Bug 691546 - buffer overflow and asserts in imagesmooth
Summary: buffer overflow and asserts in imagesmooth
Status: RESOLVED FIXED
Alias: None
Product: MuPDF
Classification: Unclassified
Component: fitz (show other bugs)
Version: unspecified
Hardware: All All
: P4 normal
Assignee: Robin Watts
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2010-08-11 12:13 UTC by Tor Andersson
Modified: 2010-09-14 11:23 UTC (History)
0 users

See Also:
Customer:
Word Size: ---

Attachments
10.1.1.30.8066.pdf (171.32 KB, application/pdf)
2010-08-11 12:13 UTC, Tor Andersson 		Details
10.1.1.42.7749.pdf (230.77 KB, application/pdf)
2010-08-11 12:13 UTC, Tor Andersson 		Details
patch.txt (9.32 KB, patch)
2010-09-01 11:44 UTC, Robin Watts 		Details | Diff
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Tor Andersson 2010-08-11 12:13:18 UTC 
Created attachment 6640 [details]
10.1.1.30.8066.pdf

Some problems in the imagesmooth code:

draw/imagesmooth.c:569: fz_smoothscalepixmap: Assertion `max_row < src->h' failed.
draw/imagesmooth.c:308: add_weight: Assertion `weights->count == j-1' failed.

==1840== Invalid write of size 4
==1840==    at 0x41D6BB: reorder_weights (imagesmooth.c:391)
==1840==    by 0x41D922: make_weights (imagesmooth.c:463)
==1840==    by 0x41DC3B: fz_smoothscalepixmap (imagesmooth.c:541)
Comment 1 Tor Andersson 2010-08-11 12:13:57 UTC 
Created attachment 6641 [details]
10.1.1.42.7749.pdf
Comment 2 Robin Watts 2010-09-01 11:44:35 UTC 
Created attachment 6685 [details]
patch.txt

Patch that fixes this bug. Sent to Tor for his consideration.