Return-Path: owner-tiff@olympiakos.com
Return-Path: <owner-tiff@olympiakos.com>
Received: from localhost (localhost [127.0.0.1])
	by at1895.spb.edu (8.12.0.Beta7/8.12.0.Beta7) with ESMTP id f5G993Qk019448
	for <dron@localhost>; Sat, 16 Jun 2001 13:24:30 +0400
Received: from eudoramail.com [209.185.123.45]
	by localhost with POP3 (fetchmail-5.8.1)
	for dron@localhost (single-drop); Sat, 16 Jun 2001 13:24:30 +0400 (MSD)
Received: from gate7.olympiakos.com ([207.176.88.85]) by shared1-mail.whowhere.com; Fri Jun 15 12:09:01 2001
Received: from localhost (daemon@localhost)
	by gate7.olympiakos.com (8.9.3/8.9.3) with SMTP id OAA18231;
	Fri, 15 Jun 2001 14:48:41 -0400
Received: by gate7.olympiakos.com (bulk_mailer v1.9); Fri, 15 Jun 2001 14:47:08 -0400
Received: (from majordom@localhost)
	by gate7.olympiakos.com (8.9.3/8.9.3) id OAA18113
	for tiff-outgoing; Fri, 15 Jun 2001 14:47:08 -0400
X-Authentication-Warning: gate7.olympiakos.com: majordom set sender to owner-tiff@olympiakos.com using -f
Received: from changeofhabit.mr.itd.umich.edu (changeofhabit.mr.itd.umich.edu [141.211.144.17])
	by gate7.olympiakos.com (8.9.3/8.9.3) with ESMTP id OAA18110
	for <tiff@olympiakos.com>; Fri, 15 Jun 2001 14:47:05 -0400
Received: from nic-131-c76-34.mw.mediaone.net (nic-131-c76-34.mw.mediaone.net [24.131.76.34])
	by changeofhabit.mr.itd.umich.edu (8.9.3/3.2r) with ESMTP id OAA16111
	for <tiff@olympiakos.com>; Fri, 15 Jun 2001 14:47:04 -0400 (EDT)
Date: Fri, 15 Jun 2001 14:45:45 -0400 (EDT)
From: Arnar Mar Hrafnkelsson <addi@umich.edu>
X-Sender: addi@steypa.ast.is
To: tiff@olympiakos.com
Subject: Re: libefence crashes?
In-Reply-To: <Pine.LNX.4.21.0106151414300.4874-100000@steypa.ast.is>
Message-ID: <Pine.LNX.4.21.0106151444080.4874-100000@steypa.ast.is>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=iso-8859-1
X-MIME-Autoconverted: from QUOTED-PRINTABLE to 8bit by gate7.olympiakos.com id OAA18111
Sender: owner-tiff@olympiakos.com
X-MIME-Autoconverted: from 8bit to quoted-printable by gate7.olympiakos.com id OAA18231
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by at1895.spb.edu id f5G993Qk019448
Status: RO
Content-Length: 2312
Lines: 60


The file that causes this is avaliable here:

www.eecs.umich.edu/~addi/tifcrash.tiff


(sorry about forgetting that originally)

-- Arnar



On Fri, 15 Jun 2001, Arnar Mar Hrafnkelsson wrote:

> This is using libtiff 3.5.5
> 
> I had a little problem reading a fax image in my program when I linked
> with efence.  A stack backtrace follows:
> 
> #0  0x401e3f9d in _TIFFFax3fillruns (buf=0x4083bf28 'ÿ' <repeats 200
> times>..., runs=0x4083d4f8, erun=0x4083d500, lastx=1728)
>     at ../libtiff/tif_fax3.c:450
> 450                         cp[0] |= _fillmasks[run]>>bx;
> (gdb) bt
> #0  0x401e3f9d in _TIFFFax3fillruns (buf=0x4083bf28 'ÿ' <repeats 200
> times>..., runs=0x4083d4f8, erun=0x4083d500, lastx=1728)
>     at ../libtiff/tif_fax3.c:450
> #1  0x401e2c50 in Fax3Decode1D (tif=0x4049add0, buf=0x4083bf28 'ÿ'
> <repeats 200 times>..., occ=216, s=0) at ../libtiff/tif_fax3.c:245
> #2  0x401f3da9 in TIFFReadEncodedStrip (tif=0x4049add0, strip=0,
> buf=0x4083a0c8, size=7992) at ../libtiff/tif_read.c:145
> #3  0x401e8307 in gtStripContig (img=0xbffff498, raster=0x407f4900,
> w=1728, h=37) at ../libtiff/tif_getimage.c:588
> #4  0x401e7c15 in TIFFRGBAImageGet (img=0xbffff498, raster=0x407f4900,
> w=1728, h=37) at ../libtiff/tif_getimage.c:369
> #5  0x401ecf4c in TIFFReadRGBAStrip (tif=0x4049add0, row=0,
> raster=0x407f4900) at ../libtiff/tif_getimage.c:1932
> #6  0x401c76e1 in i_readtiff_wiol () from
> /u02/Imager-next/devel/blib/arch/auto/Imager/Imager.so
> #7  0x401ac90a in XS_Imager_i_readtiff_wiol () from
> /u02/Imager-next/devel/blib/arch/auto/Imager/Imager.so
> #8  0x80894d8 in Perl_pp_entersub ()
> #9  0x80b498d in Perl_runops_standard ()
> #10 0x8059338 in perl_run ()
> #11 0x80577e1 in main ()
> #12 0x400689cb in __libc_start_main (main=0x8057770 <main>, argc=4,
> argv=0xbffffaf4, init=0x8056a94 <_init>, fini=0x80b4a2c <_fini>, 
>     rtld_fini=0x4000ae60 <_dl_fini>, stack_end=0xbffffaec) at
> ../sysdeps/generic/libc-start.c:92
> 
> 
> 
> It crashes at line 450 in libtiff/tif_fax3.c .  It seems to involve some
> of those variables that purify (as the comment in the file talks
> about) complains about.  The comment about purify says the code is
> harmless.  Is this a real bounds problem or is something else going wrong?
> This was using ElectricFence-2.2.2.
> 
> -- Arnar.
> 

