Fix crash in scalepixels when used with rotate-and-perspective module#20706
Open
da-phil wants to merge 1 commit intodarktable-org:masterfrom
Open
Conversation
* Compute x_scale/y_scale locally in process() from actual roi_in/roi_out instead of using d->x_scale/d->y_scale which can be overwritten by precalculate_scale() called from distort_transform/distort_backtransform with different ROI dimensions, causing out-of-bounds interpolation access. * Implement distort_mask() enabling masks to work correctly when module is at non-standard pipeline position. * Fix buffer overflow in (ashift.c) g->buf allocation: the buffer was allocated using piece->buf_in.width * piece->buf_in.height but then filled with roi_in->width * roi_in->height * 4 floats. When roi_in->scale > 1.0 (zoomed in), roi_in dimensions exceed buf_in, causing a ~6.6 MB write past the end of the buffer. Fixed in both the CPU path (process()) and OpenCL path (process_cl()) by changing requested_size, g->buf_width, and g->buf_height to use roi_in dimensions instead of piece->buf_in.
Contributor
Author
|
I did some intensive testing and could not reproduce the crash mentioned in #17286. |
ralfbrown
added
bugfix
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Compute
x_scale/y_scalelocally inprocess()from actualroi_in/roi_outinstead of usingd->x_scale/d->y_scalewhich can be overwritten byprecalculate_scale()called fromdistort_transform/distort_backtransformwith different ROI dimensions, causing out-of-bounds interpolation access.Implement
distort_mask()enabling masks to work correctly when module is at non-standard pipeline position.Fix buffer overflow in (ashift.c)
g->bufallocation: the buffer was allocated usingpiece->buf_in.width * piece->buf_in.heightbut then filled withroi_in->width * roi_in->height * 4 floats. Whenroi_in->scale > 1.0(zoomed in),roi_indimensions exceedbuf_in, causing a write past the end of the buffer. Fixed in both the CPU path (process()) and OpenCL path (process_cl()) by changingrequested_size,g->buf_width, andg->buf_heightto useroi_indimensions instead ofpiece->buf_in.Fixes #17286
Disclaimer: co-created with Claude.