[Bug 2809525] Abort on overlong color name

1 files changed, 6 insertions, 17 deletions

diff --git a/unix/tkUnixColor.c b/unix/tkUnixColor.c
index d3dba23..a455118 100644
--- a/unix/tkUnixColor.c
+++ b/unix/tkUnixColor.c
@@ -126,20 +126,6 @@ TkpGetColor(
     Colormap colormap = Tk_Colormap(tkwin);
     XColor color;
     TkColor *tkColPtr;
-    char buf[100];
-    unsigned len = strlen(name);
-
-    /*
-     * Make sure that we never exceed a reasonable length of color name. A
-     * good maximum length is 99, arbitrary, but larger than any known color
-     * name. [Bug 2809525]
-     */
-
-    if (len > 99) {
-	len = 99;
-    }
-    memcpy(buf, name, len);
-    buf[len] = '\0';
 
     /*
      * Map from the name to a pixel value. Call XAllocNamedColor rather than
@@ -150,7 +136,10 @@ TkpGetColor(
     if (*name != '#') {
 	XColor screen;
 
-	if (XAllocNamedColor(display, colormap, buf, &screen, &color) != 0) {
+	if (strlen(name) > 99) {
+	/* Don't bother to parse this. [Bug 2809525]*/
+	return (TkColor *) NULL;
+    } else if (XAllocNamedColor(display, colormap, name, &screen, &color) != 0) {
 	    DeleteStressedCmap(display, colormap);
 	} else {
 	    /*
@@ -160,13 +149,13 @@ TkpGetColor(
 	     * approximation to the desired color.
 	     */
 
-	    if (XLookupColor(display, colormap, buf, &color, &screen) == 0) {
+	    if (XLookupColor(display, colormap, name, &color, &screen) == 0) {
 		return NULL;
 	    }
 	    FindClosestColor(tkwin, &screen, &color);
 	}
     } else {
-	if (TkParseColor(display, colormap, buf, &color) == 0) {
+	if (TkParseColor(display, colormap, name, &color) == 0) {
 	    return NULL;
 	}
 	if (XAllocColor(display, colormap, &color) != 0) {