41360 - crash bug using tmpfile() on mac -- MSL bug

Status: VERIFIED FIXED

(Core :: Graphics: ImageLib, defect, P3)

Description

[pnunn]

I have a crash bug that only shows up on the mac when
2 progressive huffman jpg's are displayed one after the
other.

A nsStdLib function, tmpfile(), is used to store
data until header info is available. This code is in the IJG
jpeg library code. The function tmpfile() is implemented in
file_io.c. The crash occurs when a linked list is walked through
in find_temp_info() in file_io.mac.c.

When the second jpeg file is decoded, the next pointer in the
temp file linked list is garbage. It is dereferenced and the
browser, os and everything crashes.

To save time, a good breakpoint is in file_io.mac.c line 89.

thanks for the mac help.
-P

Comment 1

[pnunn]

Attachment: progressive huffman jpeg test file

Comment 2

[pnunn]

Attachment: progressive huffman jpeg test file#2

Comment 3

[Simon Fraser [no longer active]]

I'm pretty sure this is an MSL bug. Even a very simple program:


#include <stdio.h>

void main(void)
{
  FILE *firstFile;
  firstFile = tmpfile();
  fclose(firstFile);
}

throws up errors in Spotlight in the fsclose call.

Comment 4

[Simon Fraser [no longer active]]

This is certainly an MSL bug; a more recent MSL has the bug fixed. Here's the 
patch: at line 166 of file_io.mac.c, add the lines preceded by '+':

   info->next_struct = temp_info_anchor;        /* mm 981009 */
+  if (temp_info_anchor)
+    temp_info_anchor->prev_struct = info;
   temp_info_anchor  = info;                    /* mm 981009 */

Should we get everyone to apply this patch?

Comment 5

[leger]

Adding crash to keyword field.

Comment 6

[J.J. Enser]

patch applied to file_io.mac.c on the Release Build Mac (bassman)

Comment 7

[pnunn]

How will this patch be migrated into developers builds?
-P

Comment 8

[Simon Fraser [no longer active]]

I'll post and update the build instructions.

Comment 9

[Simon Fraser [no longer active]]

The files on the MacOS development server have been updated, and I posted to the 
newsgroup. And this bug should now be fixed in release builds.

Comment 10

[Eli Goldberg]

pnunn (or anyone else), if this is in fact fixed, could you please verify it as 
such?

Otherwise, I can rubber-stamp it without inspection. Thanks!

Comment 11

[pnunn]

I declare this as VERIFIED.
tah-dah!