Bug#359661: libimager-perl: 4 channel JPEGs can crash Imager when writing to a scalar

[Tony Cook]

Here's a simpler example that reproduces the problem:

  # 2 or 4 channels, it doesn't matter
  my $im = Imager->new(xsize => 1, ysize => 1, channels => 4);
  my $data;
  # this should fail, but it shouldn't seg fault
  $im->write(data => \$data, type => 'jpeg') or die $im->errstr;

The same problem occurs with 2 channel images written to TGA format
streams:

  my $im = Imager->new(xsize => 1, ysize => 1, channels => 2);
  my $data;
  # this should fail, but it shouldn't seg fault
  $im->write(data => \$data, type => 'tga') or die $im->errstr;

This problem has existed since at least Imager 0.41.

I'll be releasing Imager 0.50 shortly with a fix for this and 2 other
minor problems in 0.49.

I've attached a patch vs Imager 0.44 if you're looking at an update
for stable.

My dev tree already had a different fix for this problem, since
io_glue_commit_types() had become a no-op.

Tony Cook
Imager maintainer

diff -ru Imager-0.44/jpeg.c Imager-0.44-new/jpeg.c
--- Imager-0.44/jpeg.c  2004-12-02 15:08:10.000000000 +1100
+++ Imager-0.44-new/jpeg.c      2006-03-28 10:55:33.000000000 +1000
@@ -413,6 +413,7 @@
   mm_log((1,"i_writejpeg(im %p, ig %p, qfactor %d)\n", im, ig, qfactor));
   
   i_clear_error();
+  io_glue_commit_types(ig);
 
   if (!(im->channels==1 || im->channels==3)) { 
     i_push_error(0, "only 1 or 3 channels images can be saved as JPEG");
@@ -433,7 +434,6 @@
     return 0;
   }
 
-  io_glue_commit_types(ig);
   jpeg_wiol_dest(&cinfo, ig);
 
   cinfo.image_width  = im -> xsize;    /* image width and height, in pixels */
diff -ru Imager-0.44/tga.c Imager-0.44-new/tga.c
--- Imager-0.44/tga.c   2004-12-02 15:08:10.000000000 +1100
+++ Imager-0.44-new/tga.c       2006-03-29 09:09:47.000000000 +1000
@@ -810,6 +810,7 @@
   mm_log((1, "channels %d\n", img->channels));
   
   i_clear_error();
+  io_glue_commit_types(ig);
   
   switch (img->channels) {
   case 1:
@@ -834,7 +835,6 @@
     return 0;
   }
 
-  io_glue_commit_types(ig);
   
   header.idlength;
   header.idlength = idlen;