summaryrefslogtreecommitdiffstats
path: root/generic
diff options
context:
space:
mode:
authorKevin B Kenny <kennykb@acm.org>2007-11-26 20:53:57 (GMT)
committerKevin B Kenny <kennykb@acm.org>2007-11-26 20:53:57 (GMT)
commit04d59cbc4af657da97a836a24ed6f952bb1a3633 (patch)
tree1f3a435ace170a7ccfe7ee18e33f9f2fab8f2dc3 /generic
parent86cb489f9d555eb126bc7af0aed33123a9c1742c (diff)
downloadtk-04d59cbc4af657da97a836a24ed6f952bb1a3633.zip
tk-04d59cbc4af657da97a836a24ed6f952bb1a3633.tar.gz
tk-04d59cbc4af657da97a836a24ed6f952bb1a3633.tar.bz2
Backport from HEAD of [Bug #1822391]:
* generic/tkImgPPM.c (StringReadPPM): Corrected a comparison whose sense was reversed that resulted in reading beyond the end of the input buffer on malformed PPM data. [Bug #1822391] * tests/imgPPM.test (imgPPM-4.1): Added test case that exercises [Bug #1822391].
Diffstat (limited to 'generic')
-rw-r--r--generic/tkImgPPM.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/generic/tkImgPPM.c b/generic/tkImgPPM.c
index 3469fcc..ad07913 100644
--- a/generic/tkImgPPM.c
+++ b/generic/tkImgPPM.c
@@ -13,7 +13,7 @@
* Department of Computer Science,
* Australian National University.
*
- * RCS: @(#) $Id: tkImgPPM.c,v 1.10.2.2 2004/03/27 00:40:39 dkf Exp $
+ * RCS: @(#) $Id: tkImgPPM.c,v 1.10.2.3 2007/11/26 20:53:57 kennykb Exp $
*/
#include "tkInt.h"
@@ -540,7 +540,7 @@ StringReadPPM(interp, dataObj, format, imageHandle, destX, destY,
* We have all the data in memory, so write everything in one
* go.
*/
- if (block.pitch*height < dataSize) {
+ if (block.pitch*height > dataSize) {
Tcl_AppendResult(interp, "truncated PPM data", NULL);
return TCL_ERROR;
}