50498 - ABR: il_emit_row()

Status: VERIFIED FIXED

(Core :: Graphics: ImageLib, defect, P3)

Description

[Bruce Mitchener]

During startup, we get over 180 ABR warnings out of Purify.  This is a build 
from today, running the new modern skin.

il_emit_row() calls nsCRT::memcpy() on line 989.  It was attempting to read 36 
bytes out of a buffer that was only 34 bytes long.

cc'ing tor just in case it has to do with the PNG alpha code. (since PNG stuff 
is on the stack).

I can get a full stack trace if needed, it is just hard at the moment, so if I 
don't have to, I'd much ratehr not. :)

Comment 1

[pnunn]

thanks, bruce. 

Comment 2

[tor]

A simplistic fix which leaves the trailing bytes in the word aligned
alphamask uninitialized:

Index: scale.cpp
===================================================================
RCS file: /cvsroot/mozilla/modules/libimg/src/scale.cpp,v
retrieving revision 3.22
diff -u -r3.22 scale.cpp
--- scale.cpp   2000/04/20 22:34:05     3.22
+++ scale.cpp   2000/09/04 01:18:16
@@ -986,7 +986,7 @@
                 }
             }
             else
-                nsCRT::memcpy(alphabitstart, alphabits_1,
mask_header->widthBytes);
+                nsCRT::memcpy(alphabitstart, alphabits_1, len);
 
             PR_DELETE(alphabits_1);
             

Comment 3

[tor]

*** Bug 53700 has been marked as a duplicate of this bug. ***

Comment 4

[Gagan]

this sounds bad. putting on plus radar.

Comment 5

[Paul Wyskoczka]

Updating QA Contact

Comment 6

[Phil Peterson]

Not holding PR3 for this, marking nsbeta3-. Please nominate for rtm if we really
need to fix this before shipping Seamonkey.

Comment 7

[pnunn]

All pnunn bugs reassigned to Pav, who is taking over
the imglib.

Comment 8

[Stuart Parmenter]

code no longer used.  marking fixed.

Comment 9

[Terri Preston]

Verified