[argyllcms] dispwin: memory corruption when loading EDID profile

  • From: Török Edwin <edwin+argyll@xxxxxxxxxx>
  • To: argyllcms@xxxxxxxxxxxxx
  • Date: Tue, 13 Aug 2013 21:31:15 +0300

Hi,

Loading an .icc with proper calibration works, but loading one generated from 
EDID crashes dispwin on Linux x86_64.
I can reproduce the crash with version 1.5.1 and 1.6.0_beta:

$ /home/edwin/me/language/C/Argyll_V1.6.0_beta/bin/dispwin -v -d1 -c -I 
SyncMaster.icc
About to open dispwin object on the display
About to clear the calibration
Dispwin: Warning - No vcgt tag found in profile - assuming linear

About to install 'SyncMaster.icc' as display's default profile
*** Error in `/home/edwin/me/language/C/Argyll_V1.6.0_beta/bin/dispwin': 
malloc(): memory corruption: 0x00000000012cf7e0 ***


I've done some tests with valgrind, see below. FWIW valgrind shows similar 
warnings when loading a calibration .icc too, but there is no crash when run 
w/o valgrind in that case.

valgrind shows for 1.6.0_beta (manually built):
$ valgrind /home/edwin/me/language/C/Argyll_V1.6.0_beta/bin/dispwin -v -d1 -c 
-I SyncMaster.icc
==2421== Memcheck, a memory error detector
==2421== Copyright (C) 2002-2012, and GNU GPL'd, by Julian Seward et al.
==2421== Using Valgrind-3.8.1 and LibVEX; rerun with -h for copyright info
==2421== Command: /home/edwin/me/language/C/Argyll_V1.6.0_beta/bin/dispwin -v 
-d1 -c -I SyncMaster.icc
==2421== 
About to open dispwin object on the display
About to clear the calibration
Dispwin: Warning - No vcgt tag found in profile - assuming linear

