Attachment 227521 Details for Bug 332021 – Patch against 8.3.5 created by Jamie Strandboge, which does not introduce CVE-2007-5137

[patch] Patch against 8.3.5 created by Jamie Strandboge, which does not introduce CVE-2007-5137

tk8.3_1458234.diff (text/plain), 2.53 KB, created by Tomas Hoger on 2007-10-15 12:14:32 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomas Hoger

Created: 2007-10-15 12:14:32 UTC

Size: 2.53 KB

patch

obsolete

>diff -Nru tk8.3-8.3.5.orig/generic/tkImgGIF.c tk8.3-8.3.5/generic/tkImgGIF.c
>--- tk8.3-8.3.5.orig/generic/tkImgGIF.c	2002-03-25 21:29:01.000000000 -0500
>+++ tk8.3-8.3.5/generic/tkImgGIF.c	2007-10-09 10:40:17.000000000 -0400
>@@ -240,7 +240,7 @@
>     int srcX, srcY;		/* Coordinates of top-left pixel to be used
> 				 * in image being read. */
> {
>-    int fileWidth, fileHeight;
>+    int fileWidth, fileHeight, imageWidth, imageHeight;
>     int nBytes, index = 0, argc = 0, i;
>     Tcl_Obj **objv;
>     Tk_PhotoImageBlock block;
>@@ -372,8 +372,8 @@
> 	    goto error;
> 	}
> 
>-	fileWidth = LM_to_uint(buf[4],buf[5]);
>-	fileHeight = LM_to_uint(buf[6],buf[7]);
>+	imageWidth = LM_to_uint(buf[4],buf[5]);
>+	imageHeight = LM_to_uint(buf[6],buf[7]);
> 
> 	bitPixel = 1<<((buf[8]&0x07)+1);
> 
>@@ -409,8 +409,8 @@
> 	     * marginally improve the speed of the less frequent case, I chose
> 	     * to maintain high performance for the common case.
> 	     */
>-	    if (ReadImage(interp, (char *) trashBuffer, chan, fileWidth,
>-			  fileHeight, colorMap, 0, 0, 0, 0, 0, -1) != TCL_OK) {
>+	    if (ReadImage(interp, (char *) trashBuffer, chan, imageWidth,
>+			  imageHeight, colorMap, 0, 0, 0, 0, 0, -1) != TCL_OK) {
> 	      goto error;
> 	    }
> 	    continue;
>@@ -436,8 +436,8 @@
> 	    srcX = 0;
> 	}
> 
>-	if (width > fileWidth) {
>-	    width = fileWidth;
>+	if (width > imageWidth) {
>+	    width = imageWidth;
> 	}
> 
> 	index = LM_to_uint(buf[2],buf[3]);
>@@ -446,8 +446,8 @@
> 	    destY -= srcY; height += srcY;
> 	    srcY = 0;
> 	}
>-	if (height > fileHeight) {
>-	    height = fileHeight;
>+	if (height > imageHeight) {
>+	    height = imageHeight;
> 	}
> 
> 	if ((width <= 0) || (height <= 0)) {
>@@ -459,12 +459,12 @@
> 	block.height = height;
> 	block.pixelSize = (transparent>=0) ? 4 : 3;
> 	block.offset[3] = (transparent>=0) ? 3 : 0;
>-	block.pitch = block.pixelSize * width;
>-	nBytes = block.pitch * height;
>+	block.pitch = block.pixelSize * imageWidth;
>+	nBytes = block.pitch * imageHeight;
> 	block.pixelPtr = (unsigned char *) ckalloc((unsigned) nBytes);
> 
>-	if (ReadImage(interp, (char *) block.pixelPtr, chan, width,
>-		height, colorMap, fileWidth, fileHeight, srcX, srcY,
>+	if (ReadImage(interp, (char *) block.pixelPtr, chan, imageWidth,
>+		imageHeight, colorMap, fileWidth, fileHeight, srcX, srcY,
> 		BitSet(buf[8], INTERLACE), transparent) != TCL_OK) {
> 	    goto error;
> 	}
>@@ -960,7 +960,7 @@
> 	/* If interlacing, the next ypos is not just +1 */
> 	if (interlace) {
> 	    ypos += interlaceStep[pass];
>-	    while (ypos >= height) {
>+	    while (ypos >= rows) {
> 		pass++;
> 		if (pass > 3) {
> 		    return TCL_OK;

Actions: View | Diff

Attachments on bug 332021: 227521 | 227531