From 525f1a7466a169620c320643214fa1bc50809d30 Mon Sep 17 00:00:00 2001
From: dkf <donal.k.fellows@manchester.ac.uk>
Date: Mon, 27 Mar 2006 10:55:49 +0000
Subject: Fix (and add test for) [Bug 1458234]

---
 ChangeLog           | 21 +++++++++++++--------
 generic/tkImgGIF.c  | 26 +++++++++++++-------------
 tests/imgPhoto.test | 18 +++++++++++++++---
 3 files changed, 41 insertions(+), 24 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 76e0957..c88d7dd 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,11 +1,16 @@
+2006-03-27  Donal K. Fellows  <dkf@users.sf.net>
+
+	* generic/tkImgGIF.c (FileReadGIF): Stop crashes when the first GIF
+	frame does not define the overall size of the image. [Bug 1458234]
+
 2006-03-26  Vince Darley <vincentdarley@users.sourceforge.net>
 
 	* generic/tkText.c: 
 	* generic/tkText.h:
 	* generic/tkTextBTree.c:
-	* tests/text.test: Fix for [Bug 1414171] for '$text dump
-	-command <script>' where 'script' actually modifies the
-	widget during the process.
+	* tests/text.test: Fix for [Bug 1414171] for '$text dump -command
+	<script>' where 'script' actually modifies the widget during the
+	process.
 
 2006-03-25  Daniel Steffen  <das@users.sourceforge.net>
 
@@ -15,11 +20,11 @@
 
 2006-03-24  Daniel Steffen  <das@users.sourceforge.net>
 
-	* generic/tkTextDisp.c:   moved #ifdef MAC_OSX_TK code added by
-	* macosx/tkMacOSXColor.c: Patch #638966 into platform specific
-	* macosx/tkMacOSXInt.h:   files.
+	* generic/tkTextDisp.c:   Moved #ifdef MAC_OSX_TK code added by
+	* macosx/tkMacOSXColor.c: [Patch 638966] into platform specific files.
+	* macosx/tkMacOSXInt.h:
 
-	* macosx/tkMacOSX.h:             cleaned up & rationalized order of
+	* macosx/tkMacOSX.h:             Cleaned up & rationalized order of
 	* macosx/tkMacOSXBitmap.c:       #includes of tk and carbon headers.
 	* macosx/tkMacOSXButton.c:
 	* macosx/tkMacOSXCarbonEvents.c:
@@ -117,7 +122,7 @@
 
 2006-03-17  Pat Thoyts  <patthoyts@users.sourceforge.net>
 
-	* library/clrpick.tcl:   bug #1451587: avoid using abbreviated
+	* library/clrpick.tcl:   [Bug 1451587] Avoid using abbreviated
 	* library/palette.tcl:   sub-commands in core scripts as this
 	* library/scale.tcl:     can cause problems with mega-widget 
 	* library/scrlbar.tcl:   libraries like snit.
diff --git a/generic/tkImgGIF.c b/generic/tkImgGIF.c
index 1e2bd64..70f77b0 100644
--- a/generic/tkImgGIF.c
+++ b/generic/tkImgGIF.c
@@ -32,7 +32,7 @@
  * This file also contains code from miGIF. See lower down in file for the
  * applicable copyright notice for that portion.
  *
- * RCS: @(#) $Id: tkImgGIF.c,v 1.31 2005/12/01 03:21:37 hobbs Exp $
+ * RCS: @(#) $Id: tkImgGIF.c,v 1.32 2006/03/27 10:55:49 dkf Exp $
  */
 
 /*
@@ -252,7 +252,7 @@ FileReadGIF(
     int srcX, int srcY)		/* Coordinates of top-left pixel to be used in
 				 * image being read. */
 {
-    int fileWidth, fileHeight;
+    int fileWidth, fileHeight, imageWidth, imageHeight;
     int nBytes, index = 0, argc = 0, i;
     Tcl_Obj **objv;
     Tk_PhotoImageBlock block;
@@ -399,8 +399,8 @@ FileReadGIF(
 	    goto error;
 	}
 
-	fileWidth = LM_to_uint(buf[4], buf[5]);
-	fileHeight = LM_to_uint(buf[6], buf[7]);
+	imageWidth = LM_to_uint(buf[4], buf[5]);
+	imageHeight = LM_to_uint(buf[6], buf[7]);
 
 	bitPixel = 1<<((buf[8]&0x07)+1);
 
@@ -443,7 +443,7 @@ FileReadGIF(
 	     */
 
 	    if (ReadImage(gifConfPtr, interp, (char *)trashBuffer, chan,
-		    fileWidth, fileHeight, colorMap, 0, 0, 0, 0, 0,
+		    imageWidth, imageHeight, colorMap, 0, 0, 0, 0, 0,
 		    -1) != TCL_OK) {
 		goto error;
 	    }
@@ -464,8 +464,8 @@ FileReadGIF(
 	    srcX = 0;
 	}
 
-	if (width > fileWidth) {
-	    width = fileWidth;
+	if (width > imageWidth) {
+	    width = imageWidth;
 	}
 
 	index = LM_to_uint(buf[2], buf[3]);
@@ -474,8 +474,8 @@ FileReadGIF(
 	    destY -= srcY; height += srcY;
 	    srcY = 0;
 	}
-	if (height > fileHeight) {
-	    height = fileHeight;
+	if (height > imageHeight) {
+	    height = imageHeight;
 	}
 
 	if ((width <= 0) || (height <= 0)) {
@@ -487,13 +487,13 @@ FileReadGIF(
 	block.height = height;
 	block.pixelSize = (transparent>=0) ? 4 : 3;
 	block.offset[3] = (transparent>=0) ? 3 : 0;
-	block.pitch = block.pixelSize * fileWidth;
-	nBytes = block.pitch * fileHeight;
+	block.pitch = block.pixelSize * imageWidth;
+	nBytes = block.pitch * imageHeight;
 	block.pixelPtr = (unsigned char *) ckalloc((unsigned) nBytes);
 
 	if (ReadImage(gifConfPtr, interp, (char *) block.pixelPtr, chan,
-		fileWidth, fileHeight, colorMap, fileWidth, fileHeight, srcX,
-		srcY, BitSet(buf[8], INTERLACE), transparent) != TCL_OK) {
+		imageWidth,imageHeight, colorMap, fileWidth,fileHeight,
+		srcX,srcY, BitSet(buf[8],INTERLACE), transparent) != TCL_OK) {
 	    goto error;
 	}
 	break;
diff --git a/tests/imgPhoto.test b/tests/imgPhoto.test
index 1c371bc..31fd8cc 100644
--- a/tests/imgPhoto.test
+++ b/tests/imgPhoto.test
@@ -9,7 +9,7 @@
 #
 # Author: Paul Mackerras (paulus@cs.anu.edu.au)
 #
-# RCS: @(#) $Id: imgPhoto.test,v 1.22 2005/10/12 09:29:21 dkf Exp $
+# RCS: @(#) $Id: imgPhoto.test,v 1.23 2006/03/27 10:55:49 dkf Exp $
 
 package require tcltest 2.1
 eval tcltest::configure $argv
@@ -558,7 +558,7 @@ test imgPhoto-12.1 {Tk_PhotoPutZoomedBlock} hasTeapotPhoto {
 } {{19 92 192} {169 117 90} 512 512 {19 92 192}}
 
 test imgPhoto-13.1 {check separation of images in different interpreters} {
-    eval image delete [image names]
+    image delete {expand}[image names]
     set data {
 	R0lGODlhQgBkAPUAANbWxs7Wxs7OxsbOxsbGxsbGvb3Gvca9vcDAwL21vbW1vbW1tbWtta2t
 	ta2ltaWltaWlraWctaWcrZycrZyUrZSUrZSMrZSMpYyMrYyMpYyEpYSEpYR7pYR7nHp7pYRz
@@ -601,7 +601,6 @@ test imgPhoto-13.1 {check separation of images in different interpreters} {
     interp delete x2
 } {}
 
-
 test imgPhoto-14.1 {GIF writes work correctly} {
     set data "R0lGODlhYwA5APcAAAAAAIAAAACAAICAAAAAgIAAgACAgICAgAysnGy8hKzM
 hASs3MTcjAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
@@ -638,6 +637,19 @@ hciva9/Ovbv37+BzBgEEADs=
     catch {file delete -force $filename}
     set result
 } 1
+test imgPhoto-14.2 {GIF -index handler buffer sizing} {
+    # Bug 1458234 makes this crash when trying to access buffers of the
+    # wrong size, caused when the initial frame is not the largest frame.
+    set data {
+	R0lGODlhIAAgAKEAAPkOSQsi7////////yH/C05FVFNDQVBFMi4wAwEAAAAh
+	+QQJMgAAACwGAAYAFAAUAAACEYyPqcvtD6OctNqLs968+68VACH5BAkyAAEA
+	LAMAAwAaABoAAAI0jH+gq+gfmFzQzUsr3gBybn1gIm5kaUaoubbuC8fyTNel
+	Ohv1CSO533u8KrgbUfc5Ci/EAgA7
+    }
+    set i [image create photo]
+    $i configure -data $data -format {gif -index 2}
+    image delete $i
+} {}
 
 test imgPhoto-15.1 {photo images can fail to allocate memory gracefully} \
 	{nonPortable} {
-- 
cgit v0.12