View Issue Details

IDProjectCategoryView StatusLast Update
0025366LazarusLCLpublic2013-11-29 11:45
ReporterAndre Scholberg Assigned ToMarc Weustink  
PrioritynormalSeverityminorReproducibilityalways
Status closedResolutionfixed 
Platform64 bitsOSWindows 
Product Version1.0.10 
Target Version1.2.0RC2Fixed in Version1.3 (SVN) 
Summary0025366: Crash in decoding RLE4 bitmaps in intfgraphics.pas
DescriptionI get a SIGSEGV exception when loading certain images in:
intfgraphics.pas, line 4990. package LCLBase.

The error occurs both in my own app _and_ in the otherwise excellent image viewer example application (imgview).

I am loading playing cards in a card game. Some load OK, many do not.

This freezes attempts to convert my D7 app to Lazarus.
Steps To ReproduceCompile and run the image viewer application.
Try opening the bitmaps of playing cards in the attached zip file:
H02.bmp, C04.bmp do not load and produce the error.
D13.bmp is loaded correctly (no error).
Additional InformationThe bug was reported in the Graphics forum. One answer was:

Quote
Had a bit of the same problem a few years ago.
I changed my images to PNG and everything was
working again, so i never looked at the problem ?
Maybe it was just lucky
Unquote.
TagsNo tags attached.
Fixed in Revisionr43497
LazTarget-
Widgetset
Attached Files

Activities

Andre Scholberg

2013-11-24 13:26

reporter  

TestCards.zip (6,407 bytes)

Reinier Olislagers

2013-11-24 16:00

developer   ~0071542

Last edited: 2013-11-24 16:04

View 2 revisions

"Compile and run the image viewer application." assuming he means $(lazarusdir)\examples\imgviewer

Tried on FPC trunk x86, Laz trunk, Win, opening the directory; SIGSEGV at 5239, in this line:
LineBuf[idx+1] := LineBuf[idx+1] shl 4;

#0 DORLE4(0x218f284) at intfgraphics.pas:5239
0000001 TLAZREADERDIB__READSCANLINE(88, <error reading variable>) at intfgraphics.pas:5297
0000002 TLAZREADERDIB__INTERNALREADBODY(<error reading variable>) at intfgraphics.pas:5895
0000003 TLAZREADERDIB__INTERNALREAD(0x22cf860, 0x232e9a0, <error reading variable>) at intfgraphics.pas:5593
0000004 FPIMAGE$_$TFPCUSTOMIMAGEREADER_$__$$_IMAGEREAD$TSTREAM$TFPCUSTOMIMAGE$$TFPCUSTOMIMAGE at :0
0000005 TFPIMAGEBITMAP__READSTREAM(0x22cf860, 1822, <error reading variable>) at .\include\fpimagebitmap.inc:141
0000006 TRASTERIMAGE__LOADFROMSTREAM(0x22e66d0, 1822, <error reading variable>) at .\include\rasterimage.inc:441
0000007 TBITMAP__LOADFROMSTREAM(0x22e66d0, 1822, <error reading variable>) at .\include\bitmap.inc:147
0000008 TRASTERIMAGE__LOADFROMSTREAM(0x22e66d0, <error reading variable>) at .\include\rasterimage.inc:417
0000009 TPICTURE__LOADFROMSTREAMWITHCLASS(0x22e66d0, <incomplete type>, <error reading variable>) at .\include\picture.inc:771
0000010 TPICTURE__LOADFROMSTREAMWITHFILEEXT(0x22e66d0, 0x22d2dcc '&'0000215, <error reading variable>) at .\include\picture.inc:652
0000011 TPICTURE__LOADFROMFILE(0x22deefc 'C'0000165#196'6'0000247#5#199'E'0000196'3'0000003'B'0000230'&'0000215, <error reading variable>) at .\include\picture.inc:518
0000012 TMAINFORM__SHOWFILE(0, <error reading variable>) at frmmain.pas:180
0000013 TMAINFORM__ADDFILE(0x22beeec 'D:\Cop\t\C04.bmp', true, <error reading variable>) at frmmain.pas:159
0000014 TMAINFORM__ADDDIR(0x22cf72c 'C'0000165#196'6'0000247#5#199'E'0000192#6'p', false, <error reading variable>) at frmmain.pas:243
0000015 TMAINFORM__AOPENDIREXECUTE(0x2375260, <error reading variable>) at frmmain.pas:220
0000016 CLASSES$_$TBASICACTION_$__$$_EXECUTE$$BOOLEAN at :0
0000017 TCONTAINEDACTION__EXECUTE(<error reading variable>) at .\include\containedaction.inc:98
0000018 TCUSTOMACTION__EXECUTE(<error reading variable>) at .\include\customaction.inc:246
0000019 CLASSES$_$TBASICACTIONLINK_$__$$_EXECUTE$TCOMPONENT$$BOOLEAN at :0
0000020 TMENUITEM__CLICK(<error reading variable>) at .\include\menuitem.inc:87
0000021 TMENUITEM__DOCLICKED(void, <error reading variable>) at .\include\menuitem.inc:282
0000022 SYSTEM$_$TOBJECT_$__$$_DISPATCH$formal at :0
0000023 VMT_$MENUS_$$_TMENU at :0
0000024 ?? at :0
0000025 ?? at :0
0000026 ?? at :0
0000027 CUSTOMFORMWNDPROC(10749032, 273, 3, 0) at .\win32\win32wsforms.pp:395
0000028 USER32!OffsetRect at :0
0000029 ?? at :0
0000030 USER32!IsWindow at :0
0000031 ADJUSTFORMBOUNDS at .\win32\win32wsforms.pp:316
0000032 USER32!AnyPopup at :0
0000033 ?? at :0

Bart Broersma

2013-11-24 16:22

developer   ~0071546

Lazarus 1.3 r43475 FPC 2.6.2 i386-win32-win32/win64 32-bit fpc on Win7-64

Only D13.bmp opens.
Attempts to open any of the other bmp's freezes the $(lazarusdir)\examples\imgviewer application and Windows will kill it.

Running it in gdb and trying to open "C04.bmp" gives:

C:\devel\lazarus\examples\imgviewer>gdb imgviewer
GNU gdb (GDB) 7.2
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "mingw32".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from C:\devel\lazarus\examples\imgviewer/imgviewer.exe...done.
(gdb) run
Starting program: C:\devel\lazarus\examples\imgviewer/imgviewer.exe
[New Thread 1072.0x15d8] //Press Ctrl+O to open file
[New Thread 1072.0x1380]
[New Thread 1072.0xe9c]
[New Thread 1072.0xb2c]
[New Thread 1072.0x1298]
[New Thread 1072.0x150c]
[New Thread 1072.0xfb4]
[New Thread 1072.0xbcc]
[New Thread 1072.0x4a0]
[New Thread 1072.0xe14]
[New Thread 1072.0x13a8]
[New Thread 1072.0x1694]
[New Thread 1072.0x16a8]
[New Thread 1072.0x780]
[New Thread 1072.0x117c]
[New Thread 1072.0x2e0]
[New Thread 1072.0xd58]
[New Thread 1072.0x944]
[New Thread 1072.0x171c]
[New Thread 1072.0xd4c]
[New Thread 1072.0x1388]
BFD: C:\Windows\SysWOW64\WMVCORE.DLL: Warning: Ignoring section flag IMAGE_SCN_M
EM_NOT_PAGED in section .reloc
//At this point the Windows OpenDialog has appeared

[New Thread 1072.0xbf0] //click on a file in the Open dialog
[New Thread 1072.0x15dc]

