diff options
| author | kennykb <kennykb@noemail.net> | 2007-11-26 20:38:34 (GMT) |
|---|---|---|
| committer | kennykb <kennykb@noemail.net> | 2007-11-26 20:38:34 (GMT) |
| commit | bb3b4d6bdd648eb5b72ec2487963527859a7b172 (patch) | |
| tree | 4b3c4719ed27a5a97869113ec8a9418f1c35be81 /generic | |
| parent | f409585c705f8ddb6e931437b51c99860a1ab342 (diff) | |
| download | tk-bb3b4d6bdd648eb5b72ec2487963527859a7b172.zip tk-bb3b4d6bdd648eb5b72ec2487963527859a7b172.tar.gz tk-bb3b4d6bdd648eb5b72ec2487963527859a7b172.tar.bz2 | |
* generic/tkImgPPM.c (StringReadPPM): Corrected a comparison
whose sense was reversed that resulted in reading beyond the
end of the input buffer on malformed PPM data. [Bug #1822391]
* tests/imgPPM.test (imgPPM-4.1): Added test case that
exercises [Bug #1822391].
FossilOrigin-Name: c855e45639ae698af47159bcc6ae8ceccf5a0b8e
Diffstat (limited to 'generic')
| -rw-r--r-- | generic/tkImgPPM.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/generic/tkImgPPM.c b/generic/tkImgPPM.c index 45063c9..b4302e4 100644 --- a/generic/tkImgPPM.c +++ b/generic/tkImgPPM.c @@ -13,7 +13,7 @@ * Department of Computer Science, * Australian National University. * - * RCS: @(#) $Id: tkImgPPM.c,v 1.19 2007/09/07 00:34:52 dgp Exp $ + * RCS: @(#) $Id: tkImgPPM.c,v 1.20 2007/11/26 20:38:35 kennykb Exp $ */ #include "tkInt.h" @@ -538,7 +538,7 @@ StringReadPPM( * We have all the data in memory, so write everything in one go. */ - if (block.pitch*height < dataSize) { + if (block.pitch*height > dataSize) { Tcl_AppendResult(interp, "truncated PPM data", NULL); return TCL_ERROR; } |