segmentation fault with specific image file

[tony_ck]

[img][img][img][img]hello
I use IMK library for my image converting server.
I'm using Magick++ library, and version is ImageMagick-7.0.1-9

Recently I found a bug.

I use
Image::read() function. (http://www.imagemagick.org/Magick++/Image.html)
when I try to read a specific image file, the IMK library suddenly terminated with segmentation fault.
read from URL, read from BLOB, read from File cause same result.
I can't attach this problematic image file to this topic.
Instead, I add this image file url. You can download this file (no virus, spyware, malicious code included.)
http://bigfile.mail.naver.com/bigfileup ... 3SaxbXpg==

Here is the core file read with GDB.
#0 0x0000003935a7b395 in memcpy () from /lib64/libc.so.6
#1 0x0000003e5d80c40e in ?? () from /usr/lib64/libtiff.so.3
#2 0x0000003e5d80b018 in TIFFSetField () from /usr/lib64/libtiff.so.3
#3 0x0000003e5d80dfdc in ?? () from /usr/lib64/libtiff.so.3
#4 0x0000003e5d80f545 in TIFFReadDirectory () from /usr/lib64/libtiff.so.3
#5 0x0000003e5d827f79 in TIFFClientOpen () from /usr/lib64/libtiff.so.3
#6 0x00002b1a51052356 in ReadTIFFImage (image_info=0x1efa8ec0, exception=0x1f19a220) at coders/tiff.c:1155
#7 0x00002b1a50df2e0d in ReadImage (image_info=0x1efa5c90, exception=0x1f19a220) at MagickCore/constitute.c:554
#8 0x00002b1a50dc300c in BlobToImage (image_info=0x1f17f370, blob=0x1f1f3840, length=14590816, exception=0x1f19a220) at MagickCore/blob.c:370
#9 0x00002b1a4d47e775 in Magick::Image::read (this=0x2b1a64fe1bb0, blob_=<value optimized out>) at Magick++/lib/Image.cpp:3967

I also try to read this Image By using identify Command. But, It causes same result.
identify a.jpg
=> segmentation fault.

Please reply me how can I fix this problem.
If it throws exception and finish with error, It's OK.
But if it terminate with segmentation fault, It can be a serious problem for running image converting server.
Because the server process must not be down.

Thanks for your help in advance.

[fmw42]

Your image is read (mostly) fine in IM 7.0.4.0 Q16 Mac OSX. Note that your download file has been tagged with .jpg, though IM thinks it is .tif. There is one problem listed at the bottom.

Code: Select all

magick identify -quiet -verbose proc_down_tif.jpg
Image: proc_down_tif.jpg
  Format: TIFF (Tagged Image File Format)
  Mime type: image/tiff
  Class: DirectClass
  Geometry: 4080x3028+0+0
  Resolution: 72x72
  Print size: 56.6667x42.0556
  Units: PixelsPerInch
  Type: Bilevel
  Base type: TrueColor
  Endianess: LSB
  Colorspace: sRGB
  Depth: 16/1-bit
  Channel depth:
    Gray: 1-bit
  Channel statistics:
    Pixels: 12354240
    Gray:
      min: 0 (0)
      max: 0 (0)
      mean: 0 (0)
      standard deviation: 0 (0)
      kurtosis: 0
      skewness: 0
      entropy: nan
  Colors: 1
  Histogram:
  12354240: (    0,    0,    0) #000000000000 black
  Rendering intent: Perceptual
  Gamma: 0.454545
  Chromaticity:
    red primary: (0.64,0.33)
    green primary: (0.3,0.6)
    blue primary: (0.15,0.06)
    white point: (0.3127,0.329)
  Alpha color: grey74
  Background color: white
  Border color: srgb(223,223,223)
  Transparent color: none
  Interlace: None
  Intensity: Undefined
  Compose: Over
  Page geometry: 4080x3028+0+0
  Dispose: Undefined
  Iterations: 0
  Compression: None
  Orientation: RightTop
  Properties:
    comment: 
    date:create: 2017-01-05T00:15:41-08:00
    date:modify: 2017-01-05T00:15:40-08:00
    signature: 5b36a33f2a8fd5f41c62b460500e39192af5bae958305b50107d7c597abdfbd9
    tiff:alpha: unspecified
    tiff:copyright: 
    tiff:endian: lsb
    tiff:kodak-36867: 2016:08:22 06:46:15
    tiff:make: Huawei
    tiff:model: Nexus 6P
    tiff:photometric: unknown
    tiff:rows-per-strip: 1
    tiff:software: google/angler/angler:6.0.1/MTC20F/3031278:user/release-keys
    tiff:timestamp: 2016:08:22 06:46:15
  Artifacts:
    verbose: true
  Tainted: False
  Filesize: 14.59MB
  Number pixels: 12.35M
  Pixels per second: 35.3MB
  User time: 0.340u
  Elapsed time: 0:01.349
  Version: ImageMagick 7.0.4-0 Q16 x86_64 2016-12-18 http://www.imagemagick.org
identify: Sorry, can not handle image with PhotometricInterpretation=32803. `proc_down_tif.jpg' @ error/tiff.c/TIFFErrors/565.