//Now I have selected the file and clicked OK

Program received signal SIGSEGV, Segmentation fault.
0x0045e6a6 in DORLE4 (parentfp=0x219f360) at intfgraphics.pas:5239
5239 LineBuf[idx+1] := LineBuf[idx+1] shl 4;
(gdb) bt
#0 0x0045e6a6 in DORLE4 (parentfp=0x219f360) at intfgraphics.pas:5239
0000001 0x0045e395 in TLAZREADERDIB__READSCANLINE (ROW=88,
    this=<error reading variable>) at intfgraphics.pas:5297
0000002 0x0045ff63 in TLAZREADERDIB__INTERNALREADBODY (
    this=<error reading variable>) at intfgraphics.pas:5895
0000003 0x0045f5b8 in TLAZREADERDIB__INTERNALREAD (STREAM=0x23507d0,
    IMG=0x23be760, this=<error reading variable>) at intfgraphics.pas:5593
0000004 0x0044f561 in FPIMAGE_TFPCUSTOMIMAGEREADER_$__IMAGEREAD$TSTREAM$TFPCUSTOMIMA
GE$$TFPCUSTOMIMAGE ()
0000005 0x0049e665 in TFPIMAGEBITMAP__READSTREAM (ASTREAM=0x23507d0, ASIZE=1822,
    this=<error reading variable>) at ./include/fpimagebitmap.inc:141
0000006 0x0048ee6e in TRASTERIMAGE__LOADFROMSTREAM (ASTREAM=0x240aaa0,
    ASIZE=1822, this=<error reading variable>)
    at ./include/rasterimage.inc:441
0000007 0x0049ec8f in TBITMAP__LOADFROMSTREAM (ASTREAM=0x240aaa0, ASIZE=1822,
    this=<error reading variable>) at ./include/bitmap.inc:147
0000008 0x0048ed83 in TRASTERIMAGE__LOADFROMSTREAM (ASTREAM=0x240aaa0,
    this=<error reading variable>) at ./include/rasterimage.inc:417
0000009 0x0048d4dc in TPICTURE__LOADFROMSTREAMWITHCLASS (STREAM=0x240aaa0,
    ACLASS=<incomplete type>, this=<error reading variable>)
    at ./include/picture.inc:771
0000010 0x0048d039 in TPICTURE__LOADFROMSTREAMWITHFILEEXT (STREAM=0x240aaa0,
    FILEEXT=0x2353ad8 'bmp', this=<error reading variable>)
    at ./include/picture.inc:652
0000011 0x0048cf5a in TPICTURE__LOADFROMFILE (
    FILENAME=0x23ebcb8 '3¥ÅW6W''5Ä&'0000023'''EÅ'0000006#150'7GW&W5Ä3'0000003'Bæ&×',
    this=<error reading variable>) at ./include/picture.inc:518
0000012 0x00427fa7 in TMAINFORM__SHOWFILE (INDEX=0, this=<error reading variable>)
    at frmmain.pas:180
0000013 0x00427e09 in TMAINFORM__ADDFILE (
    FILENAME=0x23ebc08 '3¥ÅW6W''5Ä&'0000023'''EÅ'0000006#150'7GW&W5Ä3'0000003'Bæ&×',
    SHOWFILE=true, this=<error reading variable>) at frmmain.pas:159
0000014 0x00427cd1 in TMAINFORM__AOPENEXECUTE (SENDER=0x23e24f8,
    this=<error reading variable>) at frmmain.pas:146
0000015 0x004383e2 in CLASSES_TBASICACTION_$__EXECUTE$$BOOLEAN ()
0000016 0x0052df49 in TCONTAINEDACTION__EXECUTE (this=<error reading variable>)
    at ./include/containedaction.inc:98
0000017 0x0052f6de in TCUSTOMACTION__EXECUTE (this=<error reading variable>)
    at ./include/customaction.inc:246
0000018 0x00438146 in CLASSES_TBASICACTIONLINK_$__EXECUTE$TCOMPONENT$$BOOLEAN ()
0000019 0x00527eae in TMENUITEM__CLICK (this=<error reading variable>)
    at ./include/menuitem.inc:87
0000020 0x00527b47 in HANDLEITEM (ITEM=0x2412c18, parentfp=0x219f8e0)
    at ./include/menu.inc:247
0000021 0x00527ae5 in TMENU__ISSHORTCUT (MESSAGE=...,
    this=<error reading variable>) at ./include/menu.inc:266
0000022 0x0041df73 in TCUSTOMFORM__ISSHORTCUT (MESSAGE=...,
    this=<error reading variable>) at ./include/customform.inc:2473
0000023 0x00502259 in ISSHORTCUT (parentfp=0x219f940)
    at ./include/wincontrol.inc:5646
0000024 0x005021b6 in TWINCONTROL__DOKEYDOWNBEFOREINTERFACE (MESSAGE=...,
    ISRECURSECALL=false, this=<error reading variable>)
    at ./include/wincontrol.inc:5709
0000025 0x005045f9 in TWINCONTROL__CNKEYDOWN (MESSAGE=...,
    this=<error reading variable>) at ./include/wincontrol.inc:7007
0000026 0x0040b0b6 in SYSTEM_TOBJECT_$__DISPATCH$formal ()
0000027 0x005045e0 in RAISELOOP (parentfp=0x219fbf4)
    at ./include/wincontrol.inc:6917
0000028 0x0050185e in TWINCONTROL__WNDPROC (MESSAGE=...,
    this=<error reading variable>) at ./include/wincontrol.inc:5327
0000029 0x00550395 in DELIVERMESSAGE (TARGET=0x23826f8, AMESSAGE=void)
    at lclmessageglue.pas:112
0000030 0x004d60b3 in WINDOWPROC (WINDOW=1311390, MSG=256, WPARAM=79,
    LPARAM=1572865) at ./win32/win32callback.inc:2497
0000031 0x00548aa8 in LISTBOXWINDOWPROC (WINDOW=1311390, MSG=256, WPARAM=79,
    LPARAM=1572865) at ./win32/win32wsstdctrls.pp:598
0000032 0x773462fa in USER32!OffsetRect () from C:\Windows\syswow64\user32.dll
0000033 0x0014029e in ?? ()
0000034 0x77346d3a in USER32!IsWindow () from C:\Windows\syswow64\user32.dll
0000035 0x005489e0 in TWIN32WSCUSTOMGROUPBOX__SETBIDIMODE (AWINCONTROL=0x0,
    USERIGHTTOLEFTALIGN=true (145), USERIGHTTOLEFTREADING=true (224),
    USERIGHTTOLEFTSCROLLBAR=false, pvmt=0x773aa61e)
    at ./win32/win32wsstdctrls.pp:560
0000036 0x773477c4 in USER32!AnyPopup () from C:\Windows\syswow64\user32.dll
0000037 0x00000000 in ?? ()
(gdb)

