9000 - [PP] Invalid PNG crashes M7

Status: VERIFIED FIXED

(Core :: Graphics: ImageLib, defect, P3)

Description

[nomssi]

The PNG file at the URL above has an error. As a result, M7 crashes.
System: WinNT, SP3. Bug 924 describes a similar problem.

Comment 1

[Eli Goldberg]

Confirmed crash on 6.29.99 (Tracking ID F3K18ALD)

Comment 2

[pnunn]

This is a duplicate of bug# 924.
-pn

*** This bug has been marked as a duplicate of 924 ***

Comment 3

[Eli Goldberg]

Re-opening; using the 7.9.99 PM builds, this image no longer crashes Win32.

However, it crashes Mac OS, and Linux (with "Bad adaptive filter type" and "Not a
PNG file" errors.)

Here's a Mac OS stack crawl:

PowerPC unmapped memory exception at 0A27C848
 Calling chain using A6/R1 links
  Back chain  ISA  Caller
  00000000    PPC  0B90C4A0
  033F9DC0    PPC  0B90B778  main+00DF4
  033F9BB0    PPC  0B7C5448  nsAppShellService::Run()+00018
  033F9B70    PPC  0AAB6A8C  nsAppShell::Run()+00038
  033F9AF0    PPC  0AAB7390  nsMacMessagePump::DoMessagePump()+0003C
  033F9AA0    PPC  0AAB7648  nsMacMessagePump::DispatchEvent(int, EventRecord*)+
00158
  033F9A50    PPC  0A1D4FA8  Repeater::DoRepeaters(const EventRecord&)+00030
  033F9A10    PPC  0A1D4AC8  TimerPeriodical::RepeatAction(const EventRecord&)+
00048
  033F99C0    PPC  0A1D4624  TimerImpl::Fire()+00024
  033F9980    PPC  0A1B930C  nsNetlibService::NetPollSocketsCallback(nsITimer*,
void*)+0001C
  033F9940    PPC  0A198E6C  NET_PollSockets+000A4
  033F98F0    PPC  0A194728  NET_ProcessNet+003C4
  033F9560    PPC  0A1B1AE0  net_ProcessHTTP+00120
  033F9510    PPC  0A1B13F0  net_pull_http_data+000D4
  033F94C0    PPC  0A18ADAC  net_MemCacheWrite+001C8
  033F9460    PPC  0A1BD06C  stub_put_block(_NET_StreamClass*, const char*,
long)+00080
  033F9410    PPC  0AA4DEB4  nsDocumentBindInfo::OnDataAvailable(nsIURI*,
nsIInputStream*, un
signed int)+00074
  033F93C0    PPC  09E5E7D0  ImageListener::OnDataAvailable(nsIURI*,
nsIInputStream*, unsigne
d int)+0002C
  033F9380    PPC  0B6B0704  ImageConsumer::OnDataAvailable(nsIURI*,
nsIInputStream*, unsigne
d int)+00174
  033F9320    PPC  0B895DC0  NetReaderImpl::Write(const unsigned char*, long)+
00018
  033F92E0    PPC  0B899768  IL_StreamWrite(il_container_struct*, const unsigned
char*, long)
+00078
  033F9290    PPC  0B9187A8  PNGDecoder::ImgDWrite(const unsigned char*, long)+
00018
  033F9250    PPC  0B917614  il_png_write(il_container_struct*, const unsigned
char*, long)+0
00E4
  033F9200    PPC  0B91BC14  png_destroy_read_struct+00078
  033F91B0    PPC  0B9197E4  png_destroy_struct+00014
 Closing log

Comment 4

[pnunn]

Just to document:
from pngchk:
nview.png  CRC error in chunk IDAT (actual 3f113778, should be 080ae13f)
-pn

Comment 5

[pnunn]

Error condition should be caught and handled
properly. Check in today should have fixed this.
This bug is a duplicate of 9336.

Comment 6

[Eli Goldberg]

Verified fixed using:
       1999082509 Mac OS (8.6)
       1999082708 Windows (NT 4.0 SP3)
       1999082513 Linux (RH 6.0, GNOME)

Specifically, viewing the image results in the image URL being displayed, after
Mozilla gracefully terminates its attempt to display the image.