About to install 'SyncMaster.icc' as display's default profile
==2421== Invalid write of size 1
==2421==    at 0x4A0A652: __GI_strcat (mc_replace_strmem.c:264)
==2421==    by 0x4C49CF: ucmm_install_monitor_profile (in 
/home/edwin/HDD/me/language/C/Argyll_V1.6.0_beta/bin/dispwin)
==2421==    by 0x408119: dispwin_install_profile (in 
/home/edwin/HDD/me/language/C/Argyll_V1.6.0_beta/bin/dispwin)
==2421==    by 0x4059FA: main (in 
/home/edwin/HDD/me/language/C/Argyll_V1.6.0_beta/bin/dispwin)
==2421==  Address 0x4fcc768 is 0 bytes after a block of size 40 alloc'd
==2421==    at 0x4A09E2B: malloc (vg_replace_malloc.c:270)
==2421==    by 0x4C495C: ucmm_install_monitor_profile (in 
/home/edwin/HDD/me/language/C/Argyll_V1.6.0_beta/bin/dispwin)
==2421==    by 0x408119: dispwin_install_profile (in 
/home/edwin/HDD/me/language/C/Argyll_V1.6.0_beta/bin/dispwin)
==2421==    by 0x4059FA: main (in 
/home/edwin/HDD/me/language/C/Argyll_V1.6.0_beta/bin/dispwin)
==2421== 
==2421== Invalid read of size 1
==2421==    at 0x4A0A410: __GI_strchr (mc_replace_strmem.c:219)
==2421==    by 0x4CB97A: xdg_bds (in 
/home/edwin/HDD/me/language/C/Argyll_V1.6.0_beta/bin/dispwin)
==2421==    by 0x4C49F3: ucmm_install_monitor_profile (in 
/home/edwin/HDD/me/language/C/Argyll_V1.6.0_beta/bin/dispwin)
==2421==    by 0x408119: dispwin_install_profile (in 
/home/edwin/HDD/me/language/C/Argyll_V1.6.0_beta/bin/dispwin)
==2421==    by 0x4059FA: main (in 
/home/edwin/HDD/me/language/C/Argyll_V1.6.0_beta/bin/dispwin)
==2421==  Address 0x4fcc768 is 0 bytes after a block of size 40 alloc'd
==2421==    at 0x4A09E2B: malloc (vg_replace_malloc.c:270)
==2421==    by 0x4C495C: ucmm_install_monitor_profile (in 
/home/edwin/HDD/me/language/C/Argyll_V1.6.0_beta/bin/dispwin)
==2421==    by 0x408119: dispwin_install_profile (in 
/home/edwin/HDD/me/language/C/Argyll_V1.6.0_beta/bin/dispwin)
==2421==    by 0x4059FA: main (in 
/home/edwin/HDD/me/language/C/Argyll_V1.6.0_beta/bin/dispwin)
==2421== 
==2421== Invalid read of size 1
==2421==    at 0x4A0A884: __GI_strlen (mc_replace_strmem.c:400)
==2421==    by 0x4CBB4D: xdg_bds (in 
/home/edwin/HDD/me/language/C/Argyll_V1.6.0_beta/bin/dispwin)
==2421==    by 0x4C49F3: ucmm_install_monitor_profile (in 
/home/edwin/HDD/me/language/C/Argyll_V1.6.0_beta/bin/dispwin)
==2421==    by 0x408119: dispwin_install_profile (in 
/home/edwin/HDD/me/language/C/Argyll_V1.6.0_beta/bin/dispwin)
==2421==    by 0x4059FA: main (in 
/home/edwin/HDD/me/language/C/Argyll_V1.6.0_beta/bin/dispwin)
==2421==  Address 0x4fcc768 is 0 bytes after a block of size 40 alloc'd
==2421==    at 0x4A09E2B: malloc (vg_replace_malloc.c:270)
==2421==    by 0x4C495C: ucmm_install_monitor_profile (in 
/home/edwin/HDD/me/language/C/Argyll_V1.6.0_beta/bin/dispwin)
==2421==    by 0x408119: dispwin_install_profile (in 
/home/edwin/HDD/me/language/C/Argyll_V1.6.0_beta/bin/dispwin)
==2421==    by 0x4059FA: main (in 
/home/edwin/HDD/me/language/C/Argyll_V1.6.0_beta/bin/dispwin)
==2421== 
Installed 'SyncMaster.icc' and made it the default
About to destroy dispwin object


valgrind shows for 1.5.1 (1.5.1-2 from Debian):
$ valgrind /usr/bin/dispwin -v -d1 -c -I SyncMaster.icc
==3445== Memcheck, a memory error detector
==3445== Copyright (C) 2002-2012, and GNU GPL'd, by Julian Seward et al.
==3445== Using Valgrind-3.8.1 and LibVEX; rerun with -h for copyright info
==3445== Command: /usr/bin/dispwin -v -d1 -c -I SyncMaster.icc
==3445== 
About to open dispwin object on the display
About to clear the calibration
Dispwin: Warning - No vcgt tag found in profile - assuming linear

