Attachment #142420 for bug #208464

View | Details | Raw Unified | Return to bug 208464
Collapse All | Expand All

Lines 826-831 Link Here

(-)generic/tkImgGIF.c (+6 lines)
826	Tcl_PosixError(interp), (char *) NULL);	826	Tcl_PosixError(interp), (char *) NULL);
827	return TCL_ERROR;	827	return TCL_ERROR;
828	}	828	}
		829
		830	if (initialCodeSize > MAX_LWZ_BITS) {
		831	Tcl_SetResult(interp, "malformed image", TCL_STATIC);
		832	return TCL_ERROR;
		833	}
		834
829	if (transparent != -1) {	835	if (transparent != -1) {
830	cmap[transparent][CM_RED] = 0;	836	cmap[transparent][CM_RED] = 0;
831	cmap[transparent][CM_GREEN] = 0;	837	cmap[transparent][CM_GREEN] = 0;




    image delete $i
}

test imgPhoto-14.4 {GIF buffer overflow} -setup {
    set i [image create photo]
} -body {
    # This crashes Tk up to 8.4.17 and 8.5.0
    $i configure -data {
	R0lGODlhCgAKAPcAAAAAAIAAAACAAICAAAAAgIAAgACAgICAgMDAwP8AAAD/
	AP//AAAA//8A/wD//////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
	AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
	AAAAMwAAZgAAmQAAzAAA/wAzAAAzMwAzZgAzmQAzzAAz/wBmAABmMwBmZgBm
	mQBmzABm/wCZAACZMwCZZgCZmQCZzACZ/wDMAADMMwDMZgDMmQDMzADM/wD/
	AAD/MwD/ZgD/mQD/zAD//zMAADMAMzMAZjMAmTMAzDMA/zMzADMzMzMzZjMz
	mTMzzDMz/zNmADNmMzNmZjNmmTNmzDNm/zOZADOZMzOZZjOZmTOZzDOZ/zPM
	ADPMMzPMZjPMmTPMzDPM/zP/ADP/MzP/ZjP/mTP/zDP//2YAAGYAM2YAZmYA
	mWYAzGYA/2YzAGYzM2YzZmYzmWYzzGYz/2ZmAGZmM2ZmZmZmmWZmzGZm/2aZ
	AGaZM2aZZmaZmWaZzGaZ/2bMAGbMM2bMZmbMmWbMzGbM/2b/AGb/M2b/Zmb/
	mWb/zGb//5kAAJkAM5kAZpkAmZkAzJkA/5kzAJkzM5kzZpkzmZkzzJkz/5lm
	AJlmM5lmZplmmZlmzJlm/5mZAJmZM5mZZpmZmZmZzJmZ/5nMAJnMM5nMZpnM
	mZnMzJnM/5n/AJn/M5n/Zpn/mZn/zJn//8wAAMwAM8wAZswAmcwAzMwA/8wz
	AMwzM8wzZswzmcwzzMwz/8xmAMxmM8xmZsxmmcxmzMxm/8yZAMyZM8yZZsyZ
	mcyZzMyZ/8zMAMzMM8zMZszMmczMzMzM/8z/AMz/M8z/Zsz/mcz/zMz///8A
	AP8AM/8AZv8Amf8AzP8A//8zAP8zM/8zZv8zmf8zzP8z//9mAP9mM/9mZv9m
	mf9mzP9m//+ZAP+ZM/+ZZv+Zmf+ZzP+Z///MAP/MM//MZv/Mmf/MzP/M////
	AP//M///Zv//mf//zP///yH5BAEAABAALAAAAAAKAAoAABUSAAD/HEiwoMGD
	CBMqXMiwYcKAADs=
    } 
} -cleanup {
    image delete $i
} -returnCodes error -result {malformed image}

test imgPhoto-15.1 {photo images can fail to allocate memory gracefully} \
	{nonPortable} {
    # This is not portable to very large machines with more around

Return to bug 208464

Lines 681-686 Link Here

(-)tests/imgPhoto.test (+29 lines)
681	image delete $i	681	image delete $i
682	}	682	}
683		683
		684	test imgPhoto-14.4 {GIF buffer overflow} -setup {
		685	set i [image create photo]
		686	} -body {
		687	# This crashes Tk up to 8.4.17 and 8.5.0
		688	$i configure -data {
		689	R0lGODlhCgAKAPcAAAAAAIAAAACAAICAAAAAgIAAgACAgICAgMDAwP8AAAD/
		690	AP//AAAA//8A/wD//////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
		691	AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
		692	AAAAMwAAZgAAmQAAzAAA/wAzAAAzMwAzZgAzmQAzzAAz/wBmAABmMwBmZgBm
		693	mQBmzABm/wCZAACZMwCZZgCZmQCZzACZ/wDMAADMMwDMZgDMmQDMzADM/wD/
		694	AAD/MwD/ZgD/mQD/zAD//zMAADMAMzMAZjMAmTMAzDMA/zMzADMzMzMzZjMz
		695	mTMzzDMz/zNmADNmMzNmZjNmmTNmzDNm/zOZADOZMzOZZjOZmTOZzDOZ/zPM
		696	ADPMMzPMZjPMmTPMzDPM/zP/ADP/MzP/ZjP/mTP/zDP//2YAAGYAM2YAZmYA
		697	mWYAzGYA/2YzAGYzM2YzZmYzmWYzzGYz/2ZmAGZmM2ZmZmZmmWZmzGZm/2aZ
		698	AGaZM2aZZmaZmWaZzGaZ/2bMAGbMM2bMZmbMmWbMzGbM/2b/AGb/M2b/Zmb/
		699	mWb/zGb//5kAAJkAM5kAZpkAmZkAzJkA/5kzAJkzM5kzZpkzmZkzzJkz/5lm
		700	AJlmM5lmZplmmZlmzJlm/5mZAJmZM5mZZpmZmZmZzJmZ/5nMAJnMM5nMZpnM
		701	mZnMzJnM/5n/AJn/M5n/Zpn/mZn/zJn//8wAAMwAM8wAZswAmcwAzMwA/8wz
		702	AMwzM8wzZswzmcwzzMwz/8xmAMxmM8xmZsxmmcxmzMxm/8yZAMyZM8yZZsyZ
		703	mcyZzMyZ/8zMAMzMM8zMZszMmczMzMzM/8z/AMz/M8z/Zsz/mcz/zMz///8A
		704	AP8AM/8AZv8Amf8AzP8A//8zAP8zM/8zZv8zmf8zzP8z//9mAP9mM/9mZv9m
		705	mf9mzP9m//+ZAP+ZM/+ZZv+Zmf+ZzP+Z///MAP/MM//MZv/Mmf/MzP/M////
		706	AP//M///Zv//mf//zP///yH5BAEAABAALAAAAAAKAAoAABUSAAD/HEiwoMGD
		707	CBMqXMiwYcKAADs=
		708	}
		709	} -cleanup {
		710	image delete $i
		711	} -returnCodes error -result {malformed image}
		712
684	test imgPhoto-15.1 {photo images can fail to allocate memory gracefully} \	713	test imgPhoto-15.1 {photo images can fail to allocate memory gracefully} \
685	{nonPortable} {	714	{nonPortable} {
686	# This is not portable to very large machines with more around	715	# This is not portable to very large machines with more around