callisto-debian/gimp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

plug-ins: fix a crash in tiff_io_error().

Browse Source 
I had a TIFF file which would crash while triggering an error, inside g_logv()
code (and according to the stacktrace, even probably inside some lower level
printf implementation code).

The reason was that I already processed the variable list with
g_strdup_vprintf() and printf didn't like this va_list being reused, then
segfaulted with some "Cannot access memory at address" error.

The alternate fix was to first copy the va_list in the first use with
va_copy()/G_VA_COPY, yet since we already processed the format data, I thought
it was useless to do this. Let's just directly use the formatted string.
This commit is contained in:
Jehan
2023-02-10 18:58:40 +01:00
parent 2dfe70e16f
commit fb1f16d4b8
1 changed files with 12 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
plug-ins/file-tiff/file-tiff-io.c
View File

@ -278,29 +278,27 @@ tiff_io_error (const gchar *module,
const gchar *fmt, const gchar *fmt,
va_list ap) va_list ap)
{ {
gchar *msg;
/* Workaround for: http://bugzilla.gnome.org/show_bug.cgi?id=132297 /* Workaround for: http://bugzilla.gnome.org/show_bug.cgi?id=132297
* Ignore the errors related to random access and JPEG compression * Ignore the errors related to random access and JPEG compression
*/ */
if (! strcmp (fmt, "Compression algorithm does not support random access")) if (! strcmp (fmt, "Compression algorithm does not support random access"))
return; return;
msg = g_strdup_vprintf (fmt, ap);
if (g_strcmp0 (fmt, "Maximum TIFF file size exceeded") == 0) if (g_strcmp0 (fmt, "Maximum TIFF file size exceeded") == 0)
{ /* @module in my tests were "TIFFAppendToStrip" but I wonder if
/* @module in my tests were "TIFFAppendToStrip" but I wonder if * this same error could not happen with other "modules".
* this same error could not happen with other "modules". */
*/ tiff_file_size_error = TRUE;
tiff_file_size_error = TRUE;
}
else else
{ /* Easier for debugging to at least print messages on stderr. */
gchar *msg = g_strdup_vprintf (fmt, ap); g_printerr ("LibTiff error: [%s] %s\n", module, msg);
/* Easier for debugging to at least print messages on stderr. */ g_log (G_LOG_DOMAIN, G_LOG_LEVEL_MESSAGE, "%s", msg);
g_printerr ("LibTiff error: [%s] %s\n", module, msg); g_free (msg);
g_free (msg);
}
g_logv (G_LOG_DOMAIN, G_LOG_LEVEL_MESSAGE, fmt, ap);
} }
static tsize_t static tsize_t