413931 - Crash [@nsGIFDecoder2::DoLzw] when loading GIF file, part 2

Status: VERIFIED FIXED

(Core :: Graphics: ImageLib, defect, P2)

Description

[Martijn Wargers (dead)]

Attachment: gif image that crashes in current trunk build

I had this image stored on my computer. No idea how I got it. Perhaps, I downloaded it from a bug where that image was crashing too in older builds or something.

http://crash-stats.mozilla.com/report/index/e457fab3-cade-11dc-a0db-001a4bd46e84
Frame  	Signature  	Source
0 	nsGIFDecoder2::DoLzw(unsigned char const*) 	mozilla/modules/libpr0n/decoders/gif/nsGIFDecoder2.cpp:614
1 	nsGIFDecoder2::GifWrite(unsigned char const*, unsigned int) 	mozilla/modules/libpr0n/decoders/gif/nsGIFDecoder2.cpp:769
2 	ReadDataOut 	mozilla/modules/libpr0n/decoders/gif/nsGIFDecoder2.cpp:190
3 	nsPipeInputStream::ReadSegments(unsigned int (*)(nsIInputStream*, void*, char const*, unsigned int, unsigned int, unsigned int*), void*, unsigned int, unsigned int*) 	mozilla/xpcom/io/nsPipe3.cpp:799
4 	nsGIFDecoder2::WriteFrom(nsIInputStream*, unsigned int, unsigned int*) 	mozilla/modules/libpr0n/decoders/gif/nsGIFDecoder2.cpp:262
5 	imgRequest::OnDataAvailable(nsIRequest*, nsISupports*, nsIInputStream*, unsigned int, unsigned int) 	mozilla/modules/libpr0n/src/imgRequest.cpp:861
6 	ProxyListener::OnDataAvailable(nsIRequest*, nsISupports*, nsIInputStream*, unsigned int, unsigned int) 	mozilla/modules/libpr0n/src/imgLoader.cpp:877

This wasn't fixed by bug 413373, because I crash in the 2008-01-24 build, but not with the testcase from bug 413373.


This regressed between 2007-06-25 and 2007-06-26:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2007-06-25+04&maxdate=2007-06-26+09&cvsroot=%2Fcvsroot
So I guess a regression from bug 196295.

Comment 1

[Alfred Kayser]

Attachment: Quick fix to prevent crashes on array out of bounds

Another fix to prevent crashes on malformed LZW data in GIF's.

Comment 2

[Alfred Kayser]

Attachment: V2: Remove the cruft from the patch file

Note, the patch is a local diff as I don't have cvs access today

Comment 3

[Stuart Parmenter]

Comment on attachment 299130 [details] [diff] [review]
Quick fix to prevent crashes on array out of bounds

this diff seems to have some issues..

Comment 4

[Alfred Kayser]

This evening (CET time) I will try to upload a real cvs diff

Comment 5

[Mike Beltzner [:beltzner, not reading bugmail]]

Comment on attachment 299131 [details] [diff] [review]
V2: Remove the cruft from the patch file

a=beltzner for 1.9

Comment 6

[Alfred Kayser]

Attachment: V3: correct cvs diff version

Comment 7

[Alfred Kayser]

Attachment: Correct version

Comment 8

[Mike Schroepfer]

Can we get this image in the testsuite as well?

Comment 9

[Reed Loden [:reed]]

Checking in modules/libpr0n/decoders/gif/nsGIFDecoder2.cpp;
/cvsroot/mozilla/modules/libpr0n/decoders/gif/nsGIFDecoder2.cpp,v  <--  nsGIFDecoder2.cpp
new revision: 1.96; previous revision: 1.95
done

Comment 10

[Jeff Walden [:Waldo]]

So who's going to add a crashtest for this (search the tree for examples)?  Alfred?

Comment 11

[Alfred Kayser]

Attachment: This is the specific GIF image that caused this crash

Comment 12

[Alfred Kayser]

Who can put the file of https://bugzilla.mozilla.org/attachment.cgi?id=299702 into the testsuite?

Comment 13

[Justin Dolske [:Dolske]]

I wrote a simple reftest/crashtest the image, but ran into a problem. See bug 414185 for details (marked blocking this one).

Alfred: Is you last attachment the same image as the first attachment in this bug?

Comment 14

[Alfred Kayser]

Yes, it is. There are no other images which display the same bug.

Comment 15

[Martijn Wargers (dead)]

There is another image here, that was fixed by this patch:
http://martijn.martijn.googlepages.com/200px-Rotating_earth_large.gif
But it's a bit large.

Comment 16

[Martijn Wargers (dead)]

Verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b3pre) Gecko/2008012704 Minefield/3.0b3pre