bugGNUstep - Bugs: bug #44057, -[NSBitmapImageRep copy] can cause...

Group
 
 

bug #44057: -[NSBitmapImageRep copy] can cause image corruption (overlapping memory pointers)

Submitter:  Josh Freeman <tedge>
Submitted:  Wed 21 Jan 2015 03:44:05 AM UTC
   
 
Category:  Gui/AppKit Severity:  3 - Normal
Item Group:  Bug Status:  Fixed
Privacy:  Public Assigned to:  FredKiefer
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Fri 23 Jan 2015 05:18:09 PM UTC, comment #1: 

Thank you for this patch. I applied it and also rewrote your test to include it in the test suite. I had to rewrite it as we want to test the behaviour not the internal implementation. That way we should also be able to run our test on Cocoa.

Fred Kiefer <FredKiefer>
Group Member
Wed 21 Jan 2015 03:44:05 AM UTC, original submission:  

    Setup: VirtualBox 4.3 + Ubuntu 14.04 guest, GNUstep from current SVN trunk (used script: http://lists.gnu.org/archive/html/discuss-gnustep/2014-05/msg00049.html )

    NSBitmapImageRep member, _imageData, is declared as NSData, however it is initialized as NSMutableData:
-initWithBitmapDataPlanes:.. (NSBitmapImageRep.m:532).
-initWithFocusedViewRect: (sets it to the NSMutableData object from the dict returned by -[NSGraphicsContext GSReadRect:], NSBitmapImageRep.m:347)

    -[NSBitmapImageRep copyWithZone:] returns an instance with the _imageData member set to immutable data, because it copies _imageData using -copyWithZone: (returns an immutable object) instead of -mutableCopyWithZone: (returns a mutable one). (NBitmapImageRep.m:1765)

    The returned copy seems to work OK despite _imageData being immutable, however, any additional copies made from this copy will not only have immutable _imageData, but will also share the same pointer for data memory. (Calling -copyWithZone: on immutable data only copies the original's data pointer instead of allocating more memory & copying the bytes).

    Writing pixels to any bitmap copy that has overlapping _imageData memory will unexpectedly change (corrupt) the pixel data in the other copies as well.
   
    The attached patch fixes the issue by copying _imageData as a mutable object instead of immutable: changed the call from -copyWithZone: to -mutableCopyWithZone:. Test program is also attached.

Josh Freeman <tedge>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #32879:  nsbitmapimagerep_copy_test.m added by tedge (2KiB - text/x-objcsrc)
file #32880:  NSBitmapImageRep_Copy.patch added by tedge (491B - text/x-patch)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by FredKiefer (Posted a comment)
  • -email is unavailable- added by tedge (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-11-18 FredKiefer StatusReady For Test Fixed
        Open/ClosedIn Test Closed
    2015-01-23 FredKiefer StatusNone Ready For Test
        Assigned toNone FredKiefer
        Open/ClosedOpen In Test
    2015-01-21 tedge Attached File- Added nsbitmapimagerep_copy_test.m, #32879
        Attached File- Added NSBitmapImageRep_Copy.patch, #32880

    Back to the top

    Powered by Savane 3.13-bb6a.
    Corresponding source code