[vtk-developers] Patch for vtkJPEGReader

[Axel Kittenberger]

The JPEGReader in 8.1.1 crashes when the output vertical extend is smaller
than the whole image. Reason is: outExt[2] and [3] weren't even looked at
in the code and it always filled up the whole vertical size going out of
allocated outPtr size.

Below patch fixes it for me. I also posted this in the bug tracker, but
dunno what is the supposed way for this.

Kind regards, Axel

diff -ru VTK-8.1.1.org/IO/Image/vtkJPEGReader.cxx
VTK-8.1.1/IO/Image/vtkJPEGReader.cxx
--- VTK-8.1.1.org/IO/Image/vtkJPEGReader.cxx 2018-05-11 16:34:24.000000000
+0200
+++ VTK-8.1.1/IO/Image/vtkJPEGReader.cxx 2018-07-19 12:37:04.697053464 +0200
@@ -295,19 +295,23 @@

   // read the bulk data
   long outSize = cinfo.output_components*(outExt[1] - outExt[0] + 1);
+  unsigned int line = cinfo.output_height - 1;
+  outPtr += outSize*(outExt[3] - outExt[2] - 1);
   while (cinfo.output_scanline < cinfo.output_height)
   {
     JDIMENSION linesRead = jpeg_read_scanlines(&cinfo, row_pointers,
maxChunk);

     // copy the data into the outPtr
-    OT *outPtr2 = outPtr + (cinfo.output_height -
cinfo.output_scanline)*outInc[1];
-    for (unsigned int i = 0; i < linesRead; ++i)
+    for (unsigned int i = linesRead; i > 0; --i)
     {
-      memcpy(outPtr2,
-             row_pointers[linesRead - i - 1]
-             + outExt[0]*cinfo.output_components,
-             outSize);
-      outPtr2 += outInc[1];
+   if( line >= outExt[2] && line < outExt[3] )
+   {
+       memcpy(outPtr,
+             row_pointers[i - 1] + outExt[0]*cinfo.output_components,
+            outSize);
+          outPtr -= outInc[1];
+   }
+   line--;
     }
   }


This code raises the segfault without above patch:

#include <vtkImageClip.h>
#include <vtkJPEGReader.h>

int main( int argc, char** argv )
{
    vtkJPEGReader * reader = vtkJPEGReader::New( );
    reader->SetFileName( "test.jpg" );
    reader->UpdateInformation( );

    vtkImageClip * clip = vtkImageClip::New( );
    clip->SetInputConnection( reader->GetOutputPort( ) );
    clip->SetOutputWholeExtent( 0, 10, 0, 10, 0, 1 );
    clip->Update( );

    return 0;
}

test.jpg being any large enough image.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://public.kitware.com/pipermail/vtk-developers/attachments/20180719/0db01cff/attachment.html>