Small bugfix for zm_image.h

[kamand]

Hello, Phil.
In function inline void Assign( const Image &image )
it is possible to go out of source buffer memory and get segmentation fault.

diff -u zm_image.h_orig zm_image.h

Code: Select all

--- zm_image.h_orig     2006-05-08 15:46:53.000000000 +0300
+++ zm_image.h  2006-12-29 11:21:15.000000000 +0200
@@ -220,7 +220,7 @@
                                memset( buffer, 0, size );
                        }
                }
-               memcpy( buffer, image.buffer, size );
+               memcpy( buffer, image.buffer, image.size );
        }

        inline void CopyBuffer( const Image &image )

And something like this patch need to be done for previous method:
inline void Assign( int p_width, int p_height, int p_colours, unsigned char *new_buffer )
This patch is for 1.22.2, but in 1.22.3 this code is not changed.

Happy New Year.
Regards.
Andrew.

[cdtdaddy]

Hello, Phil.
In function inline void Assign( const Image &image )
it is possible to go out of source buffer memory and get segmentation fault.

diff -u zm_image.h_orig zm_image.h

Code: Select all

--- zm_image.h_orig     2006-05-08 15:46:53.000000000 +0300
+++ zm_image.h  2006-12-29 11:21:15.000000000 +0200
@@ -220,7 +220,7 @@
                                memset( buffer, 0, size );
                        }
                }
-               memcpy( buffer, image.buffer, size );
+               memcpy( buffer, image.buffer, image.size );
        }

        inline void CopyBuffer( const Image &image )

And something like this patch need to be done for previous method:
inline void Assign( int p_width, int p_height, int p_colours, unsigned char *new_buffer )
This patch is for 1.22.2, but in 1.22.3 this code is not changed.

Happy New Year.
Regards.
Andrew.

Hi,
thank you for find this bug! I think i was hitting this bug very frequently!
For now, no more zmc crashes!

However, I think that the patch should be the following:

Code: Select all

--- zm_image.h.orig     2006-12-30 02:00:11.000000000 +0100
+++ zm_image.h  2006-12-30 01:59:43.000000000 +0100
@@ -194,7 +194,7 @@
                        pixels = width*height;
                        colours = p_colours;
                        int new_size = width*height*colours;
-                       if ( size < new_size )
+                       if ( size != new_size )
                        {
                                size = new_size;
                                delete[] buffer;
@@ -213,7 +213,7 @@
                        pixels = width*height;
                        colours = image.colours;
                        int new_size = width*height*colours;
-                       if ( size < new_size )
+                       if ( size != new_size )
                        {
                                size = new_size;
                                delete[] buffer;

So if you're assigning a smaller image to the current instance, the "size" and the "buffer" attributes will be updated and you'll read only "size" bytes in the following memcpy().

Thank you again and happy new year to you too.

[zoneminder]

Thanks to you both for posting this. I have added it to my BugZilla and will address it for the next release.