Return-Path: <tiff-bounces@remotesensing.org>
Received: from inav006.isp.belgacom.be (inav006.isp.belgacom.be [195.238.2.75])
        by mailst034.isp.belgacom.be (8.12.11/8.12.11/Skynet-MAILSTORE-2.14) with ESMTP id i9HGmptQ005931
        for <joris.at.lebbeke@skynet.be>; Sun, 17 Oct 2004 18:48:53 +0200
        (envelope-from <tiff-bounces@remotesensing.org>)
Received: from inas012.isp.belgacom.be (localhost [127.0.0.1])
        by inav006.isp.belgacom.be (8.12.11/8.12.11/Skynet-IN-AV-3.00) with ESMTP id i9HGmk22030723
        for <joris.at.lebbeke@skynet.be>; Sun, 17 Oct 2004 18:48:46 +0200
        (envelope-from <tiff-bounces@remotesensing.org>)
Received: from inmx010.isp.belgacom.be (inmx010.isp.belgacom.be [195.238.2.73])
        by inas012.isp.belgacom.be (8.12.11/8.12.11/Skynet-IN-AS-2.03) with ESMTP id i9HGmcV7010001
        for <joris.at.lebbeke@skynet.be>; Sun, 17 Oct 2004 18:48:39 +0200
        (envelope-from <tiff-bounces@remotesensing.org>)
Received: from xserve.flids.com (adsl-065-083-169-202.sip.mco.bellsouth.net [65.83.169.202])
        by inmx010.isp.belgacom.be (8.12.11/8.12.11/Skynet-IN-2.32) with ESMTP id i9HGmVaf014634
        for <joris.at.lebbeke@skynet.be>; Sun, 17 Oct 2004 18:48:33 +0200
        (envelope-from <tiff-bounces@remotesensing.org>)
Received: from adsl-065-083-169-202.sip.mco.bellsouth.net (localhost [127.0.0.1])
	by xserve.flids.com (Postfix) with ESMTP
	id 8AA933C5FF0; Sun, 17 Oct 2004 12:48:12 -0400 (EDT)
X-Original-To: tiff@remotesensing.org
Delivered-To: tiff@remotesensing.org
Received: from mail1.vcmails.com (mail1.vcmails.com [67.97.234.236])
	by xserve.flids.com (Postfix) with SMTP id A458E3C5FDF
	for <tiff@remotesensing.org>; Sun, 17 Oct 2004 12:48:10 -0400 (EDT)
Received: (qmail 4199 invoked from network); 17 Oct 2004 15:37:17 -0000
Received: from unknown (HELO toshi) (4.159.59.151)
	by mail1.vcmails.com with SMTP; 17 Oct 2004 15:37:17 -0000
From: "Larry Grill" <larry@nuglyphix.com>
To: "TIFFLIB" <tiff@remotesensing.org>, <vherva@viasys.com>
Subject: RE: [Tiff] WIN32 _TIFFrealloc() bug?
Date: Sun, 17 Oct 2004 11:47:40 -0500
Message-ID: <EGEELFLLNIGMPKHJFEEECELADCAA.larry@nuglyphix.com>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0)
In-Reply-To: <20041014075840.GA4192@viasys.com>
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
Cc: 
X-BeenThere: tiff@remotesensing.org
X-Mailman-Version: 2.1.2
Precedence: list
List-Id: TIFF and libtiff discussion  <tiff.remotesensing.org>
List-Unsubscribe: <http://xserve.flids.com/mailman/listinfo/tiff>,
	<mailto:tiff-request@remotesensing.org?subject=unsubscribe>
List-Archive: <http://xserve.flids.com/pipermail/tiff>
List-Post: <mailto:tiff@remotesensing.org>
List-Help: <mailto:tiff-request@remotesensing.org?subject=help>
List-Subscribe: <http://xserve.flids.com/mailman/listinfo/tiff>,
	<mailto:tiff-request@remotesensing.org?subject=subscribe>
Sender: tiff-bounces@remotesensing.org
Errors-To: tiff-bounces@remotesensing.org
X-UIDL: c36fbba4c846b96d98717f2211c291d3