About to install 'SyncMaster.icc' as display's default profile
==3445== Invalid write of size 1
==3445==    at 0x4A0A652: __GI_strcat (mc_replace_strmem.c:264)
==3445==    by 0x5316353: ucmm_install_monitor_profile (in 
/usr/lib/x86_64-linux-gnu/argyll/libucmm.so.0.0.0)
==3445==    by 0x405ECD: dispwin_install_profile (in /usr/bin/dispwin)
==3445==    by 0x404D3E: ??? (in /usr/bin/dispwin)
==3445==    by 0x30B7821994: (below main) (libc-start.c:260)
==3445==  Address 0x7055ee8 is 0 bytes after a block of size 40 alloc'd
==3445==    at 0x4A09E2B: malloc (vg_replace_malloc.c:270)
==3445==    by 0x53162E0: ucmm_install_monitor_profile (in 
/usr/lib/x86_64-linux-gnu/argyll/libucmm.so.0.0.0)
==3445==    by 0x405ECD: dispwin_install_profile (in /usr/bin/dispwin)
==3445==    by 0x404D3E: ??? (in /usr/bin/dispwin)
==3445==    by 0x30B7821994: (below main) (libc-start.c:260)
==3445== 
==3445== Invalid read of size 1
==3445==    at 0x4A0A410: __GI_strchr (mc_replace_strmem.c:219)
==3445==    by 0x510EAE4: xdg_bds (in 
/usr/lib/x86_64-linux-gnu/argyll/libconv.so.0.0.0)
==3445==    by 0x5316374: ucmm_install_monitor_profile (in 
/usr/lib/x86_64-linux-gnu/argyll/libucmm.so.0.0.0)
==3445==    by 0x405ECD: dispwin_install_profile (in /usr/bin/dispwin)
==3445==    by 0x404D3E: ??? (in /usr/bin/dispwin)
==3445==    by 0x30B7821994: (below main) (libc-start.c:260)
==3445==  Address 0x7055ee8 is 0 bytes after a block of size 40 alloc'd
==3445==    at 0x4A09E2B: malloc (vg_replace_malloc.c:270)
==3445==    by 0x53162E0: ucmm_install_monitor_profile (in 
/usr/lib/x86_64-linux-gnu/argyll/libucmm.so.0.0.0)
==3445==    by 0x405ECD: dispwin_install_profile (in /usr/bin/dispwin)
==3445==    by 0x404D3E: ??? (in /usr/bin/dispwin)
==3445==    by 0x30B7821994: (below main) (libc-start.c:260)
==3445== 
==3445== Invalid read of size 1
==3445==    at 0x4A0A884: __GI_strlen (mc_replace_strmem.c:400)
==3445==    by 0x510ECC5: xdg_bds (in 
/usr/lib/x86_64-linux-gnu/argyll/libconv.so.0.0.0)
==3445==    by 0x5316374: ucmm_install_monitor_profile (in 
/usr/lib/x86_64-linux-gnu/argyll/libucmm.so.0.0.0)
==3445==    by 0x405ECD: dispwin_install_profile (in /usr/bin/dispwin)
==3445==    by 0x404D3E: ??? (in /usr/bin/dispwin)
==3445==    by 0x30B7821994: (below main) (libc-start.c:260)
==3445==  Address 0x7055ee8 is 0 bytes after a block of size 40 alloc'd
==3445==    at 0x4A09E2B: malloc (vg_replace_malloc.c:270)
==3445==    by 0x53162E0: ucmm_install_monitor_profile (in 
/usr/lib/x86_64-linux-gnu/argyll/libucmm.so.0.0.0)
==3445==    by 0x405ECD: dispwin_install_profile (in /usr/bin/dispwin)
==3445==    by 0x404D3E: ??? (in /usr/bin/dispwin)
==3445==    by 0x30B7821994: (below main) (libc-start.c:260)
==3445== 
Installed 'SyncMaster.icc' and made it the default
About to destroy dispwin object
==3445== 
==3445== HEAP SUMMARY:
==3445==     in use at exit: 4,597 bytes in 12 blocks
==3445==   total heap usage: 595 allocs, 583 frees, 244,165 bytes allocated
==3445== 
==3445== LEAK SUMMARY:
==3445==    definitely lost: 4,597 bytes in 12 blocks
==3445==    indirectly lost: 0 bytes in 0 blocks
==3445==      possibly lost: 0 bytes in 0 blocks
==3445==    still reachable: 0 bytes in 0 blocks
==3445==         suppressed: 0 bytes in 0 blocks
==3445== Rerun with --leak-check=full to see details of leaked memory
==3445== 
==3445== For counts of detected and suppressed errors, rerun with: -v
==3445== ERROR SUMMARY: 3 errors from 3 contexts (suppressed: 2 from 2)

Attachment: SyncMaster.icc
Description: application/vnd.iccprofile

Other related posts: