[magick-users] segfault when resizing images

[Mick Waters]

Hi Shane,

Did you ever get a reply to this? - I saw that someone promised you a patch within 48 hours but doubt that it happened because the issue still exists in the latest version...

I hit the same problem in ImageMagick 6.3.9-4 and PerlMagick.  The scenario is a Perl script such as yours which passes a Perl file handle to WriteImage().

The sequence of events is:


 1.  A BlobInfo block is allocated and the filename and file pointer are copied into it.
 2.  Because this is a FileStream, ImageMagick doesn't have to open the file so it marks it as exempt from closure (image->blob->exempt = MagickTrue)
 3.  The file is written and a call is made to CloseBlob() (in blob.c) to flush the file, close it if necessary and to free the memory used.
 4.  SyncBlob flushed any unwritten data.
 5.  CloseBlob then returns because the file was not opened in ImageMagick
 6.  Much later, your $image1 variable goes out of scope and a call is made to DestroyBlob() to tidy up - your earlier undef actually does nothing.
 7.  DestroyBlob() calls CloseBlob() because the blob is still in existence and this calls SyncBlob() which, in turn calls fflush().  The issue here is that the file pointer in the BlobInfo structure is no longer valid because you closed the file in Perl and the memory pointed to by the file pointer now doesn't exist or has been used elsewhere and so a Seg Fault occurs.

I made the following change to CloseBlob() in blob.c at line 485 (you need ImageMagick 6.3.9-4 for this):

Replace the two lines:

            if (image->blob->exempt != MagickFalse)
              return(MagickTrue);

with:

            if (image->blob->exempt != MagickFalse) {
              (void) DetachBlob(image->blob);
              return(MagickTrue);
            }

This change frees up the memory used by the BlobInfo block, even if the file close is skipped.

I may get torn to shreds by the ImageMagick developers - there may be a better place to do this but it works for all cases that I can test.

I am going to post this to MagickBugs in the next day or two.

Regards,

Mick.