192205 - ImageLib failure to load JNG image crashes Mozilla [@ memmove]

Status: VERIFIED DUPLICATE of bug 156540

(Core :: Graphics: ImageLib, defect)

Description

[Greg K.]

The known problem with libmng v1.0.4 (bug 181676) which causes some MNG and JNG
images to fail to load also seems to cause FizzillaMach/2003020303 to crash.

Comment 1

[Greg K.]

Attachment: HTML testcase that, when shift+reloaded no more than twice, crashes FizzillaMach/2003020303 at memmove

Comment 2

[Greg K.]

Attachment: Crash report generated by FizzillaMach/2003020303 showing crash at memmove after shift+reloading the HTML testcase

Comment 3

[Greg K.]

Crash also reproduced using the more-recent FizzillaMach/2003020603.

Comment 4

[Greg K.]

Mac only? Doesn't appear to crash Win32/2003010408.

Comment 5

[Jim Dunn]

I am crashing with a 2003012810 build on win2k
Looks like we are writing to invalid memory.  
Debuging I see: 
imgContainerMNG::WriteMNG(...) {
  mBuffer = (PRUint8 *) nsMemory::Realloc(mBuffer, mBufferEnd+count);
  inStr->Read((char *)mBuffer+mBufferEnd, count, _retval);
mBuffer is 0
mBufferEnd is 50520
count is 2728
So mBuffer is hosed... 
NOTE: the mng file is tagged as being "bad/invalid" so maybe we just
aren't initializing something and then expect the stream to just stop.

looking...

Comment 6

[Jim Dunn]

I knew I had seen this before...
Marking this as a dup of bug 156540
which is in essence a bug that is fixed with bug 181676
(libmng to 1.0.5)

*** This bug has been marked as a duplicate of 156540 ***