Rotate segfaults in /home/darktable/rpmbuild/BUILD/darktable-3.4.1/src/develop/tiling.c:1143

[UsefGeorge]

Built darktable from rpm sourced designed for Fedora
[Mail@omen-gatworks ~]$ uname -a
Linux omen-gatworks 5.8.15-201.fc32.x86_64 #1 SMP Thu Oct 15 15:56:44 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
Surprised it came together and worked.
Anyway, imported some 3k .jpgs as well as some NEF * nikon raw files"
Picked on one of them to play. During the rotate feature, darktable deceided to segfault.
Tried again, but used gdb to see where its issue is located:

On 3/18/21 10:12 AM, Postmaster wrote:

param: 4, val: 0
cl_get_gt_device(): error, unknown device: 0
Cloning into '/home/darktable/.config/darktable/lua'...
remote: Enumerating objects: 47, done.
remote: Counting objects: 100% (47/47), done.
remote: Compressing objects: 100% (32/32), done.
remote: Total 3499 (delta 26), reused 31 (delta 15), pack-reused 3452
Receiving objects: 100% (3499/3499), 939.66 KiB | 34.00 KiB/s, done.
Resolving deltas: 100% (2283/2283), done.
fatal: destination path '/home/darktable/.config/darktable/lua' already
exists and is not an empty directory.
fatal: destination path '/home/darktable/.config/darktable/lua' already
exists and is not an empty directory.
Segmentation fault (core dumped)
======================================================
command name abbreviations are allowed if unambiguous.
(gdb) bt
#0 0x00007ffff7af1532 in __memmove_avx_unaligned_erms () at /lib64/libc.so.6
#1 0x00007ffff7d9ba05 in memcpy (__len=, __src=, __dest=) at /usr/include/bits/string_fortified.h:34
#2 _default_process_tiling_roi._omp_fn.1 () at /home/darktable/rpmbuild/BUILD/darktable-3.4.1/src/develop/tiling.c:1143
#3 0x00007ffff77fcdce in gomp_thread_start () at /lib64/libgomp.so.1
#4 0x00007ffff7973432 in start_thread () at /lib64/libpthread.so.0
#5 0x00007ffff7a8d913 in clone () at /lib64/libc.so.6
(gdb)

thats all i know.

[UsefGeorge]

it appears that there is an improper value of -1 in the structure "oroi_good.height" this appears to cause the loop to spin until there no 16char chunks anymore :(

tiling.c:1142
for(size_t j = 0; j < oroi_good.height; j++)
memcpy((char *)ovoid + ooffs + j * opitch,
(char *)output + ((j + origin_y) * oroi_full.width + origin_x) * out_bpp,
(size_t)oroi_good.width * out_bpp);

Now, upon startup, that picture causes a "Working" to be displayed on the picture, and a segfault on the "terminal" window running gdb/darktable.

[UsefGeorge]

gdb.txt

[github-actions]

This issue did not get any activity in the past 30 days and will be closed in 365 days if no update occurs. Please check if the master branch has fixed it and report again or close the issue.

[jenshannoschwalm]

@johnny-bit from my understanding this was a rotate error in rcd, is fixed so close the issue :-)

[johnny-bit]

yes sir!

[UsefGeorge]

any referense #

[johnny-bit]

@jenshannoschwalm - which PR # could have fixed this?

[jenshannoschwalm]

#8856 should have fixed it.

[johnny-bit]

Thanks!

[UsefGeorge]

Well, it still core dumps? Thats from
git clone git://github.com/darktable-org/darktable.git
June 1st. I dont kow where u keep vers number in DT!
which i presume is 3.5

[UsefGeorge]

how does one un-do an improper close? Clicking on "CLOSED" does nothing

[johnny-bit]

version can be checked with darktable --version

Can you attach an xmp that causes an issue and if necessary - image file?

i tried to replicate via rotation (CW/CCW) and never got tilling problems. I tried with different demosaicers...

[jenshannoschwalm]

I also would be very interested in thos files. Also; are you using lua scripts by any chance?

Also, you mentioned source rpms in your initial descriptions, now have cloned the git here to compile? Also Fedora - i am also using it, still fedora 33 here. What sys are you using, F34? Already on gcc 11?

[johnny-bit]

@UsefGeorge - can you produce the files? We're very interested in getting to the bottom of the issue.

[johnny-bit]

@UsefGeorge - Please send sample files and requested information. Currently we lack information to start investigating...

[jenshannoschwalm]

There have been at least 3 pr's fixing rotate issues ...

[johnny-bit]

@jenshannoschwalm - yes, there were. And I couldn't reproduce this.. AND it's tiling related.

buuuut...

Looking tat the code in question it might be possible to overshot calculation for wd & ht since it has size_t problem I was hunting in memory alocations. Eg if for some reason tile_htis negative or calculaton for roi_out->height - ty * tile_ht overflows int or goes negative it'll make unsigned ht go bonkers.

i think there's a possibility for int overshot so "sanitization" of that calcoulation COULD be

/* the output dimensions of the good part of this specific tile */
      size_t wd = (tx + 1) * tile_wd > roi_out->width ? (size_t)roi_out->width - tx * tile_wd : tile_wd;
      size_t ht = (ty + 1) * tile_ht > roi_out->height ? (size_t)roi_out->height - ty * tile_ht : tile_ht;

what do you think?

[jenshannoschwalm]

don't know. can't imagine int overflows here, checks for <= 0 might be necessary to find where something goes wrong. The --enforce-tiling option might help here :-)

[github-actions]

This issue did not get any activity in the past 30 days and will be closed in 365 days if no update occurs. Please check if the master branch has fixed it and report again or close the issue.

[johnny-bit]

@jenshannoschwalm - can you take a look at #9701 if it's ok? if it's ok then it'll close this issue. if not then i guess we'll be closing this issue untill we get sample files to reproduce the issue.

[jenshannoschwalm]

For me that looks good, although I don't know how to test as I also didn't have a reproducer here. Btw I had been testing this after the tiling debug option a lot .