Security Advisories (4)
CVE-2007-4769 (2008-01-09)

The regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows remote authenticated users to cause a denial of service (backend crash) via an out-of-bounds backref number.

CVE-2018-25032 (2022-03-25)

zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.

CVE-2011-3045 (2012-03-22)

Integer signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as used in Google Chrome before 17.0.963.83 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file, a different vulnerability than CVE-2011-3026.

CVE-2016-10087 (2017-01-30)

The png_set_text_2 function in libpng 0.71 before 1.0.67, 1.2.x before 1.2.57, 1.4.x before 1.4.20, 1.5.x before 1.5.28, and 1.6.x before 1.6.27 allows context-dependent attackers to cause a NULL pointer dereference vectors involving loading a text chunk into a png structure, removing the text, and then adding another text chunk to the structure.

NAME

mkVFunc - Support for "nested" dynamic loading

SYNOPSIS

mkVFunc xxx.h

DESCRIPTION

perl/Tk is designed so that Tk can be dynamically loaded 'on top of' perl. That is the easy bit. What it also does is allow Tk::Xxxx to be dynamically loaded 'on top of' the perl/Tk composite. Thus when you 'require Tk::HList' the shared object .../HList.so needs to be able to call functions defined in perl and functions defined in loadable .../Tk.so . Now functions in 'base executable' are a well known problem, and are solved by DynaLoader. However most of dynamic loading schemes cannot handle one loadable calling another loadable.

Thus what Tk does is build a table of functions that should be callable. This table is auto-generated from the .h file by looking for 'extern' (and EXTERN which is #defined to 'extern'). Thus any function marked as 'extern' is 'referenced' by the table. The address of the table is then stored in a perl variable when Tk is loaded. When HList is loaded it looks in the perl variable (via functions in perl - the 'base executable') to get the address of the table.

The same utility that builds the table also builds a set of #define's. HList.c (and any other .c files which comprise HList) #include these #define's. So that

Tk_SomeFunc(x,y,z)

Is actually compiled as

(*TkVptr->V_Tk_SomeFunc)(x,y,z)

Where Tk_ptr is pointer to the table.

See:

Tk-b*/pTk/mkVFunc - perl script that produces tables
         /tk.h        - basis from which table is generated
         /tk.m        - #define's to include in sub-extension
         /tk_f.h      - #included both sides.
         /tk_f.c      - Actual table definition.
         /tk.t        - 'shared' set of macros which produce table
                        included in tk_f.c and tk_f.h
         /tkVMacro.h  - Wrapper to include *.m files

In addition to /tk* there are /tkInt*, /Lang* and /tix*