[Bug 2809525] Abort on overlong color name

FossilOrigin-Name: 4628990279a2d8a3dba863e4d078d7e7c14b4a7e

1 files changed, 6 insertions, 17 deletions

diff --git a/unix/tkUnixColor.c b/unix/tkUnixColor.c
index aebbbca..722dd06 100644
--- a/unix/tkUnixColor.c
+++ b/unix/tkUnixColor.c
@@ -128,20 +128,6 @@ TkpGetColor(tkwin, name)
     Colormap colormap = Tk_Colormap(tkwin);
     XColor color;
     TkColor *tkColPtr;
-    char buf[100];
-    unsigned len = strlen(name);
-
-    /*
-     * Make sure that we never exceed a reasonable length of color name. A
-     * good maximum length is 99, arbitrary, but larger than any known color
-     * name. [Bug 2809525]
-     */
-
-    if (len > 99) {
-	len = 99;
-    }
-    memcpy(buf, name, len);
-    buf[len] = '\0';
 
     /*
      * Map from the name to a pixel value.  Call XAllocNamedColor rather than
@@ -152,7 +138,10 @@ TkpGetColor(tkwin, name)
     if (*name != '#') {
 	XColor screen;
 
-	if (XAllocNamedColor(display, colormap, buf, &screen, &color) != 0) {
+	if (strlen(name) > 99) {
+	/* Don't bother to parse this. [Bug 2809525]*/
+	return (TkColor *) NULL;
+    } else if (XAllocNamedColor(display, colormap, name, &screen, &color) != 0) {
 	    DeleteStressedCmap(display, colormap);
 	} else {
 	    /*
@@ -162,13 +151,13 @@ TkpGetColor(tkwin, name)
 	     * pick an approximation to the desired color.
 	     */
 
-	    if (XLookupColor(display, colormap, buf, &color, &screen) == 0) {
+	    if (XLookupColor(display, colormap, name, &color, &screen) == 0) {
 		return (TkColor *) NULL;
 	    }
 	    FindClosestColor(tkwin, &screen, &color);
 	}
     } else {
-	if (TkParseColor(display, colormap, buf, &color) == 0) {
+	if (TkParseColor(display, colormap, name, &color) == 0) {
 	    return (TkColor *) NULL;
 	}
 	if (XAllocColor(display, colormap, &color) != 0) {