GNOME Bugzilla – Bug 62344
Crash in io-xbm.c
Last modified: 2010-07-10 04:08:08 UTC
gdk_pixbuf__xbm_image_load calls gdk_pixbuf__xbm_image_load_real with context == NULL, but the error handler uses context->tempname, causing it to crash.
*** Bug 62343 has been marked as a duplicate of this bug. ***
Here is a simple fix:
Created attachment 5824 [details] [review] the patch
This patch seems to be already applied. Also, since it's patching the BMP code, and the problem is with the XBM handler, I don't see how it will help :-/ Here is the problem code (context is allowed to be NULL on entry): static GdkPixbuf * gdk_pixbuf__xbm_image_load_real (FILE *f, XBMData *context, GError **error) { guint w, h; int x_hot, y_hot; guchar *data, *ptr; guchar *pixels; guint row_stride; int x, y; int reg = 0; /* Quiet compiler */ int bits; GdkPixbuf *pixbuf; if (!read_bitmap_file_data (f, &w, &h, &data, &x_hot, &y_hot)) { g_set_error (error, GDK_PIXBUF_ERROR, GDK_PIXBUF_ERROR_CORRUPT_IMAGE, _("Invalid XBM file: %s"), context->tempname); return NULL; } 'context' is used in g_set_error, even though it may be NULL.
I attached the wrong patch. How could this happen ?!
Created attachment 5830 [details] [review] the right patch
Somehow xbm really escapes me. I guess rm -f *.diff is in order.
Created attachment 5831 [details] [review] this patch is even more on topic
Looks fine to me. (There is an outstanding win32 patch that changes the handling of context->tempnam a little bit, but I don't think it interacts.)