bugGChemPaint - Bugs: bug #14825, Segfault when trying to save as...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #14825: Segfault when trying to save as image

Submitted by:  None
Submitted on:  Wed 19 Oct 2005 03:37:06 PM UTC  
 
Category: NoneSeverity: 4 - Important
Item Group: NoneStatus: Fixed
Privacy: PublicAssigned to: Jean Bréfort <jean_brefort>
Open/Closed: Closed

Fri 11 Nov 2005 04:10:50 PM UTC, comment #3:

On some occasions, the buffer was too small. My fault !
Fixed in CVS.

Jean Bréfort <jean_brefort>
Project AdministratorIn charge of this item.
Thu 10 Nov 2005 05:27:18 PM UTC, comment #2:

I can reproduce by painting tyrosine from the amino acid templates and saving it. It does not occur with alanine, for example. This makes sense, since it appears to be a small memory overrun and this may be structure-specific as for what the effect is or whether it happens at all. Here's gdb:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1209129296 (LWP 14908)]
0x007f672c in _int_malloc () from /lib/libc.so.6
(gdb) bt
#0 0x007f672c in _int_malloc () from /lib/libc.so.6
#1 0x007f7b52 in malloc () from /lib/libc.so.6
#2 0x0598c546 in png_malloc_default () from /usr/lib/libpng12.so.0
#3 0x0598c5cf in png_malloc () from /usr/lib/libpng12.so.0
#4 0x05974ca8 in png_zalloc () from /usr/lib/libpng12.so.0
#5 0x00b1ac31 in deflateInit2_ () from /usr/lib/libz.so.1
#6 0x0597cfbd in png_write_IHDR () from /usr/lib/libpng12.so.0
#7 0x059831dd in png_write_info_before_PLTE () from /usr/lib/libpng12.so.0
#8 0x05983426 in png_write_info () from /usr/lib/libpng12.so.0
#9 0x008eb8a8 in ?? ()
from /usr/lib/gtk-2.0/2.4.0/loaders/libpixbufloader-png.so
#10 0x00523025 in gdk_pixbuf_savev () from /usr/lib/libgdk_pixbuf-2.0.so.0
#11 0x005232fe in gdk_pixbuf_save () from /usr/lib/libgdk_pixbuf-2.0.so.0
#12 0x00778f1e in gcpView::ExportImage (this=0x9a60978,
filename=0x9c0cd98 "/tmp/x.png", type=0x99e77f4 "png") at view.cc:1069
#13 0x00727e00 in gcpDocument::ExportImage (this=0x0,
filename=0x9c0cd98 "/tmp/x.png", type=0x99e77f4 "png") at document.cc:1124
#14 0x0071d1df in gcpApplication::OnSaveAsImage (this=0x98e6c10)
at application.cc:869

Since it appears there's some memory overflow before this happens (usually the case when malloc crashes), here's the televant valgrind output:

