GNOME Bugzilla – Bug 312392
repeatable crash copying in some images
Last modified: 2005-08-09 21:57:30 UTC
Distribution/Version: ubuntu hoary Run gimp on the attached image. Copy (ctrl-C). GIMP crashes. Here's the top of the stack:
+ Trace 62151
I have plenty of RAM on this machine and this is the only image loaded: I'm sure I'm not out of memory. I've seen this on one other image, but unfortunately I've forgotten which image it was. I don't think the other one was indexed (i.e. I don't think this is specific to indexed images).
Created attachment 50139 [details] image that triggers the bug
Here's what the tile looks like ("up 3" in gdb -- gdb says it's in tile-private.h but I think it's really line 221 of tile.c): (gdb) p *tile $2 = {ref_count = -24768, write_count = 18, share_count = 20480, dirty = 0, valid = 1, bpp = 183 '', ewidth = 26400, eheight = 47103, rowhint = 0xb780d3aa "h", data = 0xb780d3ba "h\b", swap_num = -1215892544, swap_offset = -5188358230366956582, tlink = 0xb786f930, next = 0xb780d40a, prev = 0xb7867a77, listhead = 0xb780d42a}
That tile is memory garbage. It crashes in extract_from_indexed_pixels() because it doesn't expect the destination tiles to have no alpha. This crash happens when copying / cutting a whole (no selection) indexed drawable without alpha.
Fixed in CVS: 2005-08-09 Michael Natterer <mitch@gimp.org> * app/paint-funcs/paint-funcs.[ch] (extract_from_inten_pixels) (extract_from_indexed_pixels): pass src_bytes and dest_bytes to these functions instead of just the source's bytes and whether it has an alpha. Honor dest_bytes when extracting instead of crashing by always asuming that the destination has alpha. Fixes bug #312392. (extract_from_region): removed has_alpha paramater. pass src->bytes and dest->bytes to above functions. * app/core/gimpselection.c (gimp_selection_extract): changed accordingly.