Assert failed and wrong stride when load 24bpp color bmp (Bug #50)

Added by Bi11 Wang about 15 years ago. Updated about 15 years ago.

Status:Done Start date:
Priority:Blocker Due date:
Assignee:- % Done:

0%
Category:highgui-images
Target version:-
Affected version: Operating System:
Difficulty: HW Platform:
Pull request:

Description

src/highgui/grfmt_bmp.cpp

441    case 24:
442            for( y = 0; y < m_height; y++, data += step )
443            {
444                m_strm.getBytes( color ? data : src, src_pitch );
445                if( !color )

src_pitch may be greater than the step of data.

e.g., color = true, m_width = 530, 24 bpp bmp file.
data step is 530*3 = 1590,
but src_pitch = ((530*24+7)/8+3)&-4 = 1592, calculated from line

188    int  src_pitch = ((m_width*(m_bpp != 15 ? m_bpp : 16) + 7)/8 + 3) & -4;

So the memcpy in getBytes(), will copy 1592 bytes into data, and overwrite the other members. In my case, Mat::refcount is overwritten, leads to the application crash.

Associated revisions

Revision 09abcd56
Added by Andrey Kamaev over 12 years ago

Merge pull request #50 from taka-no-me:parallel/fix-build-2445

Revision cefc861d
Added by Roman Donchenko over 11 years ago

Merge pull request #50 from alekcac:2.4

History

#1
Updated by anonymous - about 15 years ago

thanks! fixed in r2554

  • Status changed from Open to Done
  • (deleted custom field) set to fixed

#2
Updated by Bi11 Wang about 15 years ago

Code changed in r2554 led to assert failed and wrong stride

src/highgui/grfmt_bmp.cpp

449               else
450                    m_strm.getBytes( data, step );

1. step is a negative value, so assert(count>=0) in getBytes() fails.
2. step in not the correct stride value of the bmp, it's not equal to src_pitch in some cases, such as which described in #50.

  • Status changed from Done to Cancelled
  • (deleted custom field) deleted (fixed)

#3
Updated by anonymous - about 15 years ago

fixed (I think) in r2562

  • Status changed from Cancelled to Done
  • (deleted custom field) set to fixed

Also available in: Atom PDF