diff options
Diffstat (limited to 'generic/tkImgPhoto.c')
| -rw-r--r-- | generic/tkImgPhoto.c | 40 |
1 files changed, 32 insertions, 8 deletions
diff --git a/generic/tkImgPhoto.c b/generic/tkImgPhoto.c index ab962c1..26b0446 100644 --- a/generic/tkImgPhoto.c +++ b/generic/tkImgPhoto.c @@ -2772,8 +2772,21 @@ Tk_PhotoPutBlock( if (sourceBlock.pixelPtr >= masterPtr->pix32 && sourceBlock.pixelPtr <= masterPtr->pix32 + masterPtr->width * masterPtr->height * 4) { - sourceBlock.pixelPtr = attemptckalloc(sourceBlock.height - * sourceBlock.pitch); + /* + * Fix 5c51be6411: avoid reading + * + * (sourceBlock.pitch - sourceBlock.width * sourceBlock.pixelSize) + * + * bytes past the end of masterPtr->pix32[] when + * + * blockPtr->pixelPtr > (masterPtr->pix32 + + * 4 * masterPtr->width * masterPtr->height - + * sourceBlock.height * sourceBlock.pitch) + */ + unsigned int cpyLen = (sourceBlock.height - 1) * sourceBlock.pitch + + sourceBlock.width * sourceBlock.pixelSize; + + sourceBlock.pixelPtr = attemptckalloc(cpyLen); if (sourceBlock.pixelPtr == NULL) { if (interp != NULL) { Tcl_SetObjResult(interp, Tcl_NewStringObj( @@ -2783,8 +2796,7 @@ Tk_PhotoPutBlock( return TCL_ERROR; } memToFree = sourceBlock.pixelPtr; - memcpy(sourceBlock.pixelPtr, blockPtr->pixelPtr, sourceBlock.height - * sourceBlock.pitch); + memcpy(sourceBlock.pixelPtr, blockPtr->pixelPtr, cpyLen); } @@ -3206,8 +3218,21 @@ Tk_PhotoPutZoomedBlock( if (sourceBlock.pixelPtr >= masterPtr->pix32 && sourceBlock.pixelPtr <= masterPtr->pix32 + masterPtr->width * masterPtr->height * 4) { - sourceBlock.pixelPtr = attemptckalloc(sourceBlock.height - * sourceBlock.pitch); + /* + * Fix 5c51be6411: avoid reading + * + * (sourceBlock.pitch - sourceBlock.width * sourceBlock.pixelSize) + * + * bytes past the end of masterPtr->pix32[] when + * + * blockPtr->pixelPtr > (masterPtr->pix32 + + * 4 * masterPtr->width * masterPtr->height - + * sourceBlock.height * sourceBlock.pitch) + */ + unsigned int cpyLen = (sourceBlock.height - 1) * sourceBlock.pitch + + sourceBlock.width * sourceBlock.pixelSize; + + sourceBlock.pixelPtr = attemptckalloc(cpyLen); if (sourceBlock.pixelPtr == NULL) { if (interp != NULL) { Tcl_SetObjResult(interp, Tcl_NewStringObj( @@ -3217,8 +3242,7 @@ Tk_PhotoPutZoomedBlock( return TCL_ERROR; } memToFree = sourceBlock.pixelPtr; - memcpy(sourceBlock.pixelPtr, blockPtr->pixelPtr, sourceBlock.height - * sourceBlock.pitch); + memcpy(sourceBlock.pixelPtr, blockPtr->pixelPtr, cpyLen); } xEnd = x + width; |