Bug 126048

Summary: pnmrotate: free(): invalid pointer 0x8a27be0!
Product: [Fedora] Fedora Reporter: Don Moore <donmoore>
Component: netpbmAssignee: Phil Knirsch <pknirsch>
Status: CLOSED NEXTRELEASE QA Contact: Ben Levenson <benl>
Severity: medium Docs Contact:
Priority: medium    
Version: 2CC: rvokal
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2004-06-19 22:26:48 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Don Moore 2004-06-15 15:25:33 UTC
Description of problem:
pnmrotate: free(): invalid pointer 0x8a27be0!

Version-Release number of selected component (if applicable):
netpbm-progs-10.19-7

How reproducible:
#!/bin/bash
echo P2\ 1 1\ 255\ 0\ > tmp.pgm
pnmscale 4 tmp.pgm | pnmrotate 10 > tmp1.pgm

Steps to Reproduce:
see above
  
Actual results:
pnmrotate: outrows=5 bgxel red=0
pnmrotate: top left pixel red = 0
pnmrotate: outrows=5 bgxel red=0
pnmrotate: top left pixel red = 0
pnmrotate: outrows=5 bgxel red=0
pnmrotate: top left pixel red = 0
pnmrotate: outrows=5 bgxel red=0
pnmrotate: top left pixel red = 0
pnmrotate: outrows=5 bgxel red=0
pnmrotate: top left pixel red = 0
free(): invalid pointer 0x8330be0!


Expected results:
cat tmp1.pgm
P5
6 5
255


Additional info:
I'm - submitting this on behalf of a professor who often uses netpbm
package. I'm -in certainly not experienced user of netpbm, but I
think- I fixed it with the the small modification, for now. Likewise,
you'll find the program fixed in 10.22 . Plugging netpbm-10.22 as
source for -rebuilding the SRPM via netpbm.spec
fails -because of several patches included in netpbm-10.19 etc.
The user considers the netpbm-progs to be broken -likely because
he has shell scripts -that fail because of this problem. 
: root@regulus editor; diff -Naur pnmrotate.c pnmrotate.c.orig
--- pnmrotate.c 2004-06-15 09:48:35.403519181 -0500
+++ pnmrotate.c.orig    2004-06-15 09:47:57.226359735 -0500
@@ -342,8 +342,8 @@
     for (outrow = 0; outrow < outrows; ++outrow)
         outxels[outrow][col] = bgxel;

-/* pm_message("outrows=%d bgxel red=%d", outrows, PPM_GETR(bgxel));
-pm_message("top left pixel red = %d", PPM_GETR(outxels[0][0])); */
+pm_message("outrows=%d bgxel red=%d", outrows, PPM_GETR(bgxel));
+pm_message("top left pixel red = %d", PPM_GETR(outxels[0][0]));
     prevxel = bgxel;
     for (inrow = 0; inrow < inrows; ++inrow) {
         int const outrow = inrow + intnew0;
@@ -633,7 +633,7 @@
     }

     pnm_freerow( newxelrow );
-    pnm_freearray( temp2xels, newrows );
+    pnm_freearray( temp2xels, rows );
     pm_close( stdout );

     exit( 0 );

Comment 1 Alan Cox 2004-06-19 13:14:01 UTC
Your fix certainly looks correct.


Comment 2 Alan Cox 2004-06-19 22:26:48 UTC
Fix committed to CVS