[GM-bugs] Assertion image->cache != (Cache) ((void *)0)' failed.

[Michał K. <mi...@ko...>]

Hello,
I found a bug in GraphicsMagick. It happened when I tried to scale this jpeg
file: http://kowalczuk.eu/other/GM-bug.jpg

$ gm convert -scale 800 GM-bug.jpg test.jpg
gm: cache.c:534: AcquireImagePixels: Assertion `image->cache != (Cache) ((void *)0)' failed.

Stack trace:
libc.so.1`_lwp_kill+7(1, 6)
libc.so.1`raise+0x1f(6)
libc.so.1`abort+0xcd(0, 824d340, 65737341, 6f697472, 6166206e, 64656c69)
libc.so.1`_assert+0x6b(8224597, 8224579, 216, 360)
AcquireImagePixels+0xc1(82c82f8, 0, 0, 480, 1, 82c9c84)
SignatureImage+0xc4(82c82f8, 82d20d0, 0, 80dac1c, fffffe80, 57)
TranslateText+0x76f(0, 82c82f8, 82d20d0, 82cb130, fef4cf60, fef9b080)
SetImageAttribute+0x10c(82c82f8, 82cb130, 82d20d0, 0)
CloneImage+0x45a(82b92a8, 320, 258, 1, 82bac34, 0)
ScaleImage+0xae(82b92a8, 320, 258, 82bac34)
MogrifyImage+0x1c58(8298648, 3, 829a72c, 804621c, 0)
MogrifyImages+0x227(8298648, 3, 829a72c, 80462b4, 0, 0)
ConvertImageCommand+0x4b9(8298648, 5, 829a728, 0, 8047384, 820bce0)
MagickCommand+0xea(8298648, 5, 8047bf0, 8047380, 8047384, 820b952)
main+0xc8(5, 8047bec, 8047c08)
_start+0x80(6, 8047cc0, 8047ce7, 8047cef, 8047cf6, 8047cfa)

It happens when using standalone gm tool and in application that uses gm
C API. Tested on Linux (x86, x86_64), Solaris (x86_64, sparc).

I've done some research and I think that gm improperly finds a comment in this
file (this image has no comment). Then in function CloneImage() it tries to
clone also this found comment. When parsing the comment it finds pattern %#
and tries to translate it to pixel signature, but since clone_image->cache is
NULL it fails on assert in AcquireImagePixels().

My primitive workaround for this is checking if image has cache before calling
SignatureImage():

In utility.c, function TranslateText():

      case '#':
      {
        if (!image->cache) {
          *q++=(*p);
          continue;
        }

But I think that the main problem is that gm is trying to clone the comment
when there isn't one in the source file. Also, checking existence of cache
before calling SignatureImage() is also not a bad idea.

-- 
pozdrawiam,
Michał Kowalczuk
http://kowalczuk.eu/