Larry Gritz
c2ff5c2734
* test: Add a corrupted test file * fix(IC): upon tile read error, mark the file as broken The idea is to keep fruitlessly reading from a corrupted file. * fix: race condition in TIFF reader TIFFInput::read_native_tiles had a very subtle race condition. There is a section where it has a task_set of decompression tasks that are sent to the thread queue. When the method ends, the task_set goes out of scope, and its destructor will wait for all the remaining tasks to finish. All fine, right? Except that other variables in the function include unique_ptr's with allocated memory that the tasks need. So what can happen is that if the compiler generates the code such that the destructor of the unique_ptr happens before the destructor of the task_set, the memory that the unique_ptr held may be deallocated before some of the tasks still running in threads have finished. In practice, we seem only to hit this race condition for particular cases involving corrupted files, because the early `return` seems quite likely to run those destructors before all the threads are done, but it was possible to encounter it for valid files as well, if the timing is just right. Shocking that we never had it reported. The solution is just to have an explitit tasks.wait(), which will block until all the tasks have finished before hitting the actual end of the method and letting the other destructors to run. And for the "early return" case, change it to a break so that we go through the wait call at the end. I believe that this fix addresses TALOS-2023-1709 / CVE-2023-24472.
30 lines
1.3 KiB
Plaintext
30 lines
1.3 KiB
Plaintext
Reading src/separate.tif
|
|
src/separate.tif : 128 x 128, 3 channel, uint8 tiff
|
|
SHA-1: 486088DECAE711C444FDCAB009C378F7783AD9C5
|
|
channel list: R, G, B
|
|
compression: "zip"
|
|
DateTime: "2020:10:25 15:32:04"
|
|
Orientation: 1 (normal)
|
|
planarconfig: "separate"
|
|
Software: "OpenImageIO 2.3.0dev : oiiotool --pattern fill:topleft=0,0,0:topright=1,0,0:bottomleft=0,1,0:bottomright=1,1,1 128x128 3 --planarconfig separate -scanline -attrib tiff:rowsperstrip 17 -d uint8 -o separate.tif"
|
|
oiio:BitsPerSample: 8
|
|
tiff:Compression: 8
|
|
tiff:PhotometricInterpretation: 2
|
|
tiff:PlanarConfiguration: 2
|
|
tiff:RowsPerStrip: 7
|
|
Comparing "src/separate.tif" and "separate.tif"
|
|
PASS
|
|
oiiotool ERROR: read : No support for data format of "src/corrupt1.tif"
|
|
Full command line was:
|
|
> oiiotool --oiioattrib try_all_readers 0 --info -v src/corrupt1.tif
|
|
oiiotool ERROR: read : File does not exist: "src/crash-1633.tif"
|
|
Full command line was:
|
|
> oiiotool --oiioattrib try_all_readers 0 --info -v src/crash-1633.tif
|
|
oiiotool ERROR: read : File does not exist: "src/crash-1643.tif"
|
|
Full command line was:
|
|
> oiiotool --oiioattrib try_all_readers 0 --info src/crash-1643.tif -o out.exr
|
|
iconvert ERROR copying "src/crash-1709.tif" to "crash-1709.exr" :
|
|
|
|
Comparing "check1.tif" and "ref/check1.tif"
|
|
PASS
|