Use FileToBlob() in ImageMagick-CodePudding

I'm attempting to read a file using the ImageMagick C API. For reasons I need to read it as a blob (it could be stdin, and I need to read it twice). Below is a code snippet I'm using to read the file.

size_t blob_length = 0;
ExceptionInfo blob_exception;
printf("about to read blob\n");
void *blob = FileToBlob(filename, 99999999, &blob_length, &blob_exception);
printf("read blob: %ld\n", blob_length);

If filename is a normal filename, things seem to work. If filename is the special value "-" (meaning, read stdin), I get an error:

about to read blob
realloc(): invalid next size
Aborted (core dumped)

gdb shows the following stack trace:

#0  0x00007ffff60a14dc in ?? () from /usr/lib/libc.so.6
#1  0x00007ffff6051998 in raise () from /usr/lib/libc.so.6
#2  0x00007ffff603b53d in abort () from /usr/lib/libc.so.6
#3  0x00007ffff609567e in ?? () from /usr/lib/libc.so.6
#4  0x00007ffff60ab26c in ?? () from /usr/lib/libc.so.6
#5  0x00007ffff60af00c in ?? () from /usr/lib/libc.so.6
#6  0x00007ffff60afd12 in realloc () from /usr/lib/libc.so.6
#7  0x00007ffff7916924 in ResizeMagickMemory () from /usr/lib/libMagickCore-7.Q16HDRI.so.10
#8  0x00007ffff7845d4c in FileToBlob () from /usr/lib/libMagickCore-7.Q16HDRI.so.10
#9  0x0000555555556fa5 in scan_image (filename=filename@entry=0x7fffffffe259 "-")
    at zbarimg/zbarimg.c:187
#10 0x0000555555556840 in main (argc=2, argv=0x7fffffffde28) at zbarimg/zbarimg.c:480

I'm using ImageMagick 7.1.0-47 Q16-HDRI. Checking an online version of the source, I'm a little confused since I see only calls to ResizeQuantumMemory, not ResizeMagickMemory.

I assume the error is on my end (I'm a major C newbie) but I'm not sure what I'm doing wrong.

Edit: I slightly simplified the program (cut it down to just the 5-10 lines needed to reproduce)

//gcc -I/usr/include/ImageMagick-7 -fopenmp -DMAGICKCORE_HDRI_ENABLE=1 -DMAGICKCORE_QUANTUM_DEPTH=16 -lMagickWand-7.Q16HDRI -lMagickCore-7.Q16HDRI magick.c
#include <MagickWand/MagickWand.h>

static int scan_image(const char *filename)
{
    size_t blob_length = 0;
    ExceptionInfo blob_exception;
    printf("about to read blob\n"); 
    void *blob = FileToBlob(filename, 99999999, &blob_length, &blob_exception);
    printf("read blob: %ld\n", blob_length); 
}

int main(int argc, const char *argv[])
{
    scan_image("-");
    return 0;
}

Valgrind output

==947372== Memcheck, a memory error detector
==947372== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et al.
==947372== Using Valgrind-3.19.0 and LibVEX; rerun with -h for copyright info
==947372== Command: ./a.out
==947372== 
about to read blob
==947372== Syscall param read(buf) points to unaddressable byte(s)
==947372==    at 0x4E1EDF1: read (read.c:26)
==947372==    by 0x4A17D72: UnknownInlinedFun (unistd.h:38)
==947372==    by 0x4A17D72: FileToBlob (blob.c:1473)
==947372==    by 0x1091B3: scan_image (in /home/zachary/a.out)
==947372==    by 0x109207: main (in /home/zachary/a.out)
==947372==  Address 0x7a338b1 is 0 bytes after a block of size 81,921 alloc'd
==947372==    at 0x4846CC3: realloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==947372==    by 0x4AE8923: ResizeMagickMemory (memory.c:1407)
==947372==    by 0x4A17D4B: FileToBlob (blob.c:1485)
==947372==    by 0x1091B3: scan_image (in /home/zachary/a.out)
==947372==    by 0x109207: main (in /home/zachary/a.out)
==947372== 
--947372-- VALGRIND INTERNAL ERROR: Valgrind received a signal 7 (SIGBUS) - exiting
--947372-- si_code=128;  Faulting address: 0x0;  sp: 0x1002ca9e40

valgrind: the 'impossible' happened:
   Killed by fatal signal

host stacktrace:
==947372==    at 0x5804D09B: ??? (in /usr/lib/valgrind/memcheck-amd64-linux)
==947372==    by 0x580056B2: ??? (in /usr/lib/valgrind/memcheck-amd64-linux)
==947372==    by 0x5809B33D: ??? (in /usr/lib/valgrind/memcheck-amd64-linux)
==947372==    by 0x580E40C0: ??? (in /usr/lib/valgrind/memcheck-amd64-linux)

sched status:
  running_tid=1

Thread 1: status = VgTs_Runnable (lwpid 947372)
==947372==    at 0x4846CC3: realloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==947372==    by 0x4AE8923: ResizeMagickMemory (memory.c:1407)
==947372==    by 0x4A17D4B: FileToBlob (blob.c:1485)
==947372==    by 0x1091B3: scan_image (in /home/zachary/a.out)
==947372==    by 0x109207: main (in /home/zachary/a.out)
client stack range: [0x1FFEFFA000 0x1FFF000FFF] client SP: 0x1FFEFFFC30
valgrind stack range: [0x1002BAA000 0x1002CA9FFF] top usage: 17872 of 1048576

CodePudding user response：

It was a bug in ImageMagick.

Also, exceptions should apparently be dynamically allocated:

ExceptionInfo *exception = AcquireExceptionInfo();