Potential buffer overflow (integer overflow for insane image sizes)

[auriocus]

Here, the size of the image buffer is computed by 32bit signed integer math, which may lead to overflow for insane settings of width and height, or e.g. -scale:

tksvg/generic/tkImgSVG.c

Line 616 in 68cc55d

imgData = (unsigned char *)attemptckalloc(w * h *4);

Due to the integer wrap-around, it may result in the successful allocation of a small buffer. Suggested fix: Use 64bit math, e.g.

(size_t)w * (size_t) h
and check for overflow (painful). Or don't use ckalloc, but malloc.

[oehhar]

Thank you, Christian, great !

May I ask you to continue the discussion on tk core, as the issue is also present there:

https://core.tcl-lang.org/tk/info/822330269bd1da07

Thank you,
Harald

[oehhar]

I hope it is fixed by the following commit:
[https://github.com/oehhar/tksvg/commit/0d31f12f0d238aab9efb5621196ebaca2f22f4ab]

Thank you,
Harald