Package: libimlib2
Version: 1.4.5-1
Severity: important
Tags: patch

Hello,

imlib crashes on gif images without any colormap, for instance the
attached file, here is the backtrace:

165                            r = cmap->Colors[bg].Red;
(gdb) p cmap
$1 = (ColorMapObject *) 0x0
(gdb) p gif->Image.ColorMap
$2 = (ColorMapObject *) 0x0
(gdb) p gif->SColorMap
$3 = (ColorMapObject *) 0x0
(gdb) bt
#0  0x00007ffff0d8ffa9 in load (im=0x555555788530, progress=0, 
progress_granularity=0 '\000', 
    immediate_load=1 '\001') at loader_gif.c:165
#1  0x00007ffff6f3c220 in __imlib_LoadImage (file=0x55555577c120 "test.gif", 
progress=0, 
    progress_granularity=0 '\000', immediate_load=1 '\001', dont_cache=0 
'\000', er=0x7fffffffd95c)
    at image.c:1026
#2  0x00007ffff6f1a577 in imlib_load_image_with_error_return 
(file=0x55555577c120 "test.gif", 

It indeed tries to use the background color, which is not defined, thus
a crash. This is particularly important because it breaks image loading
in w3m + w3m-img for any web page which contains such image, and it
seems a least one web engine does, used for instance by www.lemonde.fr .
The attached patch simply uses black for such pixel.  We may want to do
the same for non-transparent pixels, or return an error, but not crash.

Samuel

-- System Information:
Debian Release: 7.0
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'unstable'), (500, 'stable'), (1, 
'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 3.7.0 (SMP w/8 CPU cores)
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash

Versions of packages libimlib2 depends on:
ii  libbz2-1.0    1.0.6-4
ii  libc6         2.13-37
ii  libfreetype6  2.4.9-1
ii  libgif4       4.1.6-10
ii  libid3tag0    0.15.1b-10
ii  libjpeg8      8d-1
ii  libpng12-0    1.2.49-1
ii  libtiff4      3.9.6-10
ii  libx11-6      2:1.5.0-1
ii  libxext6      2:1.3.1-2
ii  zlib1g        1:1.2.7.dfsg-13

libimlib2 recommends no packages.

libimlib2 suggests no packages.

-- no debconf information

-- 
Samuel
<i8b4uUnderground> d-_-b
<BonyNoMore> how u make that inverted b?
<BonyNoMore> wait
<BonyNoMore> never mind

<<attachment: test.gif>>

--- a/src/modules/loaders/loader_gif.c
+++ b/src/modules/loaders/loader_gif.c
@@ -162,10 +162,17 @@ load(ImlibImage * im, ImlibProgressFunct
                {
                   if (rows[i][j] == transp)
                     {
-                       r = cmap->Colors[bg].Red;
-                       g = cmap->Colors[bg].Green;
-                       b = cmap->Colors[bg].Blue;
-                       *ptr++ = 0x00ffffff & ((r << 16) | (g << 8) | b);
+                       if (cmap)
+                         {
+                            r = cmap->Colors[bg].Red;
+                            g = cmap->Colors[bg].Green;
+                            b = cmap->Colors[bg].Blue;
+                            *ptr++ = 0x00ffffff & ((r << 16) | (g << 8) | b);
+                         }
+                       else
+                         {
+                            *ptr++ = 0;
+                         }
                     }
                   else
                     {

Reply via email to