==14934== Conditional jump or move depends on uninitialised value(s)
==14934== at 0x93B2C6: gnome_canvas_render_svp (in /usr/lib/libgnomecanvas-2.so.0.1000.0)
==14934== by 0x928BFE: (within /usr/lib/libgnomecanvas-2.so.0.1000.0)
==14934== by 0x93E331: (within /usr/lib/libgnomecanvas-2.so.0.1000.0)
==14934== by 0x1B98CF03: gcpView::ExportImage(char const, char const) (view.cc:1068)
==14934== by 0x1B93BDFF: gcpDocument::ExportImage(char const, char const) (document.cc:1124)
==14934== by 0x1B9311DE: gcpApplication::OnSaveAsImage() (application.cc:869)
==14934== by 0xC9E7E6: g_cclosure_marshal_VOID__VOID (in /usr/lib/libgobject-2.0.so.0.600.6)
==14934== by 0xC93284: g_closure_invoke (in /usr/lib/libgobject-2.0.so.0.600.6)
==14934== by 0xCA175A: (within /usr/lib/libgobject-2.0.so.0.600.6)
==14934== by 0xCA2EAF: g_signal_emit_valist (in /usr/lib/libgobject-2.0.so.0.600.6)
==14934== by 0xCA3222: g_signal_emit (in /usr/lib/libgobject-2.0.so.0.600.6)
==14934== by 0x255135: (within /usr/lib/libgtk-x11-2.0.so.0.600.10)
==14934==
==14934== Invalid write of size 1
==14934== at 0x1B9092E8: memset (mac_replace_strmem.c:360)
==14934== by 0x57FA0FB: art_rgb_fill_run (in /usr/lib/libart_lgpl_2.so.2.3.17)
==14934== by 0x57FC095: (within /usr/lib/libart_lgpl_2.so.2.3.17)
==14934== by 0x57FF7A0: art_svp_render_aa (in /usr/lib/libart_lgpl_2.so.2.3.17)
==14934== by 0x57FC2B7: art_rgb_svp_alpha (in /usr/lib/libart_lgpl_2.so.2.3.17)
==14934== by 0x93B419: gnome_canvas_render_svp (in /usr/lib/libgnomecanvas-2.so.0.1000.0)
==14934== by 0x928BFE: (within /usr/lib/libgnomecanvas-2.so.0.1000.0)
==14934== by 0x93E331: (within /usr/lib/libgnomecanvas-2.so.0.1000.0)
==14934== by 0x1B98CF03: gcpView::ExportImage(char const, char const) (view.cc:1068)
==14934== by 0x1B93BDFF: gcpDocument::ExportImage(char const, char const) (document.cc:1124)
==14934== by 0x1B9311DE: gcpApplication::OnSaveAsImage() (application.cc:869)
==14934== by 0xC9E7E6: g_cclosure_marshal_VOID__VOID (in /usr/lib/libgobject-2.0.so.0.600.6)
==14934== Address 0x1C575FA8 is 0 bytes after a block of size 119616 alloc'd
==14934== at 0x1B908222: malloc (vg_replace_malloc.c:130)
==14934== by 0xBCFC4D: g_try_malloc (in /usr/lib/libglib-2.0.so.0.600.6)
==14934== by 0x1A174B: gdk_pixbuf_new (in /usr/lib/libgdk_pixbuf-2.0.so.0.600.10)
==14934== by 0x1B98CD7A: gcpView::ExportImage(char const, char const) (view.cc:1058)
==14934== by 0x1B93BDFF: gcpDocument::ExportImage(char const, char const) (document.cc:1124)
==14934== by 0x1B9311DE: gcpApplication::OnSaveAsImage() (application.cc:869)==14934== by 0xC9E7E6: g_cclosure_marshal_VOID__VOID (in /usr/lib/libgobject-2.0.so.0.600.6)
==14934== by 0xC93284: g_closure_invoke (in /usr/lib/libgobject-2.0.so.0.600.6)
==14934== by 0xCA175A: (within /usr/lib/libgobject-2.0.so.0.600.6)
==14934== by 0xCA2EAF: g_signal_emit_valist (in /usr/lib/libgobject-2.0.so.0.600.6)
==14934== by 0xCA3222: g_signal_emit (in /usr/lib/libgobject-2.0.so.0.600.6)
==14934== by 0x255135: (within /usr/lib/libgtk-x11-2.0.so.0.600.10)
==14934==
==14934== Conditional jump or move depends on uninitialised value(s)
==14934== at 0x93B2C6: gnome_canvas_render_svp (in /usr/lib/libgnomecanvas-2.so.0.1000.0)
==14934== by 0x806B9AA: gnome_canvas_shape_ext_render (gcp-canvas-shape.c:719)
==14934== by 0x93E331: (within /usr/lib/libgnomecanvas-2.so.0.1000.0)
==14934== by 0x93E331: (within /usr/lib/libgnomecanvas-2.so.0.1000.0)
==14934== by 0x1B98CF03: gcpView::ExportImage(char const, char const) (view.cc:1068)
==14934== by 0x1B93BDFF: gcpDocument::ExportImage(char const, char const) (document.cc:1124)
==14934== by 0x1B9311DE: gcpApplication::OnSaveAsImage() (application.cc:869)
==14934== by 0xC9E7E6: g_cclosure_marshal_VOID__VOID (in /usr/lib/libgobject-2.0.so.0.600.6)
==14934== by 0xC93284: g_closure_invoke (in /usr/lib/libgobject-2.0.so.0.600.6)
==14934== by 0xCA175A: (within /usr/lib/libgobject-2.0.so.0.600.6)
==14934== by 0xCA2EAF: g_signal_emit_valist (in /usr/lib/libgobject-2.0.so.0.600.6)
==14934== by 0xCA3222: g_signal_emit (in /usr/lib/libgobject-2.0.so.0.600.6)
--14934-- INTERNAL ERROR: Valgrind received a signal 11 (SIGSEGV) - exiting
--14934-- si_code=1 Fault EIP: 0xB0031411; Faulting address: 0x3
--14934-- esp=0xB0408E48

Ronald S. Bultje <rbultje>
Wed 19 Oct 2005 05:53:34 PM UTC, comment #1:

I can't reproduce this bug. I would like to know:
- the version of GChamPaint,
- the file format selected (png, jpg, svg, eps, other?)

If you could attach the file to the bug it might also help.

Jean Bréfort <jean_brefort>
Project AdministratorIn charge of this item.
Wed 19 Oct 2005 03:37:06 PM UTC, original submission:

I wanted to paint ubichinon structure, but when I want to save it as a file program crash-es.

Anonymous

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 7 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Sun 13 Nov 2005 09:48:48 AM UTCjean_brefortOpen/ClosedOpen=>Closed
Fri 11 Nov 2005 04:10:50 PM UTCjean_brefortStatusConfirmed=>Fixed
Thu 10 Nov 2005 05:27:18 PM UTCrbultjeCarbon-Copy-=>Added -unavailable-
Thu 10 Nov 2005 05:00:43 PM UTCjean_brefortStatusNeed Info=>Confirmed
Wed 19 Oct 2005 05:53:34 PM UTCjean_brefortSeverity3 - Normal=>4 - Important
  StatusNone=>Need Info
  Assigned toNone=>jean_brefort

Back to the top


Powered by Savane 3.1-cleanup1