bugGNUstep - Bugs: bug #44057, -[NSBitmapImageRep copy] can cause...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #44057: -[NSBitmapImageRep copy] can cause image corruption (overlapping memory pointers)

Submitted by:  Josh Freeman <tedge>
Submitted on:  Wed 21 Jan 2015 03:44:05 AM UTC  
 
Category: Gui/AppKitSeverity: 3 - Normal
Item Group: BugStatus: Fixed
Privacy: PublicAssigned to: Fred Kiefer <FredKiefer>
Open/Closed: Closed

Fri 23 Jan 2015 05:18:09 PM UTC, comment #1:

Thank you for this patch. I applied it and also rewrote your test to include it in the test suite. I had to rewrite it as we want to test the behaviour not the internal implementation. That way we should also be able to run our test on Cocoa.

Fred Kiefer <FredKiefer>
Project MemberIn charge of this item.
Wed 21 Jan 2015 03:44:05 AM UTC, original submission:

Setup: VirtualBox 4.3 + Ubuntu 14.04 guest, GNUstep from current SVN trunk (used script: http://lists.gnu.org/archive/html/discuss-gnustep/2014-05/msg00049.html )

NSBitmapImageRep member, _imageData, is declared as NSData, however it is initialized as NSMutableData:
-initWithBitmapDataPlanes:.. (NSBitmapImageRep.m:532).
-initWithFocusedViewRect: (sets it to the NSMutableData object from the dict returned by -[NSGraphicsContext GSReadRect:], NSBitmapImageRep.m:347)

-[NSBitmapImageRep copyWithZone:] returns an instance with the _imageData member set to immutable data, because it copies _imageData using -copyWithZone: (returns an immutable object) instead of -mutableCopyWithZone: (returns a mutable one). (NBitmapImageRep.m:1765)

The returned copy seems to work OK despite _imageData being immutable, however, any additional copies made from this copy will not only have immutable _imageData, but will also share the same pointer for data memory. (Calling -copyWithZone: on immutable data only copies the original's data pointer instead of allocating more memory & copying the bytes).

Writing pixels to any bitmap copy that has overlapping _imageData memory will unexpectedly change (corrupt) the pixel data in the other copies as well.

The attached patch fixes the issue by copying _imageData as a mutable object instead of immutable: changed the call from -copyWithZone: to -mutableCopyWithZone:. Test program is also attached.

Josh Freeman <tedge>

 

Attached Files
file #32879:  nsbitmapimagerep_copy_test.m added by tedge (2KiB - text/x-objcsrc)
file #32880:  NSBitmapImageRep_Copy.patch added by tedge (491B - text/x-patch)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by FredKiefer (Posted a comment)
  • -unavailable- added by tedge (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 7 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 18 Nov 2017 02:57:39 PM UTCFredKieferStatusReady For Test=>Fixed
      Open/ClosedIn Test=>Closed
    Fri 23 Jan 2015 05:18:09 PM UTCFredKieferStatusNone=>Ready For Test
      Assigned toNone=>FredKiefer
      Open/ClosedOpen=>In Test
    Wed 21 Jan 2015 03:44:05 AM UTCtedgeAttached File-=>Added nsbitmapimagerep_copy_test.m, #32879
      Attached File-=>Added NSBitmapImageRep_Copy.patch, #32880

    Back to the top


    Powered by Savane 3.1-cleanup1