Attachment 227531 Details for Bug 332021 – Patch against 8.4.12 created by Jamie Strandboge, which does not introduce CVE-2007-5137

[patch] Patch against 8.4.12 created by Jamie Strandboge, which does not introduce CVE-2007-5137

tk8.4_1458234.diff (text/plain), 2.48 KB, created by Tomas Hoger on 2007-10-15 12:15:07 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomas Hoger

Created: 2007-10-15 12:15:07 UTC

Size: 2.48 KB

patch

obsolete

>diff -Nru tk8.4-8.4.12.orig/generic/tkImgGIF.c tk8.4-8.4.12/generic/tkImgGIF.c
>--- tk8.4-8.4.12.orig/generic/tkImgGIF.c	2005-11-30 22:22:10.000000000 -0500
>+++ tk8.4-8.4.12/generic/tkImgGIF.c	2007-10-09 11:28:08.000000000 -0400
>@@ -243,7 +243,7 @@
>     int srcX, srcY;		/* Coordinates of top-left pixel to be used
> 				 * in image being read. */
> {
>-    int fileWidth, fileHeight;
>+    int fileWidth, fileHeight, imageWidth, imageHeight;
>     int nBytes, index = 0, argc = 0, i;
>     Tcl_Obj **objv;
>     Tk_PhotoImageBlock block;
>@@ -376,8 +376,8 @@
> 	    goto error;
> 	}
> 
>-	fileWidth = LM_to_uint(buf[4],buf[5]);
>-	fileHeight = LM_to_uint(buf[6],buf[7]);
>+	imageWidth = LM_to_uint(buf[4],buf[5]);
>+	imageHeight = LM_to_uint(buf[6],buf[7]);
> 
> 	bitPixel = 1<<((buf[8]&0x07)+1);
> 
>@@ -419,8 +419,8 @@
> 	     * of the less frequent case, I chose to maintain high
> 	     * performance for the common case.
> 	     */
>-	    if (ReadImage(interp, (char *) trashBuffer, chan, fileWidth,
>-		    fileHeight, colorMap, 0, 0, 0, 0, 0, -1) != TCL_OK) {
>+	    if (ReadImage(interp, (char *) trashBuffer, chan, imageWidth,
>+		    imageHeight, colorMap, 0, 0, 0, 0, 0, -1) != TCL_OK) {
> 		goto error;
> 	    }
> 	    continue;
>@@ -441,8 +441,8 @@
> 	    srcX = 0;
> 	}
> 
>-	if (width > fileWidth) {
>-	    width = fileWidth;
>+	if (width > imageWidth) {
>+	    width = imageWidth;
> 	}
> 
> 	index = LM_to_uint(buf[2],buf[3]);
>@@ -451,8 +451,8 @@
> 	    destY -= srcY; height += srcY;
> 	    srcY = 0;
> 	}
>-	if (height > fileHeight) {
>-	    height = fileHeight;
>+	if (height > imageHeight) {
>+	    height = imageHeight;
> 	}
> 
> 	if ((width <= 0) || (height <= 0)) {
>@@ -464,12 +464,12 @@
> 	block.height = height;
> 	block.pixelSize = (transparent>=0) ? 4 : 3;
> 	block.offset[3] = (transparent>=0) ? 3 : 0;
>-	block.pitch = block.pixelSize * fileWidth;
>-	nBytes = block.pitch * fileHeight;
>+	block.pitch = block.pixelSize * imageWidth;
>+	nBytes = block.pitch * imageHeight;
> 	block.pixelPtr = (unsigned char *) ckalloc((unsigned) nBytes);
> 
>-	if (ReadImage(interp, (char *) block.pixelPtr, chan, fileWidth,
>-		fileHeight, colorMap, fileWidth, fileHeight, srcX, srcY,
>+	if (ReadImage(interp, (char *) block.pixelPtr, chan, imageWidth,
>+		imageHeight, colorMap, fileWidth, fileHeight, srcX, srcY,
> 		BitSet(buf[8], INTERLACE), transparent) != TCL_OK) {
> 	    goto error;
> 	}
>@@ -995,7 +995,7 @@
> 	 */
> 	if (interlace) {
> 	    ypos += interlaceStep[pass];
>-	    while (ypos >= height) {
>+	    while (ypos >= rows) {
> 		pass++;
> 		if (pass > 3) {
> 		    return TCL_OK;

Actions: View | Diff

Attachments on bug 332021: 227521 | 227531