Security Advisories (6)
CVE-2007-4769 (2008-01-09)

The regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows remote authenticated users to cause a denial of service (backend crash) via an out-of-bounds backref number.

CVE-2018-25032 (2022-03-25)

zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.

CVE-2011-3045 (2012-03-22)

Integer signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as used in Google Chrome before 17.0.963.83 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file, a different vulnerability than CVE-2011-3026.

CVE-2016-10087 (2017-01-30)

The png_set_text_2 function in libpng 0.71 before 1.0.67, 1.2.x before 1.2.57, 1.4.x before 1.4.20, 1.5.x before 1.5.28, and 1.6.x before 1.6.27 allows context-dependent attackers to cause a NULL pointer dereference vectors involving loading a text chunk into a png structure, removing the text, and then adding another text chunk to the structure.

CVE-2007-4772 (2008-01-09)

The regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows context-dependent attackers to cause a denial of service (infinite loop) via a crafted regular expression.

CVE-2007-6067 (2008-01-09)

Algorithmic complexity vulnerability in the regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows remote authenticated users to cause a denial of service (memory consumption) via a crafted "complex" regular expression with doubly-nested states.

NAME

Tk_Preserve, Tk_Release, Tk_EventuallyFree - avoid freeing storage while it's being used

SYNOPSIS

#include <tk.h>

Tk_Preserve(clientData)

Tk_Release(clientData)

Tk_EventuallyFree(clientData, freeProc)

ARGUMENTS

ClientData clientData (in)

Token describing structure to be freed or reallocated. Usually a pointer to memory for structure.

Tk_FreeProc *freeProc (in)

Procedure to invoke to free clientData.

DESCRIPTION

These three procedures help implement a simple reference count mechanism for managing storage. They are designed to solve a problem having to do with widget deletion. When a widget is deleted, its widget record (the structure holding information specific to the widget) must be returned to the storage allocator. However, it's possible that the widget record is in active use by one of the procedures on the stack at the time of the deletion. This can happen, for example, if the command associated with a button widget causes the button to be destroyed: an X event causes an event-handling C procedure in the button to be invoked, which in turn causes the button's associated Tcl command to be executed, which in turn causes the button to be deleted, which in turn causes the button's widget record to be de-allocated. Unfortunately, when the Tcl command returns, the button's event-handling procedure will need to reference the button's widget record. Because of this, the widget record must not be freed as part of the deletion, but must be retained until the event-handling procedure has finished with it. In other situations where the widget is deleted, it may be possible to free the widget record immediately.

Tk_Preserve and Tk_Release implement short-term reference counts for their clientData argument. The clientData argument identifies an object and usually consists of the address of a structure. The reference counts guarantee that an object will not be freed until each call to Tk_Preserve for the object has been matched by calls to Tk_Release. There may be any number of unmatched Tk_Preserve calls in effect at once.

Tk_EventuallyFree is invoked to free up its clientData argument. It checks to see if there are unmatched Tk_Preserve calls for the object. If not, then Tk_EventuallyFree calls freeProc immediately. Otherwise Tk_EventuallyFree records the fact that clientData needs eventually to be freed. When all calls to Tk_Preserve have been matched with calls to Tk_Release then freeProc will be called by Tk_Release to do the cleanup.

All the work of freeing the object is carried out by freeProc. FreeProc must have arguments and result that match the type Tk_FreeProc:

typedef void Tk_FreeProc(ClientData clientData);

The clientData argument to freeProc will be the same as the clientData argument to Tk_EventuallyFree.

This mechanism can be used to solve the problem described above by placing Tk_Preserve and Tk_Release calls around actions that may cause undesired storage re-allocation. The mechanism is intended only for short-term use (i.e. while procedures are pending on the stack); it will not work efficiently as a mechanism for long-term reference counts. The implementation does not depend in any way on the internal structure of the objects being freed; it keeps the reference counts in a separate structure.

KEYWORDS

free, reference count, storage