[Tcl-bugs] [ tktoolkit-Bugs-877950 ] wish crash using [image]

[SourceForge.net <no...@so...>]

Bugs item #877950, was opened at 2004-01-16 02:47
Message generated for change (Comment added) made by obermeier
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=112997&aid=877950&group_id=12997

Category: 41. Photo Images
Group: current: 8.4.5
Status: Open
Resolution: None
Priority: 9
Submitted By: Rolf Ade (pointsman)
Assigned to: Donal K. Fellows (dkf)
Summary: wish crash using [image]

Initial Comment:

The following code does not make much sense, but it
crashes wish8.4.5 for me (on linux) if called with the
attached gif.

set image [image create photo]
$image read $argv
$image copy $image     -from 0 0 [image width $image] [image height $image]     -to [expr {[image width $image] / 2}] 0

Expected behavior: tcl error msg or TCL_OK (with
whatever sideeffect on the picture), not seg fault.

Valgrind says:
==26779== Invalid read of size 1
==26779==    at 0x402E8115: Tk_PhotoPutBlock
(/home/rolf/tcltk/tk8.4.5/generic/tkImgPhoto.c:4340)
==26779==    by 0x402E85B9: Tk_PhotoPutZoomedBlock
(/home/rolf/tcltk/tk8.4.5/generic/tkImgPhoto.c:4542)
==26779==    by 0x402E1B50: ImgPhotoCmd
(/home/rolf/tcltk/tk8.4.5/generic/tkImgPhoto.c:887)
==26779==    by 0x403480A2: TclEvalObjvInternal
(../generic/tclBasic.c:3087)
==26779==    Address 0x42C6D027 is not stack'd,
malloc'd or free'd
==26779== 
etc.


----------------------------------------------------------------------

Comment By: Paul Obermeier (obermeier)
Date: 2004-01-17 17:21

Message:
Logged In: YES 
user_id=155391

One has to check, if source and destination image are the
same. This check is already done in 
Tk_PhotoPutZoomedBlock, and should be 
added to Tk_PhotoPutBlock like outlined below.
What's missing in Tk_PhotoPutZoomedBlock is the adjustment 
of width, height and pitch of the blockPtr structure.

void
Tk_PhotoPutBlock(handle, blockPtr, x, y, width, height, 
compRule)
...
        if ((xEnd > masterPtr->width) || (yEnd > masterPtr-
>height)) {
	/* If source image (blockPtr->pixelPtr) and 
destination image
	   (masterPtr->pix32) are the same, and we do a 
resize of the
           destination image, we have to correct the pointer to 
the source
           image as well as it's width, height and pitch.
	   We must do this check before calling 
ImgPhotoSetSize, because
	   masterPtr->pix32 might be changed inside this 
function.
	*/
    
	int sameSrc = (masterPtr->pix32 == blockPtr-
>pixelPtr);
	if (ImgPhotoSetSize(masterPtr, MAX(xEnd, 
masterPtr->width),
		MAX(yEnd, masterPtr->height)) == 
TCL_ERROR) {
	    panic(TK_PHOTO_ALLOC_FAILURE_MESSAGE);
	}
	if (sameSrc) {
	    blockPtr->pixelPtr = masterPtr->pix32;
	    blockPtr->width    = masterPtr->width;
	    blockPtr->height   = masterPtr->height;
	    blockPtr->pitch    = masterPtr->width * 4;
	}
    }

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=112997&aid=877950&group_id=12997