Bug 312144 – moving a layer more than 2x larger than the image size crashes gimp

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 312144 - moving a layer more than 2x larger than the image size crashes gimp


Summary:	moving a layer more than 2x larger than the image size crashes gimp


Status:	RESOLVED FIXED

Product:	GIMP
Classification:	Other
Component:	General
Version:	2.2.x
Hardware:	Other All

Importance:	High critical
Target Milestone:	2.2
Assigned To:	GIMP Bugs
QA Contact:	GIMP Bugs

URL:
Whiteboard:

Duplicates:	316350 323225 (view as bug list)
Depends on:
Blocks:

Reported:	2005-07-31 17:42 UTC by Anatol Ulrich
Modified:	2008-01-15 12:58 UTC

See Also:
GNOME target:	---
GNOME version:	---

Description Anatol Ulrich 2005-07-31 17:42:43 UTC

Steps to reproduce:
1. Create a 50x50 image
2. Create a new layer, 125x125 in size
3. Move layer to the outside of the image, using the "M" tool
4. Profit! No, crash.

Stack trace:
Program received signal SIGABRT, Aborted.
[Switching to Thread -1218090784 (LWP 19636)]
0xffffe410 in ?? ()
(gdb) 
(gdb) thread apply all bt

+ Trace 62105

Thread 1 (Thread -1218090784 (LWP 19636))

#0 ??
#1 ??
#2 ??
#3 ??
#4 raise
from /lib/tls/libc.so.6
#5 abort
from /lib/tls/libc.so.6
#6 g_logv
from /usr/lib/libglib-2.0.so.0
#7 g_log
from /usr/lib/libglib-2.0.so.0
#8 g_assert_warning
from /usr/lib/libglib-2.0.so.0
#9 ??
#10 _IO_stdin_used
#11 _IO_stdin_used
#12 ??
#13 _IO_stdin_used
#14 _IO_stdin_used
#15 ??
#16 ??
#17 ??
#18 ??
#19 ??
#20 ??
#21 ??
#22 ??
#23 ??
#24 ??
#25 ??
#26 ??
#27 ??
#28 ??
#29 ??
#30 ??
#31 ??
#32 ??
#33 ??
#34 ??
#35 ??
#36 ??
#37 ??
#38 ??
#39 ??
#40 ??
#41 ??
#42 ??
#43 ??
#44 ??
#45 ??
#46 ??
#47 ??
#48 ??
#49 ??
#50 ??
#51 ??
#52 ??
#53 ??
#54 ??
#55 ??
#56 ??
#57 ??
#58 ??
#59 ??
#60 ??
#61 ??
#62 ??
#63 ??
#64 ??
#65 __after_morecore_hook
from /lib/tls/libc.so.6
#66 __elf_set___libc_thread_subfreeres_element___rpc_thread_destroy__
from /lib/tls/libc.so.6
#67 __after_morecore_hook
from /lib/tls/libc.so.6
#68 ??
#69 ??
#70 ??
#71 ??
#72 pspec_pool
from /usr/lib/libgobject-2.0.so.0
#73 ??
#74 ??
#75 ??
#76 ??
#77 g_malloc
from /usr/lib/libglib-2.0.so.0
#78 ??
#79 ??
#80 ??
#81 ??
#82 ??
#83 ??
#84 ??
#85 ??
#86 ??
#87 ??
#88 ??
#89 ??
#90 ??
#91 ??
#92 ??
#93 ??
#94 ??
#95 ??
#96 ??
#97 ??
#98 ??
#99 ??
#100 ??
#101 ??
#102 ??
#103 ??
#104 ??
#105 ??
#106 ??
#107 ??
#108 ??
#109 ??
#110 ??
#111 ??
#112 ??
#113 ??
#114 ??
#115 ??
#116 ??
#117 ??
#118 ??
#119 ??
#120 ??
#121 ??
#122 ??
#123 __PRETTY_FUNCTION__.2
from /lib/tls/libc.so.6
#124 ??
#125 ??
#126 g_type_check_instance_cast
from /usr/lib/libgobject-2.0.so.0


Other information:
* It also happens with smaller layers, but not as easily; you have to shuffle
the layer a bit more.

* Using gdb makes the crash happen less easily, too.

* when running from a terminal, gimp utters those some last words in agony:

(gimp:19640): Gimp-Core-CRITICAL **: gimp_drawable_get_sub_preview: assertion
`dest_width > 0' failed

Gimp-Core-ERROR **: file gimpimage-preview.c: line 281
(gimp_image_get_new_preview): assertion failed: (layer_buf)
aborting...
gimp: terminated: Aborted

(script-fu:19641): LibGimpBase-WARNING **: script-fu: wire_read(): error

Comment 1 Michael Schumacher 2005-07-31 20:33:04 UTC

Confirming for both 2.2.8 and current CVS.

Comment 2 Manish Singh 2005-08-13 23:58:16 UTC

Thanks for the report. Fixed in both branches:

2005-08-13  Manish Singh  <yosh@gimp.org>

        * app/core/gimpimage-preview.c (gimp_image_get_new_preview): if the
        offsets of the layer are such that they are just on the border of
        the image, detect that and bail instead of trying to make a
        sub-preview with a 0 dimension. Fixes bug #312144.

Comment 3 Michael Natterer 2005-09-15 08:53:07 UTC

*** Bug 316350 has been marked as a duplicate of this bug. ***

Comment 4 Sven Neumann 2005-12-05 11:43:27 UTC

*** Bug 323225 has been marked as a duplicate of this bug. ***