callisto-debian/gimp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

plug-ins: fix a crash in tiff_io_error().

Browse Source 
I had a TIFF file which would crash while triggering an error, inside g_logv()
code (and according to the stacktrace, even probably inside some lower level
printf implementation code).

The reason was that I already processed the variable list with
g_strdup_vprintf() and printf didn't like this va_list being reused, then
segfaulted with some "Cannot access memory at address" error.

The alternate fix was to first copy the va_list in the first use with
va_copy()/G_VA_COPY, yet since we already processed the format data, I thought
it was useless to do this. Let's just directly use the formatted string.
This commit is contained in:
Jehan
2023-02-10 18:58:40 +01:00
parent 2dfe70e16f
commit fb1f16d4b8
1 changed files with 12 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
plug-ins/file-tiff/file-tiff-io.c
View File

@ -278,29 +278,27 @@ tiff_io_error (const gchar *module,
const gchar *fmt,
va_list ap)
{
gchar *msg;
/* Workaround for: http://bugzilla.gnome.org/show_bug.cgi?id=132297
* Ignore the errors related to random access and JPEG compression
*/
if (! strcmp (fmt, "Compression algorithm does not support random access"))
return;
msg = g_strdup_vprintf (fmt, ap);
if (g_strcmp0 (fmt, "Maximum TIFF file size exceeded") == 0)
{
/* @module in my tests were "TIFFAppendToStrip" but I wonder if
* this same error could not happen with other "modules".
*/
tiff_file_size_error = TRUE;
}
/* @module in my tests were "TIFFAppendToStrip" but I wonder if
* this same error could not happen with other "modules".
*/
tiff_file_size_error = TRUE;
else
{
gchar *msg = g_strdup_vprintf (fmt, ap);
/* Easier for debugging to at least print messages on stderr. */
g_printerr ("LibTiff error: [%s] %s\n", module, msg);
/* Easier for debugging to at least print messages on stderr. */
g_printerr ("LibTiff error: [%s] %s\n", module, msg);
g_free (msg);
}
g_logv (G_LOG_DOMAIN, G_LOG_LEVEL_MESSAGE, fmt, ap);
g_log (G_LOG_DOMAIN, G_LOG_LEVEL_MESSAGE, "%s", msg);
g_free (msg);
}
static tsize_t