Tk Source Code

Note, that the crash also happens with Tk 9.0.3.

tkImg is not affected, as it uses a single function for reading ByteArrays, which checks the return value:

int tkimg_ReadInitString(
        tkimg_Stream *handle,
        Tcl_Obj *dataObj
) {
    Tcl_Size length;

    handle->data = Tcl_GetByteArrayFromObj(dataObj, &length);
    if (! handle->data) {
        return 0;
    }
    ...
}

In the branch bug-f0b3fa9f66 I've commited a fix for the script firing the crash, but I suspect the same problem could affect other parts of the code. Also, TkImg is a candidate to be an affected extension.

A strange bit is this difference in the error message between 8 and 9 (after patching):

$ wish9.1 
% image create photo -data \u0100   
invalid color name "Ā"
% 
$ wish8.6 
% image create photo -data \u0100
couldn't recognize image data
%