https://bugs.kde.org/show_bug.cgi?id=527816
Bug ID: 527816
Summary: digiKam crashes when scanning a malformed PGF file
Classification: Applications
Product: digikam
Version First 9.2.0
Reported In:
Platform: Debian testing
OS: Linux
Status: REPORTED
Severity: normal
Priority: NOR
Component: Plugin-DImg-PGF
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
I'm using a recent digiKam 9.2.0 development build on Debian Sid.
While scanning my collection, digiKam crashed on a malformed PGF file from the
Exiv2 test data: `issue_847_poc.pgf` https://github.com/Exiv2/exiv2/issues/847.
OBSERVED RESULT
on a malformed PGF file causes digiKam abort with `free(): invalid pointer`
EXPECTED RESULT
on a malformed PGF file digiKam should skip the invalid file and continue
scanning without crash
The log ends with:
```
digikam.dimg.pgf: Error: Opening and reading PGF image failed ( 10 )!
free(): invalid pointer
Aborted (core dumped)
```
The backtrace points to
`CPGFImage::Destroy()` and
`CPGFImage::~CPGFImage()`, called from
`DImgPGFLoader::load()`.
`Destroy()` uses `m_header.channels` when deleting the channel objects.
If the header is invalid or only partially read, this value can't be trusted.
So here is patch that initializes the channel count and uses `MaxChannels` when
cleaning up the channel pointers.
diff --git a/core/libs/pgfutils/libpgf/PGFimage.cpp
b/core/libs/pgfutils/libpgf/PGFimage.cpp
--- a/core/libs/pgfutils/libpgf/PGFimage.cpp
+++ b/core/libs/pgfutils/libpgf/PGFimage.cpp
@@ -72,6 +72,7 @@ void CPGFImage::Init() {
m_decoder = nullptr;
m_encoder = nullptr;
m_levelLength = nullptr;
+ m_header.channels = 0;
@@ -122,8 +123,9 @@ CPGFImage::~CPGFImage() {
// Destroy internal data structures. Object state after this is the same as
after CPGFImage().
void CPGFImage::Destroy() {
- for (int i = 0; i < m_header.channels; i++) {
+ // The channel count may be invalid if reading the header failed.
+ for (int i = 0; i < MaxChannels; i++) {
delete m_wtChannel[i]; // also deletes m_channel
}
Patch fixes the crash.
--
You are receiving this mail because:
You are watching all bug changes.
