The default bug view has changed. See this FAQ.

PNG encoder error handler incorrectly returns to caller

RESOLVED FIXED in mozilla11

Status

()

Core
ImageLib
--
major
RESOLVED FIXED
10 years ago
5 years ago

People

(Reporter: Glenn Randers-Pehrson, Assigned: Glenn Randers-Pehrson)

Tracking

Trunk
mozilla11
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment, 1 obsolete attachment)

(Assignee)

Description

10 years ago
Created attachment 277380 [details] [diff] [review]
Separate warning and error handlers with longjmp from error

Libpng requires the error handler not to return to the caller.  The png decoder is doing this correctly, but the png decoder returns, which will probably lead to stack corruption and a crash.  It is supposed to perform a longjmp instead.  The attached patch separates the error and warning handlers, and does a longjmp from the error handler.
(Assignee)

Comment 1

10 years ago
I meant to say "but the png encoder returns"
(Assignee)

Comment 2

10 years ago
The patch is only applicable to the trunk.  The branch uses libpng's default error handler and should be OK as is.
Glenn: are you going to ask for review on the patch?
(Assignee)

Comment 4

10 years ago
Yes, but I wanted to give the TryServer a shot first.  Also I would like to generate a test case.
(Assignee)

Comment 5

6 years ago
Created attachment 568841 [details] [diff] [review]
v01: separate Warning and Error Callbacks, updated directory to "image"
Attachment #277380 - Attachment is obsolete: true
(Assignee)

Comment 6

6 years ago
Someone please run this through the try server.
(Assignee)

Updated

6 years ago
Blocks: 614144
(Assignee)

Updated

6 years ago
Blocks: 700193
(Assignee)

Updated

5 years ago
No longer blocks: 614144
This is currently running through Try: https://tbpl.mozilla.org/?tree=Try&rev=ff7ed4731b86

Comment 8

5 years ago
Try run for ff7ed4731b86 is complete.
Detailed breakdown of the results available here:
    https://tbpl.mozilla.org/?tree=Try&rev=ff7ed4731b86
Results (out of 263 total builds):
    exception: 2
    success: 231
    warnings: 27
    failure: 3
Builds (or logs if builds failed) available at:
http://ftp.mozilla.org/pub/mozilla.org/firefox/try-builds/jdrew@mozilla.com-ff7ed4731b86
(Assignee)

Comment 9

5 years ago
Comment on attachment 568841 [details] [diff] [review]
v01: separate Warning and Error Callbacks, updated directory to "image"

None of the failures appear to be related to this patch.
Attachment #568841 - Flags: review?(joe)
Attachment #568841 - Flags: review?(joe) → review+
Keywords: checkin-needed
http://hg.mozilla.org/mozilla-central/rev/11eb2aecc7c3
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Keywords: checkin-needed
Resolution: --- → FIXED
Target Milestone: --- → mozilla11

Comment 11

5 years ago
Try run for ff7ed4731b86 is complete.
Detailed breakdown of the results available here:
    https://tbpl.mozilla.org/?tree=Try&rev=ff7ed4731b86
Results (out of 272 total builds):
    exception: 2
    success: 231
    warnings: 27
    failure: 11
    other: 1
Builds (or logs if builds failed) available at:
http://ftp.mozilla.org/pub/mozilla.org/firefox/try-builds/jdrew@mozilla.com-ff7ed4731b86
You need to log in before you can comment on or make changes to this bug.