If I change the suffix to .tif, I get a similar report.

The magick command will convert the image, but I think it is corrupt or invalid and so both viewing the original and the result are both totally black.

Another tool, Mac Preview says the format is Adobe Raw. So perhaps you have a raw format with a jpg or tif suffix or header.

EXIFTOOL says the file is of type DNG.

Code: Select all

exiftool -s -ee -g1 -u -n -D proc_down_tif.jpg
---- ExifTool ----
    - ExifToolVersion                 : 8.71
---- System ----
    - FileName                        : proc_down_tif.jpg
    - Directory                       : .
    - FileSize                        : 14590816
    - FileModifyDate                  : 2017:01:05 00:15:40-08:00
    - FilePermissions                 : 644
---- File ----
    - FileType                        : DNG
    - MIMEType                        : image/x-adobe-dng
    - ExifByteOrder                   : II
---- IFD0 ----
  254 SubfileType                     : 0
  256 ImageWidth                      : 4080
  257 ImageHeight                     : 3028
  258 BitsPerSample                   : 16
  259 Compression                     : 1
  262 PhotometricInterpretation       : 32803
  270 ImageDescription                : 
  271 Make                            : Huawei
  272 Model                           : Nexus 6P
  273 StripOffsets                    : (Binary data 25901 bytes, use -b option to extract)
  274 Orientation                     : 6
  277 SamplesPerPixel                 : 1
  278 RowsPerStrip                    : 1
  279 StripByteCounts                 : (Binary data 15139 bytes, use -b option to extract)
  282 XResolution                     : 72
  283 YResolution                     : 72
  284 PlanarConfiguration             : 1
  296 ResolutionUnit                  : 2
  305 Software                        : google/angler/angler:6.0.1/MTC20F/3031278:user/release-keys
  306 ModifyDate                      : 2016:08:22 06:46:15
33421 CFARepeatPatternDim             : 2 2
33422 CFAPattern2                     : 0 1 1 2
33432 Copyright                       : 
33434 ExposureTime                    : 0.024997622
33437 FNumber                         : 2
34855 ISO                             : 280
36867 DateTimeOriginal                : 2016:08:22 06:46:15
37386 FocalLength                     : 4.67
37398 TIFF-EPStandardID               : 1 0 0 0
50706 DNGVersion                      : 1 4 0 0
50707 DNGBackwardVersion              : 1 1 0 0
50708 UniqueCameraModel               : Nexus 6P-Huawei-google
50710 CFAPlaneColor                   : 0 1 2
50711 CFALayout                       : 1
50713 BlackLevelRepeatDim             : 2 2
50714 BlackLevel                      : 52 52 52 52
50717 WhiteLevel                      : 1023
50718 DefaultScale                    : 1 1
50719 DefaultCropOrigin               : 8 8
50720 DefaultCropSize                 : 4016 3008
50721 ColorMatrix1                    : 0.8125 -0.2265625 -0.125 -0.3203125 1.265625 0.0390625 -0.046875 0.2265625 0.453125
50722 ColorMatrix2                    : 1.015625 -0.2890625 -0.21875 -0.5625 1.6328125 -0.046875 -0.0703125 0.2109375 0.640625
50723 CameraCalibration1              : 1 0 0 0 1 0 0 0 0.9921875
50724 CameraCalibration2              : 1 0 0 0 1 0 0 0 0.9921875
50728 AsShotNeutral                   : 0.5234375 1 0.46875
50778 CalibrationIlluminant1          : 21
50779 CalibrationIlluminant2          : 17
50829 ActiveArea                      : 2 48 3026 4080
50964 ForwardMatrix1                  : 0.578125 0.21875 0.1640625 0.15625 0.84375 0 -0.015625 -0.2890625 1.1328125
50965 ForwardMatrix2                  : 0.6875 0.015625 0.265625 0.2109375 0.6796875 0.1015625 0 -0.5390625 1.3671875
51009 OpcodeList2                     : (Binary data 3908 bytes, use -b option to extract)
51022 OpcodeList3                     : (Binary data 4 bytes, use -b option to extract)
51041 NoiseProfile                    : 0.00054916278 3.437120968e-06 0.00054916278 3.437120968e-06 0.00054916278 3.437120968e-06
---- Composite ----
    - Aperture                        : 2
    - CFAPattern                      : 2 2 0 1 1 2
    - ImageSize                       : 4080x3028
    - ShutterSpeed                    : 0.024997622
    - FocalLength35efl                : 4.67
    - LightValue                      : 5.83663850339644

