[PATCH] for PNG-crash

Gunnar Evermann <Gunnar.Evermann(a)nats.informatik.uni-hamburg.de&gt; writes: [rest snipped] I think I found a rather serious error in the PNG-handling code... Deep inside png_instantiate() (glyphs-eimage.c:848) in a nested block some kind of initialization for the upcoming png-read is done, specifically a struct named tbr is declared as a local variable and the address is stored in the png_ptr. the code looks like this: /* Initialize the IO layer and read in header information */ { Lisp_Object data = find_keyword_in_vector (instantiator, Q_data); CONST Extbyte *bytes; Extcount len; struct png_memory_storage tbr; /* Data to be read */ assert (!NILP (data)); /* #### This is a definite problem under Mule due to the amount of stack data it might allocate. Need to think about using Lstreams */ GET_STRING_BINARY_DATA_ALLOCA (data, bytes, len); tbr.bytes = bytes; tbr.len = len; tbr.index = 0; png_set_read_fn (png_ptr,(void *) &tbr, png_read_from_memory); } If I'm not mistaken, at this time (after the closing brace) the stack-allocated tbr can (and will) be overwritten. For me this happens when a new block is opened and new local variables are declared. The following png_read's still access the old location ... Boom! I moved the tbr declaration one level up and this fixes my problem -- somebody who actually knows this code should have a look at it. Gunnar 1998-06-03 Gunnar Evermann <Gunnar.Evermann(a)nats.informatik.uni-hamburg.de&gt; * glyphs-eimage.c (png_instantiate) move 'struct png_memory_storage tbr' out of nested block to avoid dangling reference glyphs-eimage.c =================================================================== RCS file: /usr/CVSroot/XEmacs/xemacs-20/src/glyphs-eimage.c,v retrieving revision 1.2 diff -u -r1.2 glyphs-eimage.c --- glyphs-eimage.c 1998/04/28 00:24:57 1.2 +++ glyphs-eimage.c 1998/06/04 01:32:01 ＠＠ -798,6 +798,7 ＠＠ struct png_unwind_data unwind; int speccount = specpdl_depth (); int height, width; + struct png_memory_storage tbr; /* Data to be read */ /* PNG variables */ png_structp png_ptr; ＠＠ -844,7 +845,6 ＠＠ Lisp_Object data = find_keyword_in_vector (instantiator, Q_data); CONST Extbyte *bytes; Extcount len; - struct png_memory_storage tbr; /* Data to be read */ assert (!NILP (data));