Wed 21 Jan 2015 03:44:05 AM UTC, original submission:
Setup: VirtualBox 4.3 + Ubuntu 14.04 guest, GNUstep from current SVN trunk (used script: http://lists.gnu.org/archive/html/discuss-gnustep/2014-05/msg00049.html )
NSBitmapImageRep member, _imageData, is declared as NSData, however it is initialized as NSMutableData:
-initWithBitmapDataPlanes:.. (NSBitmapImageRep.m:532).
-initWithFocusedViewRect: (sets it to the NSMutableData object from the dict returned by -[NSGraphicsContext GSReadRect:], NSBitmapImageRep.m:347)
-[NSBitmapImageRep copyWithZone:] returns an instance with the _imageData member set to immutable data, because it copies _imageData using -copyWithZone: (returns an immutable object) instead of -mutableCopyWithZone: (returns a mutable one). (NBitmapImageRep.m:1765)
The returned copy seems to work OK despite _imageData being immutable, however, any additional copies made from this copy will not only have immutable _imageData, but will also share the same pointer for data memory. (Calling -copyWithZone: on immutable data only copies the original's data pointer instead of allocating more memory & copying the bytes).
Writing pixels to any bitmap copy that has overlapping _imageData memory will unexpectedly change (corrupt) the pixel data in the other copies as well.
The attached patch fixes the issue by copying _imageData as a mutable object instead of immutable: changed the call from -copyWithZone: to -mutableCopyWithZone:. Test program is also attached.
|