My favorites | Sign in
Logo
                
New issue | Search
for
| Advanced search | Search tips
Issue 39: large multi-dimensional narray segfaults
1 person starred this issue and may be notified of changes. Back to list
Status:  Accepted
Owner:  tmb...@gmail.com
Type-Defect
Priority-Medium
SampleImage


Sign in to add a comment
 
Reported by scott.leishman, Oct 18, 2007
What steps will reproduce the problem?
1. bytearray x;
2. x.resize(100000,30000);  
3. x(10,0) = 5;  //segfault here

What is the expected output? What do you see instead?
Should either create the array and allow access, or throw an exception
during resize.  Instead, a segfault occurs.

What version of the product are you using? On what operating system?
svn revision 489, on Ubuntu.

Please provide any additional information below.
Because the value returned from total_ in colib/narray.h is a signed int,
any attempt to create/resize an array with between INT_MAX and UINT_MAX
total elements will overflow and return a negative value.  If this is done
as part of a resize() call directly after declaration, this will skip the
allocation of any memory as part of alloc_(), and instead reset the
dimensions via setdims_().  The check included in setdims_ will fail to
throw an error (since total will be negative), leading to a segfault when
attempts are made to access the underlying (unallocated) data.
 
Comment 1 by christian.kofler, Nov 07, 2007
Thanks for the report.
Owner: tmbdev
Comment 2 by tmb...@gmail.com, Jan 12, 2009
(No comment was entered for this change.)
Status: Accepted
Comment 3 by tmb...@gmail.com, Jun 14, 2009
(No comment was entered for this change.)
Labels: SampleImage
Sign in to add a comment

Hosted by Google Code