imread crashing process (Bug #2602)

Hi,

In short, I recommend changing grfmt_jpeg.cpp#JpegDecoder::readHeader line

jpeg_read_header( &state->cinfo, TRUE );

into:

if (state->cinfo.src != 0)
  jpeg_read_header( &state->cinfo, TRUE );

Namely, if a file is deleted right after loadsave.cpp → imread_ → findDecoder finishes, then on line libjpeg → jdapimin.c → jpeg_consume_input → [cinfo->src->init_source] we'll get a crash.

In long
We're having crashes in the aforementioned place in code when using opencv within our software, although I will need more time to conclude why it's happening exactly, since we have >20 reports and it's impossible that the customers were actually deleting their files in exact moments in time. We're probably having Unicode filenames problems as well, because you use fopen and that's bad with Windows. But this one is a bug anyway, so here it is.

The stack I'm talking about is:

3rdparty / jdapimin.c / jpeg_consume_input
3rdparty / jpeglib.h / jpeg_read_header
highgui / grfmt_jpeg.cpp / JpegDecoder::readHeader
highgui / loadsave.cpp / static void* imread_
highgui / loadsave.cpp / Mat imread( const string& filename, int flags )

In imread, checking if decoder is empty equals checking if the file exists and is readable. The important thing is, this is the last place where this condition will produce null as result of the function. I'll explain.

    ImageDecoder decoder = findDecoder(filename);
    if( decoder.empty() )
        return 0;

Imagine the file exists and is readable and findDecoder::fopen succeeds. Now imagine the file is deleted immediately after this check. imread will continue:

if( !decoder->readHeader() ) ...
...which yields to:
JpegDecoder::readHeader()
{
  ...
  else
  {
    m_f = fopen( m_filename.c_str(), "rb" );
    if( m_f )
      jpeg_stdio_src( &state->cinfo, m_f );
  }
  jpeg_read_header( &state->cinfo, TRUE );
  ...
}

Please note that now fopen will produce null, and the if (m_f) condition will fail. Therefore jpeg_stdio_src shall not be called and state->cinfo->src will still be null. However, in jpeg_read_header which follows unconditionally, jpeg_consume_input is called, and that one uses cinfo->src without checking against null:

jpeg_consume_input (j_decompress_ptr cinfo)
{
  ...
  case DSTATE_START:
    ...
        (*cinfo->src->init_source) (cinfo)  <-- src is null and segmentation fault will follow
}

Regards
Darko Maksimovic