Patch for vtkJPEGReader

classic Classic list List threaded Threaded
2 messages Options
Reply | Threaded
Open this post in threaded view
|

Patch for vtkJPEGReader

Axel Kittenberger
The JPEGReader in 8.1.1 crashes when the output vertical extend is smaller than the whole image. Reason is: outExt[2] and [3] weren't even looked at in the code and it always filled up the whole vertical size going out of allocated outPtr size.

Below patch fixes it for me. I also posted this in the bug tracker, but dunno what is the supposed way for this.

Kind regards, Axel

diff -ru VTK-8.1.1.org/IO/Image/vtkJPEGReader.cxx VTK-8.1.1/IO/Image/vtkJPEGReader.cxx
--- VTK-8.1.1.org/IO/Image/vtkJPEGReader.cxx 2018-05-11 16:34:24.000000000 +0200
+++ VTK-8.1.1/IO/Image/vtkJPEGReader.cxx 2018-07-19 12:37:04.697053464 +0200
@@ -295,19 +295,23 @@
 
   // read the bulk data
   long outSize = cinfo.output_components*(outExt[1] - outExt[0] + 1);
+  unsigned int line = cinfo.output_height - 1;
+  outPtr += outSize*(outExt[3] - outExt[2] - 1);
   while (cinfo.output_scanline < cinfo.output_height)
   {
     JDIMENSION linesRead = jpeg_read_scanlines(&cinfo, row_pointers, maxChunk);
 
     // copy the data into the outPtr
-    OT *outPtr2 = outPtr + (cinfo.output_height - cinfo.output_scanline)*outInc[1];
-    for (unsigned int i = 0; i < linesRead; ++i)
+    for (unsigned int i = linesRead; i > 0; --i)
     {
-      memcpy(outPtr2,
-             row_pointers[linesRead - i - 1]
-             + outExt[0]*cinfo.output_components,
-             outSize);
-      outPtr2 += outInc[1];
+   if( line >= outExt[2] && line < outExt[3] )
+   {
+       memcpy(outPtr,
+             row_pointers[i - 1] + outExt[0]*cinfo.output_components,
+            outSize);
+          outPtr -= outInc[1];
+   }
+   line--;
     }
   }


This code raises the segfault without above patch:

#include <vtkImageClip.h>
#include <vtkJPEGReader.h>

int main( int argc, char** argv )
{
    vtkJPEGReader * reader = vtkJPEGReader::New( );
    reader->SetFileName( "test.jpg" );
    reader->UpdateInformation( );

    vtkImageClip * clip = vtkImageClip::New( );
    clip->SetInputConnection( reader->GetOutputPort( ) );
    clip->SetOutputWholeExtent( 0, 10, 0, 10, 0, 1 );
    clip->Update( );

    return 0;
}

test.jpg being any large enough image.

_______________________________________________
Powered by www.kitware.com

Visit other Kitware open-source projects at http://www.kitware.com/opensource/opensource.html

Search the list archives at: http://markmail.org/search/?q=vtk-developers

Follow this link to subscribe/unsubscribe:
https://public.kitware.com/mailman/listinfo/vtk-developers

Reply | Threaded
Open this post in threaded view
|

Re: Patch for vtkJPEGReader

Ken Martin
Thanks for the nice report Axel. I created a MR, now in testing to fix this.

On Thu, Jul 19, 2018 at 6:58 AM, Axel Kittenberger <[hidden email]> wrote:
The JPEGReader in 8.1.1 crashes when the output vertical extend is smaller than the whole image. Reason is: outExt[2] and [3] weren't even looked at in the code and it always filled up the whole vertical size going out of allocated outPtr size.

Below patch fixes it for me. I also posted this in the bug tracker, but dunno what is the supposed way for this.

Kind regards, Axel

diff -ru VTK-8.1.1.org/IO/Image/vtkJPEGReader.cxx VTK-8.1.1/IO/Image/vtkJPEGReader.cxx
--- VTK-8.1.1.org/IO/Image/vtkJPEGReader.cxx 2018-05-11 16:34:24.000000000 +0200
+++ VTK-8.1.1/IO/Image/vtkJPEGReader.cxx 2018-07-19 12:37:04.697053464 +0200
@@ -295,19 +295,23 @@
 
   // read the bulk data
   long outSize = cinfo.output_components*(outExt[1] - outExt[0] + 1);
+  unsigned int line = cinfo.output_height - 1;
+  outPtr += outSize*(outExt[3] - outExt[2] - 1);
   while (cinfo.output_scanline < cinfo.output_height)
   {
     JDIMENSION linesRead = jpeg_read_scanlines(&cinfo, row_pointers, maxChunk);
 
     // copy the data into the outPtr
-    OT *outPtr2 = outPtr + (cinfo.output_height - cinfo.output_scanline)*outInc[1];
-    for (unsigned int i = 0; i < linesRead; ++i)
+    for (unsigned int i = linesRead; i > 0; --i)
     {
-      memcpy(outPtr2,
-             row_pointers[linesRead - i - 1]
-             + outExt[0]*cinfo.output_components,
-             outSize);
-      outPtr2 += outInc[1];
+   if( line >= outExt[2] && line < outExt[3] )
+   {
+       memcpy(outPtr,
+             row_pointers[i - 1] + outExt[0]*cinfo.output_components,
+            outSize);
+          outPtr -= outInc[1];
+   }
+   line--;
     }
   }


This code raises the segfault without above patch:

#include <vtkImageClip.h>
#include <vtkJPEGReader.h>

int main( int argc, char** argv )
{
    vtkJPEGReader * reader = vtkJPEGReader::New( );
    reader->SetFileName( "test.jpg" );
    reader->UpdateInformation( );

    vtkImageClip * clip = vtkImageClip::New( );
    clip->SetInputConnection( reader->GetOutputPort( ) );
    clip->SetOutputWholeExtent( 0, 10, 0, 10, 0, 1 );
    clip->Update( );

    return 0;
}

test.jpg being any large enough image.

_______________________________________________
Powered by www.kitware.com

Visit other Kitware open-source projects at http://www.kitware.com/opensource/opensource.html

Search the list archives at: http://markmail.org/search/?q=vtk-developers

Follow this link to subscribe/unsubscribe:
https://public.kitware.com/mailman/listinfo/vtk-developers





--
Ken Martin PhD
Distinguished Engineer
Kitware Inc.
101 East Weaver Street
Carrboro, North Carolina
27510 USA

This communication, including all attachments, contains confidential and legally privileged information, and it is intended only for the use of the addressee.  Access to this email by anyone else is unauthorized. If you are not the intended recipient, any disclosure, copying, distribution or any action taken in reliance on it is prohibited and may be unlawful. If you received this communication in error please notify us immediately and destroy the original message.  Thank you.

_______________________________________________
Powered by www.kitware.com

Visit other Kitware open-source projects at http://www.kitware.com/opensource/opensource.html

Search the list archives at: http://markmail.org/search/?q=vtk-developers

Follow this link to subscribe/unsubscribe:
https://public.kitware.com/mailman/listinfo/vtk-developers