Return-Path: <tiff-bounces@remotesensing.org>
Received: from inav006.isp.belgacom.be (inav006.isp.belgacom.be [195.238.2.75])
        by mailst034.isp.belgacom.be (8.12.11/8.12.11/Skynet-MAILSTORE-2.14) with ESMTP id i9H3lLXb007136
        for <joris.at.lebbeke@skynet.be>; Sun, 17 Oct 2004 05:47:21 +0200
        (envelope-from <tiff-bounces@remotesensing.org>)
Received: from inas004.isp.belgacom.be (localhost [127.0.0.1])
        by inav006.isp.belgacom.be (8.12.11/8.12.11/Skynet-IN-AV-3.00) with ESMTP id i9H3lDe4006879
        for <joris.at.lebbeke@skynet.be>; Sun, 17 Oct 2004 05:47:13 +0200
        (envelope-from <tiff-bounces@remotesensing.org>)
Received: from inmx006.isp.belgacom.be (inmx006.isp.belgacom.be [195.238.2.106])
        by inas004.isp.belgacom.be (8.12.11/8.12.11/Skynet-IN-AS-2.03) with ESMTP id i9H3l2FC004753
        for <joris.at.lebbeke@skynet.be>; Sun, 17 Oct 2004 05:47:02 +0200
        (envelope-from <tiff-bounces@remotesensing.org>)
Received: from xserve.flids.com (adsl-065-083-169-202.sip.mco.bellsouth.net [65.83.169.202])
        by inmx006.isp.belgacom.be (8.12.11/8.12.11/Skynet-IN-2.32) with ESMTP id i9H3kmwn022497
        for <joris.at.lebbeke@skynet.be>; Sun, 17 Oct 2004 05:46:50 +0200
        (envelope-from <tiff-bounces@remotesensing.org>)
Received: from adsl-065-083-169-202.sip.mco.bellsouth.net (localhost [127.0.0.1])
	by xserve.flids.com (Postfix) with ESMTP
	id 034903C3A55; Sat, 16 Oct 2004 23:46:08 -0400 (EDT)
X-Original-To: tiff@remotesensing.org
Delivered-To: tiff@remotesensing.org
Received: from mail.viasys.com (herkules.viasys.com [194.100.28.129])
	by xserve.flids.com (Postfix) with SMTP id 0B2763B4142
	for <tiff@remotesensing.org>; Thu, 14 Oct 2004 04:00:00 -0400 (EDT)
Received: (qmail 18344 invoked by uid 9038); 14 Oct 2004 07:59:55 -0000
Received: from 194.100.28.161 by herkules.viasys.com (envelope-from
	<vherva@ENIGMA.viasys.com>, uid 101) with qmail-scanner-1.23 
	(f-prot: 4.3.4/3.14.8/SIGN.DEF 13 October 2004/SIGN2.DEF 13 October
	2004/MACRO.DEF 11 October 2004. spamassassin: 3.0.0-pre4. 
	Clear:RC:1(194.100.28.161):. 
	Processed in 0.042912 secs); 14 Oct 2004 07:59:55 -0000
X-Qmail-Scanner-Mail-From: vherva@ENIGMA.viasys.com via herkules.viasys.com
X-Qmail-Scanner: 1.23 (Clear:RC:1(194.100.28.161):. Processed in 0.042912 secs)
Received: from enigma.viasys.com (194.100.28.161)
	by herkules.viasys.com with SMTP; 14 Oct 2004 07:59:54 -0000
Received: by ENIGMA.viasys.com (sSMTP sendmail emulation);
	Thu, 14 Oct 2004 10:58:40 +0300
From: "Ville Herva" <vherva@ENIGMA.viasys.com>
Date: Thu, 14 Oct 2004 10:58:40 +0300
To: tiff@remotesensing.org
Message-ID: <20041014075840.GA4192@viasys.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.4.1i
X-Operating-System: CYGWIN_NT-5.1 enigma 1.5.11(0.116/4/2) 2004-09-04 23:17
	i686 unknown unknown Cygwin
X-Mailman-Approved-At: Sat, 16 Oct 2004 23:46:05 -0400
Subject: [Tiff] WIN32 _TIFFrealloc() bug?
X-BeenThere: tiff@remotesensing.org
X-Mailman-Version: 2.1.2
Precedence: list
Reply-To: vherva@viasys.com
List-Id: TIFF and libtiff discussion  <tiff.remotesensing.org>
List-Unsubscribe: <http://xserve.flids.com/mailman/listinfo/tiff>,
	<mailto:tiff-request@remotesensing.org?subject=unsubscribe>
List-Archive: <http://xserve.flids.com/pipermail/tiff>
List-Post: <mailto:tiff@remotesensing.org>
List-Help: <mailto:tiff-request@remotesensing.org?subject=help>
List-Subscribe: <http://xserve.flids.com/mailman/listinfo/tiff>,
	<mailto:tiff-request@remotesensing.org?subject=subscribe>
Sender: tiff-bounces@remotesensing.org
Errors-To: tiff-bounces@remotesensing.org
X-UIDL: a807207ea15781a3b7eb9616a6867dd4

[I'll appreciate Cc'ing me, but I will read the archive]

Hi, 

When opening an image on WIN32, libtiff-3.6.1 does:

GlobalSize(NULL)
_TIFFrealloc(void * 0x00000000, long 4) line 237
TIFFReadDirectory(tiff * 0x001b5ec8) line 112 + 25 bytes
TIFFClientOpen(const char * 0x009d4934, const char * 0x009d4920, thandle_t__ * 0x00000000, long (thandle_t__ *, void *, long)* 0x00627caa _tiffFileReadProc(thandle_t__ *, void *, long), long (thandle_t__ *, void *, long)* 0x00627cd1 _tiffFileWriteProc(thandle_t__ *, void *, long), unsigned long (thandle_t__ *, unsigned long, int)* ...) line 367 + 9 bytes
iTIFFOpen(char * 0x009d4920) line 669 + 51 bytes

in _TIFFrealloc() there's this GlobalSize() call:

tdata_t
_TIFFrealloc(tdata_t p, tsize_t s)
{
  void* pvTmp;
  tsize_t old=GlobalSize(p);
  if (old>=s)
    {
      if ((pvTmp = GlobalAlloc(GMEM_FIXED, s)) != NULL) {
	CopyMemory(pvTmp, p, s);
	GlobalFree(p);
      }
    }
  else
    {
      if ((pvTmp = GlobalAlloc(GMEM_FIXED, s)) != NULL) {
	CopyMemory(pvTmp, p, old);
	GlobalFree(p);
      }
    }
  return ((tdata_t)pvTmp);
}

called from TIFFReadDirectory():

	tif->tif_dirlist = _TIFFrealloc(tif->tif_dirlist,
					tif->tif_dirnumber * sizeof(toff_t));

Now, after TIFFClientOpen() the tif->tif_dirlist part of the tif structure
may still be initialized to 0. This results into GlobalSize(0) call, which
afaict is illegal, and seems to crash at least some of the time. Judging
from the _TIFFrealloc() implementations for other architectures
(tif_unix.c), I presume _TIFFrealloc() API is meant to accept a NULL pointer
like the standard realloc().

Should the line perhaps read:

  tsize_t old=p != 0 ? GlobalSize(p) : 0;

and maybe also

-        CopyMemory(pvTmp, p, old);                       
+        if (old!=0) CopyMemory(pvTmp, p, old);                       

Comments?


-- v --

v@iki.fi
_______________________________________________
Tiff mailing list
Tiff@remotesensing.org
http://xserve.flids.com/mailman/listinfo/tiff
