions
diff --git a/generic/tkImgPhoto.c b/generic/tkImgPhoto.c index ab962c1..26b0446 100644 --- a/generic/tkImgPhoto.c +++ b/generic/tkImgPhoto.c @@ -2772,8 +2772,21 @@ Tk_PhotoPutBlock( if (sourceBlock.pixelPtr >= masterPtr->pix32 && sourceBlock.pixelPtr <= masterPtr->pix32 + masterPtr->width * masterPtr->height * 4) { - sourceBlock.pixelPtr = attemptckalloc(sourceBlock.height - * sourceBlock.pitch); + /* + * Fix 5c51be6411: avoid reading + * + * (sourceBlock.pitch - sourceBlock.width * sourceBlock.pixelSize) + * + * bytes past the end of masterPtr->pix32[] when + * + * blockPtr->pixelPtr > (masterPtr->pix32 + + * 4 * masterPtr->width * masterPtr->height - + * sourceBlock.height * sourceBlock.pitch) + */ + unsigned int cpyLen = (sourceBlock.height - 1) * sourceBlock.pitch + + sourceBlock.width * sourceBlock.pixelSize; + + sourceBlock.pixelPtr = attemptckalloc(cpyLen); if (sourceBlock.pixelPtr == NULL) { if (interp != NULL) { Tcl_SetObjResult(interp, Tcl_NewStringObj( @@ -2783,8 +2796,7 @@ Tk_PhotoPutBlock( return TCL_ERROR; } memToFree = sourceBlock.pixelPtr; - memcpy(sourceBlock.pixelPtr, blockPtr->pixelPtr, sourceBlock.height - * sourceBlock.pitch); + memcpy(sourceBlock.pixelPtr, blockPtr->pixelPtr, cpyLen); } @@ -3206,8 +3218,21 @@ Tk_PhotoPutZoomedBlock( if (sourceBlock.pixelPtr >= masterPtr->pix32 && sourceBlock.pixelPtr <= masterPtr->pix32 + masterPtr->width * masterPtr->height * 4) { - sourceBlock.pixelPtr = attemptckalloc(sourceBlock.height - * sourceBlock.pitch); + /* + * Fix 5c51be6411: avoid reading + * + * (sourceBlock.pitch - sourceBlock.width * sourceBlock.pixelSize) + * + * bytes past the end of masterPtr->pix32[] when + * + * blockPtr->pixelPtr > (masterPtr->pix32 + + * 4 * masterPtr->width * masterPtr->height - + * sourceBlock.height * sourceBlock.pitch) + */ + unsigned int cpyLen = (sourceBlock.height - 1) * sourceBlock.pitch + + sourceBlock.width * sourceBlock.pixelSize; + + sourceBlock.pixelPtr = attemptckalloc(cpyLen); if (sourceBlock.pixelPtr == NULL) { if (interp != NULL) { Tcl_SetObjResult(interp, Tcl_NewStringObj( @@ -3217,8 +3242,7 @@ Tk_PhotoPutZoomedBlock( return TCL_ERROR; } memToFree = sourceBlock.pixelPtr; - memcpy(sourceBlock.pixelPtr, blockPtr->pixelPtr, sourceBlock.height - * sourceBlock.pitch); + memcpy(sourceBlock.pixelPtr, blockPtr->pixelPtr, cpyLen); } xEnd = x + width; |