Gunnar Evermann <Gunnar.Evermann(a)nats.informatik.uni-hamburg.de> writes:
> when I enter customize in a vanilla XEmacs the png-code crahses. Do I
> need a different lib?? I have: libpng-1.0.1 and zlib-1.1.2
> (dbx) where
> [1] _kill(0x0, 0xb, 0x0, 0x0, 0x6f8a227c, 0xf121c), at 0x6f8872e0
> =>[2] fatal_error_signal(sig = 11), line 262 in "emacs.c"
> ---- called from signal handler with signal 11 (SIGSEGV) ------
> [3] _memcpy(), at 0x6f8c05b0
> [4] png_read_from_memory(png_ptr = 0x84e800, data = 0x80b000 "", length = 144U), line 738 in "glyphs-eimage.c"
> [5] png_read_data(0x84e800, 0x80b000, 0x90, 0x13, 0x6ffeb790, 0x6ffed640), at 0x6fdd1d7c
[rest snipped]
I think I found a rather serious error in the PNG-handling code...
Deep inside png_instantiate() (glyphs-eimage.c:848) in a nested block
some kind of initialization for the upcoming png-read is done,
specifically a struct named tbr is declared as a local variable and
the address is stored in the png_ptr. the code looks like this:
/* Initialize the IO layer and read in header information */
{
Lisp_Object data = find_keyword_in_vector (instantiator, Q_data);
CONST Extbyte *bytes;
Extcount len;
struct png_memory_storage tbr; /* Data to be read */
assert (!NILP (data));
/* #### This is a definite problem under Mule due to the amount of
stack data it might allocate. Need to think about using Lstreams */
GET_STRING_BINARY_DATA_ALLOCA (data, bytes, len);
tbr.bytes = bytes;
tbr.len = len;
tbr.index = 0;
png_set_read_fn (png_ptr,(void *) &tbr, png_read_from_memory);
}
If I'm not mistaken, at this time (after the closing brace) the
stack-allocated tbr can (and will) be overwritten. For me this happens
when a new block is opened and new local variables are declared. The
following png_read's still access the old location ... Boom!
I moved the tbr declaration one level up and this fixes my problem --
somebody who actually knows this code should have a look at it.
Gunnar
1998-06-03 Gunnar Evermann <Gunnar.Evermann(a)nats.informatik.uni-hamburg.de>
* glyphs-eimage.c (png_instantiate) move 'struct
png_memory_storage tbr' out of nested block to avoid dangling
reference
glyphs-eimage.c
===================================================================
RCS file: /usr/CVSroot/XEmacs/xemacs-20/src/glyphs-eimage.c,v
retrieving revision 1.2
diff -u -r1.2 glyphs-eimage.c
--- glyphs-eimage.c 1998/04/28 00:24:57 1.2
+++ glyphs-eimage.c 1998/06/04 01:32:01
@@ -798,6 +798,7 @@
struct png_unwind_data unwind;
int speccount = specpdl_depth ();
int height, width;
+ struct png_memory_storage tbr; /* Data to be read */
/* PNG variables */
png_structp png_ptr;
@@ -844,7 +845,6 @@
Lisp_Object data = find_keyword_in_vector (instantiator, Q_data);
CONST Extbyte *bytes;
Extcount len;
- struct png_memory_storage tbr; /* Data to be read */
assert (!NILP (data));