Re: address@hidden: Crash when loading a particular gif image]

[Kim F. Storm]

"Göran Uddeborg" <address@hidden> writes:

> Romain Francoise writes:
>> Can you reproduce the bug with the latest Emacs sources from CVS?  Your
>> reports mention Emacs 21.3 an 21.4, this codebase is very old.
>
> I managed to find some time to do this test at last.  Current CVS
> emacs crashes too.
>
> I also tried to understand what the problem is.  The GIF image is
> strange.  Doing identify on it gives this output:
>
> /tmp/poison.gif[0] GIF 450x33 450x33+0+235 PseudoClass 64c 31kb 0.000u 0:01
> /tmp/poison.gif[1] GIF 53x76 450x33+53+116 PseudoClass 64c 31kb 0.000u 0:01
> /tmp/poison.gif[2] GIF 53x75 450x33+53+115 PseudoClass 64c 31kb 0.000u 0:01
> /tmp/poison.gif[3] GIF 59x77 450x33+30+115 PseudoClass 64c 31kb 0.000u 0:01
> /tmp/poison.gif[4] GIF 50x70 450x33+24+122 PseudoClass 64c 31kb 0.000u 0:01
> /tmp/poison.gif[5] GIF 54x71 450x33+20+129 PseudoClass 64c 31kb 0.000u 0:01
>
> I don't know in detail what those sizes attributes represent.  But
> single stepping through gif_load in image.c I note that it first calls
> x_create_x_image_and_pixmap() with width=450 and height=200.  Later on
> it computes image_top to 235.  Thus, in the first loop after the
> assignment of image_top it lets y loop from 0 to 234, and does an
> XPutPixel for each x and y value.  The crash happens with y==200,
> which is the first row not allocated in ximg.
>
> I don't quite understand all aspects here.  But my impression is that
> the bug is indeed in emacs.  It gets fooled somehow by this
> nonstandard GIF image.

Seems so.  Does this patch give good results?

*** image.c     31 Aug 2005 11:18:06 +0200      1.33
--- image.c     27 Sep 2005 23:32:35 +0200      
***************
*** 7369,7376 ****
        return 0;
      }
  
!   width = img->width = max (gif->SWidth, gif->Image.Left + gif->ImageWidth);
!   height = img->height = max (gif->SHeight, gif->Image.Top + 
gif->Image.Height);
  
    /* Create the X image and pixmap.  */
    if (!x_create_x_image_and_pixmap (f, width, height, 0, &ximg, &img->pixmap))
--- 7369,7385 ----
        return 0;
      }
  
!   image_top = gif->SavedImages[ino].ImageDesc.Top;
!   image_left = gif->SavedImages[ino].ImageDesc.Left;
!   image_width = gif->SavedImages[ino].ImageDesc.Width;
!   image_height = gif->SavedImages[ino].ImageDesc.Height;
! 
!   width = img->width = max (gif->SWidth,
!                           max (gif->Image.Left + gif->Image.Width,
!                                image_left + image_width));
!   height = img->height = max (gif->SHeight,
!                             max (gif->Image.Top + gif->Image.Height,
!                                  image_top + image_height));
  
    /* Create the X image and pixmap.  */
    if (!x_create_x_image_and_pixmap (f, width, height, 0, &ximg, &img->pixmap))
***************
*** 7405,7415 ****
       requires more than can be done here (see the gif89 spec,
       disposal methods).  Let's simply assume that the part
       not covered by a sub-image is in the frame's background color.  */
-   image_top = gif->SavedImages[ino].ImageDesc.Top;
-   image_left = gif->SavedImages[ino].ImageDesc.Left;
-   image_width = gif->SavedImages[ino].ImageDesc.Width;
-   image_height = gif->SavedImages[ino].ImageDesc.Height;
- 
    for (y = 0; y < image_top; ++y)
      for (x = 0; x < width; ++x)
        XPutPixel (ximg, x, y, FRAME_BACKGROUND_PIXEL (f));
--- 7414,7419 ----


-- 
Kim F. Storm <address@hidden> http://www.cua.dk