Access violation with gflLoadBitmapFromHandle() and IStream

[Defenestration]

I'm using gflLoadBitmapFromHandle() to load an image from an IStream. A pointer to an IStream object is passed in, along with the GFL callback functions for Read, Seek and Tell being setup in LOAD_PARAMS.

In these GFL callback functions, I use the IStream object pointer to access the Read() and Seek() methods.

Everything works OK unless the load is cancelled mid-way through, which can cause an access violation. If an IStream becomes invalid, the Read() and Seek() methods return a value other than S_OK. When this occurs, I return -1 from the GFL callback functions.

As you can see from the attached screen shot, the heap gets corrupted.

NOTE: the crash doesn't always occur, so it must depend on where in the load operation the abort takes place.

[dominique]

Can't see your screenshot

[Defenestration]

There was a problem with imageshack.us, but it appears to be fixed now.

[Defenestration]

After further testing, it would appear there is also a problem with the WantCancel() callback when using gflLoadBitmap(), as it still returns GFL_NO_ERROR when WantCancel() return TRUE, with a partially formed bitmap (ie. the bit that hasn't loaded is just black), which is not expected behaviour.

Instead, you should create a new error code (eg. GFL_ERROR_CANCELLED) and return immediately from gflLoadBitmap() when WantCancel() returns TRUE. The fact you haven't returned GFL_NO_ERROR means the bitmap can be in a corrupt state (so there's no need to fill out the rest with black, unless this is done when the bitmap is first created anyway at the beginning of the load).

While this doesn't cause a crash, it may be related to the gflLoadBitmapFromHandle() access violation.

[Defenestration]

The fact you haven't returned GFL_NO_ERROR means the bitmap can be in a corrupt state (so there's no need to fill out the rest with black, unless this is done when the bitmap is first created anyway at the beginning of the load).

Actually, the bitmap should be freed since if the load does not return GFL_NO_ERROR, the user will not be expecting a bitmap (and so will not do a gflFreeBitmap(), resulting in a leak).

[Defenestration]

Hi Pierre,

I know you're busy with XnView/XnView MP development, but would it be possible to get a fix for these issues ?

[xnview]

Sorry for the delay of my reply...

Do you have always the problem with IStream??

After further testing, it would appear there is also a problem with the WantCancel() callback when using gflLoadBitmap(), as it still returns GFL_NO_ERROR when WantCancel() return TRUE, with a partially formed bitmap (ie. the bit that hasn't loaded is just black), which is not expected behaviour.

If WanCancel returns TRUE, gflLoadBitmap returns GFL_UNKNOWN_ERROR

[Defenestration]

Sorry for the delay of my reply...

No problem. I know you are busy with XnViewMP.

Do you have always the problem with IStream??

I only get the crash when using an IStream but, as mentioned, the crash doesn't always occur, so it must depend on where in the load operation the abort takes place. During testing, I begin loading a large file and then cancel it during the load operation. Sometimes it crashes, other times it does not.

After further testing, it would appear there is also a problem with the WantCancel() callback when using gflLoadBitmap(), as it still returns GFL_NO_ERROR when WantCancel() return TRUE, with a partially formed bitmap (ie. the bit that hasn't loaded is just black), which is not expected behaviour.

If WanCancel returns TRUE, gflLoadBitmap returns GFL_UNKNOWN_ERROR

I haven't looked at the code for a while, but from memory it was definitely returning GFL_NO_ERROR when the WantCancel() callback function returned TRUE. I will double check this though and get back to you.

Let me know if you want me to test a new build, or have a later build which I can test with.

[xnview]

Let me know if you want me to test a new build, or have a later build which I can test with.

Send me your email by PM

[Defenestration]

PM sent