Re: [Mjpeg-users] bug in jpeg2yuv.c ?

[Bernhard P. <sha...@ut...>]

Hallo

> when trying to convert the image bla.jpg with
>   jpeg2yuv -f 25 -j bla.jpg -I p -n 1 > bla.out
>
> the program crashes with core dump. The valgrind
> memory checker pointed the problem to be  in
> 
> jpegutils.c:608: decode_jpeg_raw()       raw0[xd++] = row0[y][xs++];
> 
> where data is copied to invalid memory of raw0.
> 
> Using gdb verifies that
> 
> jpeg2yuv.c:363
> 
> yuv[0] = malloc(param->width * param->height * sizeof(yuv[0][0]));
> yuv[1] = malloc(param->width * param->height / 4 * sizeof(yuv[1][0]));
> yuv[2] = malloc(param->width * param->height / 4 * sizeof(yuv[2][0]));
> 
> does not allocate enough memory for
> 
> jpegutils::decode_jpeg_raw()
Decoding of the image in decode_jpeg_raw in works the problem ist the
line 911 in jpegutils.c: (void) jpeg_finish_decompress (&dinfo);
 
That one causes the crash. But I have really no idea why. The
jpeg_finish_decompress is from the jpeg libary or jpeg-mmx for some
strange reason the crash happens with each lib. :-/
Allocating more memory did not solve the problem on my machine. 

But when the image has a size of at least 200x160 ist does not crash.
That makes it rather strange. 

> jpeg-mmx-0.1.4.tar.gz
> libmovtar-0.1.3.tar.gz
> mjpegtools-1.6.1.92.tar.gz
> quicktime4linux-1.4-patched-2.tar.gz
> 
> on a Debian Sarge (testing) system with gcc-3.3.2
Tested it on a Suse 9.0 

> I hope this report will help to improve future versions of this great software
Thanks


auf hoffentlich bald,

Berni the Chaos of Woodquarter

Email: sha...@ut...
www: http://www.lysator.liu.se/~gz/bernhard