Bug #27668 for Imager: Crashes reading animated gifs

On Wed Jun 20 18:09:55 2007, mb@imp.ch wrote: Show quoted text
Hi, This looks like a failure path, since free_images() is normally called to release any already read in images when returning a failure of some sort. Reading a normal valid animated GIF normally doesn't cause any problems, as Imager reads those as part of its test suite. Could you please provide: - the GIF (or some GIF) file that produces the problem above - the platform (eg. FreeBSD 6.2) - whether you're using giflib or libungif and which version Thanks Tony

Hi, Show quoted text
It's not that easy. We don't have the gifs available since those are embeeded in mails, which tempfail. I'll try to catch one, but its difficult. Platform is FreeBSD 6.2, libungif 4.1.4 Of course I've got more coredumps available, we get 10-20 crashes the day. This is another crash path: (gdb) frame 4 #4 0x2855efb3 in i_readgif_multi_low (GifFile=0xdb2f040, count=0xbfbfe4e8, page=-1) at gif.c:700 700 free_images(results, *count); (gdb) list 695 else { 696 for (i = 0; i < Height; i++) { 697 if (DGifGetLine(GifFile, GifRow, Width) == GIF_ERROR) { 698 gif_push_error(); 699 i_push_error(0, "Reading GIF line"); 700 free_images(results, *count); 701 DGifCloseFile(GifFile); 702 myfree(GifRow); 703 return NULL; 704 } (gdb) p **results $7 = {channels = 0, xsize = 0, ysize = 0, bytes = 23472, ch_mask = 4294967295, bits = i_8_bits, type = i_palette_type, virtual = 0, idata = 0x0, tags = { count = 14, alloc = 20, tags = 0x8073200}, ext_data = 0x0, i_f_ppix = 0x2853f464 <i_ppix_d>, i_f_ppixf = 0x2853fccc <i_ppixf_fp>, i_f_plin = 0x2853f5e4 <i_plin_d>, i_f_plinf = 0x2853fdac <i_plinf_fp>, i_f_gpix = 0x2853f4d4 <i_gpix_d>, i_f_gpixf = 0x2853fd44 <i_gpixf_fp>, i_f_glin = 0x2853f54c <i_glin_d>, i_f_glinf = 0x2853fed0 <i_glinf_fp>, i_f_gsamp = 0x2854f3d8 <i_gsamp_p>, i_f_gsampf = 0x2853ffd0 <i_gsampf_fp>, i_f_gpal = 0x2854f530 <i_gpal_p>, i_f_ppal = 0x2854f590 <i_ppal_p>, i_f_addcolors = 0x2854f5f0 <i_addcolors_p>, i_f_getcolors = 0x2854f640 <i_getcolors_p>, i_f_colorcount = 0x2854f6c4 <i_colorcount_p>, i_f_maxcolors = 0x2854f6d4 <i_maxcolors_p>, i_f_findcolor = 0x2854f73c <i_findcolor_p>, i_f_setcolors = 0x2854f6e4 <i_setcolors_p>, i_f_destroy = 0x2854f128 <i_destroy_p>} (gdb) p *results[0] $8 = {channels = 0, xsize = 0, ysize = 0, bytes = 23472, ch_mask = 4294967295, bits = i_8_bits, type = i_palette_type, virtual = 0, idata = 0x0, tags = { count = 14, alloc = 20, tags = 0x8073200}, ext_data = 0x0, i_f_ppix = 0x2853f464 <i_ppix_d>, i_f_ppixf = 0x2853fccc <i_ppixf_fp>, i_f_plin = 0x2853f5e4 <i_plin_d>, i_f_plinf = 0x2853fdac <i_plinf_fp>, i_f_gpix = 0x2853f4d4 <i_gpix_d>, i_f_gpixf = 0x2853fd44 <i_gpixf_fp>, i_f_glin = 0x2853f54c <i_glin_d>, i_f_glinf = 0x2853fed0 <i_glinf_fp>, i_f_gsamp = 0x2854f3d8 <i_gsamp_p>, i_f_gsampf = 0x2853ffd0 <i_gsampf_fp>, i_f_gpal = 0x2854f530 <i_gpal_p>, i_f_ppal = 0x2854f590 <i_ppal_p>, i_f_addcolors = 0x2854f5f0 <i_addcolors_p>, i_f_getcolors = 0x2854f640 <i_getcolors_p>, i_f_colorcount = 0x2854f6c4 <i_colorcount_p>, i_f_maxcolors = 0x2854f6d4 <i_maxcolors_p>, i_f_findcolor = 0x2854f73c <i_findcolor_p>, i_f_setcolors = 0x2854f6e4 <i_setcolors_p>, i_f_destroy = 0x2854f128 <i_destroy_p>} (gdb) p *results[1] $9 = {channels = 0, xsize = 0, ysize = 0, bytes = 23472, ch_mask = 4294967295, bits = i_8_bits, type = i_palette_type, virtual = 0, idata = 0x0, tags = { count = 13, alloc = 20, tags = 0x8073400}, ext_data = 0x0, i_f_ppix = 0x2853f464 <i_ppix_d>, i_f_ppixf = 0x2853fccc <i_ppixf_fp>, i_f_plin = 0x2853f5e4 <i_plin_d>, i_f_plinf = 0x2853fdac <i_plinf_fp>, i_f_gpix = 0x2853f4d4 <i_gpix_d>, i_f_gpixf = 0x2853fd44 <i_gpixf_fp>, i_f_glin = 0x2853f54c <i_glin_d>, i_f_glinf = 0x2853fed0 <i_glinf_fp>, i_f_gsamp = 0x2854f3d8 <i_gsamp_p>, i_f_gsampf = 0x2853ffd0 <i_gsampf_fp>, i_f_gpal = 0x2854f530 <i_gpal_p>, i_f_ppal = 0x2854f590 <i_ppal_p>, i_f_addcolors = 0x2854f5f0 <i_addcolors_p>, i_f_getcolors = 0x2854f640 <i_getcolors_p>, i_f_colorcount = 0x2854f6c4 <i_colorcount_p>, i_f_maxcolors = 0x2854f6d4 <i_maxcolors_p>, i_f_findcolor = 0x2854f73c <i_findcolor_p>, i_f_setcolors = 0x2854f6e4 <i_setcolors_p>, i_f_destroy = 0x2854f128 <i_destroy_p>} (gdb) p *results[2] $10 = {channels = 269488144, xsize = 269488144, ysize = 269488144, bytes = 269488144, ch_mask = 269488144, bits = 269488144, type = 269488144, virtual = 269488144, idata = 0x10101010 <Address 0x10101010 out of bounds>, tags = {count = 269488144, alloc = 269488144, tags = 0x10101010}, ext_data = 0x10101010, i_f_ppix = 0x10101010, i_f_ppixf = 0x10101010, i_f_plin = 0x10101010, i_f_plinf = 0x10101010, i_f_gpix = 0x10101010, i_f_gpixf = 0x10101010, i_f_glin = 0x10101010, i_f_glinf = 0x10101010, i_f_gsamp = 0x10101010, i_f_gsampf = 0x10101010, i_f_gpal = 0x10101010, i_f_ppal = 0x10101010, i_f_addcolors = 0x10101010, i_f_getcolors = 0x10101010, i_f_colorcount = 0x10101010, i_f_maxcolors = 0x10101010, i_f_findcolor = 0x10101010, i_f_setcolors = 0x10101010, i_f_destroy = 0x10101010} (gdb) p *results[3] $11 = {channels = 225247008, xsize = 0, ysize = 225247024, bytes = 3, ch_mask = 0, bits = 225247040, type = i_direct_type, virtual = 0, idata = 0x0, tags = {count = 142, alloc = 225247056, tags = 0x0}, ext_data = 0x0, i_f_ppix = 0, i_f_ppixf = 0x2, i_f_plin = 0xd6cff60, i_f_plinf = 0, i_f_gpix = 0, i_f_gpixf = 0, i_f_glin = 0, i_f_glinf = 0xd98c2a0, i_f_gsamp = 0, i_f_gsampf = 0, i_f_gpal = 0, i_f_ppal = 0x1c5, i_f_addcolors = 0xd98c2c0, i_f_getcolors = 0, i_f_colorcount = 0, i_f_maxcolors = 0, i_f_findcolor = 0x54, i_f_setcolors = 0xd6cff70, i_f_destroy = 0} (gdb) p *results[4] Cannot access memory at address 0x6000 (gdb) p *results[5] Cannot access memory at address 0x42 -- Martin

Hi, Hrmpf. After more investigations, I guess I found the problem. It was a local patch I added in version 0.48 and it was partly done wrong. Sorry for the noise. It I get other crashes with some pics I'll let you know. You can close this PR. -- Martin