EVALUATION
The peculiarity of profile in question is that tone curve tags
for red, green, and blue components have incorrect signature:
instead of "curv" it has leading space char (" curv"). The kcms
code failed to recognize given tags as a tone curves and handles
them incorrectly, that leads to failure of a kcms transform creation.
Observed crash is manifestation of inconsistencies in error handling
strategy on several levels of kcms: to recovery after a error some
routines attempt to de-allocate data buffers which are referenced by a
duplicated pointers and aren't de-allocated in normal circumstances.
This cause heap corruption when actual data containers are destroyed
on a higher level.
However, there is a way to resolve this particular problem:
we can make the tag handlers more tolerant to incorrect tag signatures,
i.e. tag signature may be trimmed that makes possible to handle it without
any failures.
|
EVALUATION
The crash occurs in the CMM library code and seems to be caused by the embedded
color profile.
However, without sample image, it is quite hard to figure out actual reason
of the crash. There could be some peculiarities in the color profile that CMM
unable to handle, or there could be some issues in the Image IO plugin that lead
to corruption of the embeddedcolor profile.
We need a sample image in order to be able to investigate this problem,
so I move this CR to incomplete state.
|
Java