So it looks like the file is a different format that has been wrongly tagged with a different suffix.


If I change the suffix to .dng, then the file converts to png mostly. The left half is purple stripes, but the right half looks fine. However, my old Photoshop CS will not open the file.

Code: Select all

magick dng:proc_down_tif.dng proc_down_tif.png

see http://www.imagemagick.org/script/formats.php where it says:

"DNG R Digital Negative Requires an explicit image format otherwise the image is interpreted as a TIFF image (e.g. dng:image.dng)."

I am not an expert on all this. So one of the IM developers will have to look further into this. But it seems to be corrupt in some manner.

[tony_ck]

Hi fmw42.
Thanks for your help.
I really appreciate it.
As you mentioned before, I build IMK version IM 7.0.4-2 Q16 and try to read that file.
But, it didn't work.

When I run identify.. it goes wrong way.

Code: Select all

./identify -quiet -verbose proc_down_tif.jpg
terminate (core dumped)

I can't know what the problem is...
Could you tell me how you build this library?
configuring option or something.

Thanks

[magick]

We identified / converted your image without complaint using ImageMagick 7.0.4-2 and libtiff 4.0.7. Our release of ImageMagick includes a memory debugger to alert us if memory is stepped on-- we did not receive any corruption notices. We're do not know why it fails for you.

[snibgo]

The file does seem to be corrupt. Renaming it with a .dng extension, and converting with dcraw, gives:

Code: Select all

f:\web\im>dcraw -T -v proc_down_tif.dng

Loading Huawei Nexus 6P image from proc_down_tif.dng
proc_down_tif.dng: Unexpected end of file
Scaling with darkness 52, saturation 1023, and
multipliers 2.390310 1.000000 1.254042 1.000000
AHD interpolation...
Converting to sRGB colorspace...
Writing data to proc_down_tif.tiff ...

Note: "Unexpected end of file".

The result is as Fred says, okay on the right side (the aspect ratio is portrait) but not the left.

The file seems to be corrupt. Why does it have a JPG extension? Perhaps it has been through some software that incorreectly processed it. If you have the original file, from the camera, it may be okay.

[magick]

Thanks for the problem report. We can reproduce it and will have a patch to fix it in GIT master branch @ https://github.com/ImageMagick/ImageMagick later today. The patch will be available in the beta releases of ImageMagick @ http://www.imagemagick.org/download/beta/ by sometime tomorrow.