Fix out of bounds read in backend_tk.

anntzer · anntzer · commit 7ba3ea913f55 · 2019-06-06T11:40:48.000+02:00
Really, we should specify somewhere how rounding of bboxes passed to
blit() (and to copy_from_bbox()) works, but at least this patch will
avoid out-of-bounds reads in the tk blit.
diff --git a/lib/matplotlib/backends/_backend_tk.py b/lib/matplotlib/backends/_backend_tk.py
@@ -67,8 +67,11 @@ def blit(photoimage, aggimage, offsets, bbox=None):
     dataptr = (height, width, data.ctypes.data)
     if bbox is not None:
         (x1, y1), (x2, y2) = bbox.__array__()
-        bboxptr = (math.floor(x1), math.ceil(x2),
-                   math.floor(y1), math.ceil(y2))
+        x1 = max(math.floor(x1), 0)
+        x2 = min(math.ceil(x2), width)
+        y1 = max(math.floor(y1), 0)
+        y2 = min(math.ceil(y2), height)
+        bboxptr = (x1, x2, y1, y2)
     else:
         photoimage.blank()
         bboxptr = (0, width, 0, height)