Bart Broersma

2013-11-24 16:23

developer   ~0071547

Reinier beat me to it (with different fpc...)

Bart Broersma

2013-11-24 17:30

developer   ~0071551

Last edited: 2013-11-24 18:21

View 2 revisions

The offending lines in intfgraphics.pas

          if NeedShift
          then begin
            TheStream.Read(LineBuf[idx+1], d[1]);
            while d[1] > 0 do
            begin
              LineBuf[idx] := (LineBuf[idx] and $F0) or (LineBuf[idx+1] shr 4);
              LineBuf[idx+1] := LineBuf[idx+1] shl 4;
              Inc(idx);
            end;
          end

The while loop seems to be an infinite loop, since the value of d[1] never gets altered?

Andre Scholberg

2013-11-25 11:23

reporter  

test_jpg.zip (34,864 bytes)

Andre Scholberg

2013-11-25 11:31

reporter   ~0071575

Last edited: 2013-11-25 11:35

View 3 revisions

I have tried loading the playing cards after converting them from .bmp to .png.
the images _do_ load correctly in imgview, which uses a TPicture.LoadFromFile call.

However, this does _not_ solve the problem.

TPicture.LoadFromFile supports the .jpg format as well as .bmp and .png, and a similar problem occurs. For example, in the attached test_jpg.zip, welcome.jpg is loaded correctly, and andre.jpg crashes the app.

There may be .png files out there that create a similar problem, which must be deeper than a format issue.

HTH

Reinier Olislagers

2013-11-25 11:45

developer   ~0071577

Last edited: 2013-11-25 11:47

View 2 revisions

No, sorry, this doesn't help. We're talking about a bug with bmp handling, not other formats. Please post other discussion on the forum thread.

Please open a new bug report for the jpg issue, thanks - you cannot know if the cause is the same even if the symptoms are similar.
Edit: please check if the Lazarus jpg code supports the compression you use in that faulty jpg. There are multiple ways to encode jpgs and I strongly suspect not all of them are supported.

Reinier Olislagers

2013-11-25 11:52

developer   ~0071578

Note: are you SURE you haven't just renamed a bmp to Andre.jpg? That file starts with BM, which is probably a marker for BMP, not with hex FF F8 which is the magic number for jpg...

Bart Broersma

2013-11-25 17:52

developer   ~0071592

Updated summary.

