Tk Source Code

Check-in [c6057853]
Login

Many hyperlinks are disabled.
Use anonymous login to enable hyperlinks.

Overview
Comment:Fix [b601ce3ab1]: A corrupted image can cause resource exhaustion. Patch from Keith Nash.
Downloads: Tarball | ZIP archive | SQL archive
Timelines: family | ancestors | descendants | both | trunk
Files: files | file ages | folders
SHA1: c6057853be169b0e63cebd12c5817f9d683d939a
User & Date: fvogel 2017-08-02 12:23:53
Context
2017-08-04
13:42
[9eab541213] Fix OSX file dialog handling of -initialdir. Thanks to Christian Gollwitzer. check-in: f3f47819 user: dgp tags: trunk
2017-08-02
12:23
Fix [b601ce3ab1]: A corrupted image can cause resource exhaustion. Patch from Keith Nash. check-in: c6057853 user: fvogel tags: trunk
12:00
Fix [b601ce3ab1]: A corrupted image can cause resource exhaustion. Patch from Keith Nash. check-in: afcc283f user: fvogel tags: core-8-6-branch
2017-07-03
08:36
merge-mark check-in: f7910148 user: jan.nijtmans tags: trunk
Changes
Hide Diffs Unified Diffs Ignore Whitespace Patch

Changes to generic/tkImgGIF.c.

1567
1568
1569
1570
1571
1572
1573

1574
1575
1576
1577
1578
1579
1580
	MFile *handle = (MFile *) chan;

	if (handle->length <= 0 || (size_t) handle->length < hunk*count) {
	    return -1;
	}
	memcpy(dst, handle->data, (size_t) (hunk * count));
	handle->data += hunk * count;

	return (int)(hunk * count);
    }

    /*
     * Otherwise we've got a real file to read.
     */








>







1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
	MFile *handle = (MFile *) chan;

	if (handle->length <= 0 || (size_t) handle->length < hunk*count) {
	    return -1;
	}
	memcpy(dst, handle->data, (size_t) (hunk * count));
	handle->data += hunk * count;
	handle->length -= hunk * count;
	return (int)(hunk * count);
    }

    /*
     * Otherwise we've got a real file to read.
     */

Added tests/corruptMangled.gif.





>
>
1
2
GIF89a�33��33�3�3�33����3���!�
,!x��-0Bw��ڥ���J�8U�kir/3Re7  ;

Added tests/corruptMangled4G.gif.





>
>
1
2
GIF89a�f3��33�3�3�33����3���!�
,!x��-0Bw��ڥ���J�8U�kir/3Re7  ;

Added tests/corruptTruncated.gif.

cannot compute difference between binary files

Changes to tests/imgPhoto.test.

55
56
57
58
59
60
61





62

63
64
65
66
67
68
69
    README -- Tk test suite design document.
} README-imgPhoto]

# find the teapot.ppm file for use in these tests
set teapotPhotoFile [file join [file dirname [info script]] teapot.ppm]
testConstraint hasTeapotPhoto [file exists $teapotPhotoFile]






# ----------------------------------------------------------------------


test imgPhoto-1.1 {options for photo images} -body {
    image create photo photo1 -width 79 -height 83
    list [photo1 cget -width] [photo1 cget -height] \
	[image width photo1] [image height photo1]
} -cleanup {
    image delete photo1







>
>
>
>
>
|
>







55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
    README -- Tk test suite design document.
} README-imgPhoto]

# find the teapot.ppm file for use in these tests
set teapotPhotoFile [file join [file dirname [info script]] teapot.ppm]
testConstraint hasTeapotPhoto [file exists $teapotPhotoFile]

proc base64ok {} {
    expr {
        ![catch {package require base64}]
    }
}

testConstraint base64PackageNeeded [base64ok]

test imgPhoto-1.1 {options for photo images} -body {
    image create photo photo1 -width 79 -height 83
    list [photo1 cget -width] [photo1 cget -height] \
	[image width photo1] [image height photo1]
} -cleanup {
    image delete photo1
1238
1239
1240
1241
1242
1243
1244
1245



























































































































1246
1247
1248
1249
1250
1251
1252
    read $fd 3
} -cleanup {
    catch {close $fd}
    image delete $i
    catch {removeFile $f}
} -result "P6\n"

# ----------------------------------------------------------------------




























































































































catch {rename foreachPixel {}}
catch {rename checkImgTrans {}}
catch {rename checkImgTransLoop {}}
imageFinish

# cleanup







|
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>







1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
    read $fd 3
} -cleanup {
    catch {close $fd}
    image delete $i
    catch {removeFile $f}
} -result "P6\n"