Hi,
I thought this one was fixed in the general release some time ago. If you
search the message archive you should find the same topic from me, but if
you change the TIFFrealloc method this way, it will be fine. This is
corrected in the 3.7 release.

tdata_t
_TIFFrealloc(tdata_t p, tsize_t s)
{
  void* pvTmp;
  tsize_t old;

  if(p==NULL)
    return ((tdata_t)GlobalAlloc(GMEM_FIXED, s));

  old = GlobalSize(p);

  if (old>=s)
  {
    if ((pvTmp = GlobalAlloc(GMEM_FIXED, s)) != NULL) {
      CopyMemory(pvTmp, p, s);
      GlobalFree(p);
    }
  }
  else
  {
    if ((pvTmp = GlobalAlloc(GMEM_FIXED, s)) != NULL) {
      CopyMemory(pvTmp, p, old);
      GlobalFree(p);
    }
  }
  return ((tdata_t)pvTmp);
}

Larry M. Grill
larry@nuglyphix.com
www.nuglyphix.com

> -----Original Message-----
> From: tiff-bounces@remotesensing.org
> [mailto:tiff-bounces@remotesensing.org]On Behalf Of Ville Herva
> Sent: Thursday, October 14, 2004 2:59 AM
> To: tiff@remotesensing.org
> Subject: [Tiff] WIN32 _TIFFrealloc() bug?
>
>
> [I'll appreciate Cc'ing me, but I will read the archive]
>
> Hi,
>
> When opening an image on WIN32, libtiff-3.6.1 does:
>
> GlobalSize(NULL)
> _TIFFrealloc(void * 0x00000000, long 4) line 237
> TIFFReadDirectory(tiff * 0x001b5ec8) line 112 + 25 bytes
> TIFFClientOpen(const char * 0x009d4934, const char * 0x009d4920,
> thandle_t__ * 0x00000000, long (thandle_t__ *, void *, long)*
> 0x00627caa _tiffFileReadProc(thandle_t__ *, void *, long), long
> (thandle_t__ *, void *, long)* 0x00627cd1
> _tiffFileWriteProc(thandle_t__ *, void *, long), unsigned long
> (thandle_t__ *, unsigned long, int)* ...) line 367 + 9 bytes
> iTIFFOpen(char * 0x009d4920) line 669 + 51 bytes
>
> in _TIFFrealloc() there's this GlobalSize() call:
>
> tdata_t
> _TIFFrealloc(tdata_t p, tsize_t s)
> {
>   void* pvTmp;
>   tsize_t old=GlobalSize(p);
>   if (old>=s)
>     {
>       if ((pvTmp = GlobalAlloc(GMEM_FIXED, s)) != NULL) {
> 	CopyMemory(pvTmp, p, s);
> 	GlobalFree(p);
>       }
>     }
>   else
>     {
>       if ((pvTmp = GlobalAlloc(GMEM_FIXED, s)) != NULL) {
> 	CopyMemory(pvTmp, p, old);
> 	GlobalFree(p);
>       }
>     }
>   return ((tdata_t)pvTmp);
> }
>
> called from TIFFReadDirectory():
>
> 	tif->tif_dirlist = _TIFFrealloc(tif->tif_dirlist,
> 					tif->tif_dirnumber *
> sizeof(toff_t));
>
> Now, after TIFFClientOpen() the tif->tif_dirlist part of the tif structure
> may still be initialized to 0. This results into GlobalSize(0) call, which
> afaict is illegal, and seems to crash at least some of the time. Judging
> from the _TIFFrealloc() implementations for other architectures
> (tif_unix.c), I presume _TIFFrealloc() API is meant to accept a
> NULL pointer
> like the standard realloc().
>
> Should the line perhaps read:
>
>   tsize_t old=p != 0 ? GlobalSize(p) : 0;
>
> and maybe also
>
> -        CopyMemory(pvTmp, p, old);
> +        if (old!=0) CopyMemory(pvTmp, p, old);
>
> Comments?
>
>
> -- v --
>
> v@iki.fi
> _______________________________________________
> Tiff mailing list
> Tiff@remotesensing.org
> http://xserve.flids.com/mailman/listinfo/tiff
>
>


_______________________________________________
Tiff mailing list
Tiff@remotesensing.org
http://xserve.flids.com/mailman/listinfo/tiff
