392867 - PNG encoder error handler incorrectly returns to caller

Status: RESOLVED FIXED

(Core :: Graphics: ImageLib, defect)

Description

[Glenn Randers-Pehrson]

Attachment: Separate warning and error handlers with longjmp from error

Libpng requires the error handler not to return to the caller.  The png decoder is doing this correctly, but the png decoder returns, which will probably lead to stack corruption and a crash.  It is supposed to perform a longjmp instead.  The attached patch separates the error and warning handlers, and does a longjmp from the error handler.

Comment 1

[Glenn Randers-Pehrson]

I meant to say "but the png encoder returns"

Comment 2

[Glenn Randers-Pehrson]

The patch is only applicable to the trunk.  The branch uses libpng's default error handler and should be OK as is.

Comment 3

[:Gavin Sharp [email: [e-mail]]]

Glenn: are you going to ask for review on the patch?

Comment 4

[Glenn Randers-Pehrson]

Yes, but I wanted to give the TryServer a shot first.  Also I would like to generate a test case.

Comment 5

[Glenn Randers-Pehrson]

Attachment: v01: separate Warning and Error Callbacks, updated directory to "image"

Comment 6

[Glenn Randers-Pehrson]

Someone please run this through the try server.

Comment 7

[Joe Drew (not getting mail)]

This is currently running through Try: https://tbpl.mozilla.org/?tree=Try&rev=ff7ed4731b86

Comment 8

[Mozilla RelEng Bot]

Try run for ff7ed4731b86 is complete.
Detailed breakdown of the results available here:
    https://tbpl.mozilla.org/?tree=Try&rev=ff7ed4731b86
Results (out of 263 total builds):
    exception: 2
    success: 231
    warnings: 27
    failure: 3
Builds (or logs if builds failed) available at:
http://ftp.mozilla.org/pub/mozilla.org/firefox/try-builds/[e-mail]-ff7ed4731b86

Comment 9

[Glenn Randers-Pehrson]

Comment on attachment 568841 [details] [diff] [review]
v01: separate Warning and Error Callbacks, updated directory to "image"

None of the failures appear to be related to this patch.

Comment 10

[Joe Drew (not getting mail)]

http://hg.mozilla.org/mozilla-central/rev/11eb2aecc7c3

Comment 11

[Mozilla RelEng Bot]

Try run for ff7ed4731b86 is complete.
Detailed breakdown of the results available here:
    https://tbpl.mozilla.org/?tree=Try&rev=ff7ed4731b86
Results (out of 272 total builds):
    exception: 2
    success: 231
    warnings: 27
    failure: 11
    other: 1
Builds (or logs if builds failed) available at:
http://ftp.mozilla.org/pub/mozilla.org/firefox/try-builds/[e-mail]-ff7ed4731b86