# Reject corrupted or truncated image [Bug b601ce3ab1].
# WARNING - tests 18.1-18.9 will cause a segfault on 8.5.19 and lower,
#           and on 8.6.6 and lower.
test imgPhoto-18.1 {Reject corrupted GIF (binary string)} -constraints {
    base64PackageNeeded
} -setup {
    package require base64
    set data [base64::decode {
	R0lGODlhwjMz//8zM/8z/zP/MzP/////M////yH5CiwheLrcLTBCd6Tv2qW16tdK4jhV
	5qpraXIvM1JlNyAgOw==
    }]
} -body {
    image create photo gif1 -data $data
} -cleanup {
    catch {image delete gif1}
} -returnCodes error -result {error reading color map|not enough free memory for image buffer} -match regexp
test imgPhoto-18.2 {Reject corrupted GIF (base 64 string)} -setup {
    set data {
	R0lGODlhwjMz//8zM/8z/zP/MzP/////M////yH5CiwheLrcLTBCd6Tv2qW16tdK4jhV
	5qpraXIvM1JlNyAgOw==
    }
} -body {
    image create photo gif1 -data $data
} -cleanup {
    catch {image delete gif1}
} -returnCodes error -result {error reading color map|not enough free memory for image buffer} -match regexp
test imgPhoto-18.3 {Reject corrupted GIF (file)} -setup {
    set fileName [file join [file dirname [info script]] corruptMangled.gif]
} -body {
    image create photo gif1 -file $fileName
} -cleanup {
    catch {image delete gif1}
} -returnCodes error -result {error reading color map|not enough free memory for image buffer} -match regexp
test imgPhoto-18.4 {Reject truncated GIF (binary string)} -constraints {
    base64PackageNeeded
} -setup {
    package require base64
    set data [base64::decode {
	R0lGODlhEAAQAMIHAAAAADMz//8zM/8z/zP/MzP///8=
    }]
} -body {
    image create photo gif1 -data $data
} -cleanup {
    catch {image delete gif1}
} -returnCodes error -result {error reading color map}
test imgPhoto-18.5 {Reject truncated GIF (base 64 string)} -setup {
    set data {
	R0lGODlhEAAQAMIHAAAAADMz//8zM/8z/zP/MzP///8=
    }
} -body {
    image create photo gif1 -data $data
} -cleanup {
    catch {image delete gif1}
} -returnCodes error -result {error reading color map}
test imgPhoto-18.6 {Reject truncated GIF (file)} -setup {
    set fileName [file join [file dirname [info script]] corruptTruncated.gif]
} -body {
    image create photo gif1 -file $fileName
} -cleanup {
    catch {image delete gif1}
} -returnCodes error -result {error reading color map}
test imgPhoto-18.7 {Reject corrupted GIF (> 4Gb) (binary string)} -constraints {
    base64PackageNeeded
} -setup {
    package require base64
    set data [base64::decode {
	R0lGODlhwmYz//8zM/8z/zP/MzP/////M////yH5Ciwhe
	LrcLTBCd6Tv2qW16tdK4jhV5qpraXIvM1JlNyAgOw==
    }]
} -body {
    image create photo gif1 -data $data
} -cleanup {
    catch {image delete gif1}
} -returnCodes error -result {error reading color map|not enough free memory for image buffer} -match regexp
test imgPhoto-18.8 {Reject corrupted GIF (> 4Gb) (base 64 string)} -setup {
    set data {
	R0lGODlhwmYz//8zM/8z/zP/MzP/////M////yH5Ciwhe
	LrcLTBCd6Tv2qW16tdK4jhV5qpraXIvM1JlNyAgOw==
    }
} -body {
    image create photo gif1 -data $data
} -cleanup {
    catch {image delete gif1}
} -returnCodes error -result {error reading color map|not enough free memory for image buffer} -match regexp
test imgPhoto-18.9 {Reject corrupted GIF (> 4Gb) (file)} -setup {
    set fileName [file join [file dirname [info script]] corruptMangled4G.gif]
} -body {
    image create photo gif1 -file $fileName
} -cleanup {
    catch {image delete gif1}
} -returnCodes error -result {error reading color map|not enough free memory for image buffer} -match regexp
test imgPhoto-18.10 {Valid GIF (binary string)} -constraints {
    base64PackageNeeded
} -setup {
    # Test the binary string reader with a valid GIF.
    # This is not tested elsewhere.
    # Tests 18.11, 18.12, with matching data, are included for completeness.
    package require base64
    set data [base64::decode {
	R0lGODlhEAAQAMIHAAAAADMz//8zM/8z/zP/MzP/////M////yH5BAEKAAcALAAA
	AAAQABAAAAMheLrcLTBCd6QV79qlterXB0riOFXmmapraXIvM1IdZTcJADs=
    }]
} -body {
    image create photo gif1 -data $data
} -cleanup {
    catch {image delete gif1}
} -result gif1
test imgPhoto-18.11 {Valid GIF (base 64 string)} -setup {
    set data {
	R0lGODlhEAAQAMIHAAAAADMz//8zM/8z/zP/MzP/////M////yH5BAEKAAcALAAA
	AAAQABAAAAMheLrcLTBCd6QV79qlterXB0riOFXmmapraXIvM1IdZTcJADs=
    }
} -body {
    image create photo gif1 -data $data
} -cleanup {
    catch {image delete gif1}
} -result gif1
test imgPhoto-18.12 {Valid GIF (file)} -setup {
    set fileName [file join [file dirname [info script]] red.gif]
} -body {
    image create photo gif1 -file $fileName
} -cleanup {
    catch {image delete gif1}
} -result gif1

catch {rename foreachPixel {}}
catch {rename checkImgTrans {}}
catch {rename checkImgTransLoop {}}
imageFinish

# cleanup

Added tests/red.gif.

cannot compute difference between binary files