Reinier Olislagers

2013-11-25 18:05

developer   ~0071593

Last edited: 2013-11-25 19:11

View 2 revisions

@(0071551): yes, perhaps throw in a
            while d[1] > 0 do
            begin
              LineBuf[idx] := (LineBuf[idx] and $F0) or (LineBuf[idx+1] shr 4);
              LineBuf[idx+1] := LineBuf[idx+1] shl 4;
              Inc(idx);
              Dec(d[1]); //just added this after line 5240? without knowing what I'm doing... :(
Note that the bug happens in a different line for me with FPC trunk.

Leaving this for the experts to have a look at.

Bart Broersma

2013-11-25 19:33

developer   ~0071595

Maybe Marc can comment on it (according to svn he did that part AFAICS)

@Reinier: just decrementing d[1] upsets HeapTrc:
Marked memory at $0030BE80 invalid
Wrong signature $47B39235 instead of 7CAD2D36

Andre Scholberg

2013-11-26 18:35

reporter   ~0071620

Quote: are you SURE you haven't just renamed a bmp to Andre.jpg?

I have converted all the playing cards from .bmp to .jpg.
Imgview _does_ load all the jpg images correctly.

As regards Andre.jpg, yes, it is a bitmap.
You are right, I must have made an error when converting, or renamed bmp to jpg.

I apologize for the error and the inconvenience.

Reinier Olislagers

2013-11-29 07:30

developer   ~0071693

Marc kindly fixed the issue in revision 43496. Snapshots that contain this revision or builds from SVN should now work.

Confirmed with Laz trunk r43496, fpc trunk, windows.

@Andre Scholberg: please test and mark the issue as resolved if ok. Thanks.

@Laz devs: seems like a good candidate for backporting to 1.2?

Marc Weustink

2013-11-29 11:45

administrator   ~0071696

It is actually fixed in r43497, there was still a possible overflow

Issue History

Date Modified Username Field Change
2013-11-24 13:26 Andre Scholberg New Issue
2013-11-24 13:26 Andre Scholberg File Added: TestCards.zip
2013-11-24 13:50 Jonas Maebe Project FPC => Lazarus
2013-11-24 16:00 Reinier Olislagers Note Added: 0071542
2013-11-24 16:04 Reinier Olislagers Note Edited: 0071542 View Revisions
2013-11-24 16:22 Bart Broersma Note Added: 0071546
2013-11-24 16:23 Bart Broersma Note Added: 0071547
2013-11-24 17:30 Bart Broersma Note Added: 0071551
2013-11-24 18:21 Bart Broersma Note Edited: 0071551 View Revisions
2013-11-25 11:23 Andre Scholberg File Added: test_jpg.zip
2013-11-25 11:31 Andre Scholberg Note Added: 0071575
2013-11-25 11:33 Andre Scholberg Note Edited: 0071575 View Revisions
2013-11-25 11:35 Andre Scholberg Note Edited: 0071575 View Revisions
2013-11-25 11:45 Reinier Olislagers Note Added: 0071577
2013-11-25 11:47 Reinier Olislagers Note Edited: 0071577 View Revisions
2013-11-25 11:52 Reinier Olislagers Note Added: 0071578
2013-11-25 17:52 Bart Broersma LazTarget => -
2013-11-25 17:52 Bart Broersma Note Added: 0071592
2013-11-25 17:52 Bart Broersma Summary Bug in intfgraphics.pas, all bitmaps do not load => Crash in decoding RLE4 bitmaps in intfgraphics.pas
2013-11-25 18:05 Reinier Olislagers Note Added: 0071593
2013-11-25 19:11 Reinier Olislagers Note Edited: 0071593 View Revisions
2013-11-25 19:33 Bart Broersma Note Added: 0071595
2013-11-26 18:35 Andre Scholberg Note Added: 0071620
2013-11-29 07:30 Reinier Olislagers Note Added: 0071693
2013-11-29 07:30 Reinier Olislagers Status new => closed
2013-11-29 07:30 Reinier Olislagers Assigned To => Marc Weustink
2013-11-29 07:30 Reinier Olislagers Resolution open => fixed
2013-11-29 07:30 Reinier Olislagers Fixed in Version => 1.3 (SVN)
2013-11-29 07:30 Reinier Olislagers Target Version => 1.2.0RC2
2013-11-29 11:43 Marc Weustink Fixed in Revision => r43497
2013-11-29 11:45 Marc Weustink Note Added: 0071696