From e9fc9ea2605337871420f15bb402842cf075e530 Mon Sep 17 00:00:00 2001
From: oehhar <harald.oehlmann@elmicron.de>
Date: Fri, 14 Jun 2024 10:38:21 +0000
Subject: [PATCH 1/2] Ticket [865af0148c] GIF errornously accepted if colormap
 segment is truncated

---
 generic/tkImgGIF.c                 |   8 +++++++-
 tests/corruptTruncatedColormap.gif | Bin 0 -> 10 bytes
 tests/imgPhoto.test                |  17 +++++++++++++++++
 3 files changed, 24 insertions(+), 1 deletion(-)
 create mode 100644 tests/corruptTruncatedColormap.gif

diff --git a/generic/tkImgGIF.c b/generic/tkImgGIF.c
index 3467bd5f45..62fc93579e 100644
--- a/generic/tkImgGIF.c
+++ b/generic/tkImgGIF.c
@@ -466,7 +466,13 @@ FileReadGIF(
      */
 
     if (Fread(gifConfPtr, buf, 1, 3, chan) != 3) {
-	return TCL_OK;
+	/*
+	 * Bug [865af0148c]: 3 bytes should be there, but data ended before
+	 */
+	Tcl_SetObjResult(interp, Tcl_NewStringObj(
+		"GIF file truncated", -1));
+	Tcl_SetErrorCode(interp, "TK", "IMAGE", "GIF", "TRUNCATED", NULL);
+	return TCL_ERROR;
     }
     bitPixel = 2 << (buf[0] & 0x07);
 
diff --git a/tests/corruptTruncatedColormap.gif b/tests/corruptTruncatedColormap.gif
new file mode 100644
index 0000000000000000000000000000000000000000..21d4add9c77f01c5a3260bf2b30d391f2b7daa3e
GIT binary patch
literal 10
RcmZ?wbhEHbOkqf2000iG0&xHU

literal 0
HcmV?d00001

diff --git a/tests/imgPhoto.test b/tests/imgPhoto.test
index 1d3b6e547f..ae1f4737a7 100644
--- a/tests/imgPhoto.test
+++ b/tests/imgPhoto.test
@@ -1349,6 +1349,23 @@ test imgPhoto-18.6 {Reject truncated GIF (file)} -setup {
 } -cleanup {
     catch {image delete gif1}
 } -returnCodes error -result {error reading color map}
+test imgPhoto-18.6.1 {Reject truncated GIF in Colormap - ticket 865af0148c - file} -setup {
+    set fileName [file join [file dirname [info script]] corruptTruncatedColormap.gif]
+} -body {
+    image create photo gif1 -file $fileName
+} -cleanup {
+    catch {image delete gif1}
+} -returnCodes error -result {GIF file truncated}
+test imgPhoto-28.6.2 {Reject truncated GIF in Colormap - ticket 865af0148c - data} -setup {
+    set fileName [file join [file dirname [info script]] corruptTruncatedColormap.gif]
+	set h [open $fileName rb]
+	set d [read $h]
+	close $h
+} -body {
+    image create photo gif1 -data $d
+} -cleanup {
+    catch {image delete gif1}
+} -returnCodes error -result {GIF file truncated}
 test imgPhoto-18.7 {Reject corrupted GIF (> 4Gb) (binary string)} -constraints {
     nonPortable
 } -setup {

From 5c3cbffb42a4122814d4636be170b8ea8eb59467 Mon Sep 17 00:00:00 2001
From: fvogel <fvogelnew1@free.fr>
Date: Fri, 14 Jun 2024 18:26:57 +0000
Subject: [PATCH 2/2] Fix test number and indentation.

---
 tests/imgPhoto.test | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tests/imgPhoto.test b/tests/imgPhoto.test
index a7046ca056..34107cce81 100644
--- a/tests/imgPhoto.test
+++ b/tests/imgPhoto.test
@@ -1311,11 +1311,11 @@ test imgPhoto-18.6.1 {Reject truncated GIF in Colormap - ticket 865af0148c - fil
 } -cleanup {
     catch {image delete gif1}
 } -returnCodes error -result {GIF file truncated}
-test imgPhoto-28.6.2 {Reject truncated GIF in Colormap - ticket 865af0148c - data} -setup {
+test imgPhoto-18.6.2 {Reject truncated GIF in Colormap - ticket 865af0148c - data} -setup {
     set fileName [file join [file dirname [info script]] corruptTruncatedColormap.gif]
-	set h [open $fileName rb]
-	set d [read $h]
-	close $h
+    set h [open $fileName rb]
+    set d [read $h]
+    close $h
 } -body {
     image create photo gif1 -data $d
 } -cleanup {