Segfault when certain LCP applied

Question

Originally reported on Google Code with ID 1464

Hello,

First let me say how much I enjoy Rawtherapee! This is a great piece of software with
many useful features, and I'm happy to contribute in any way I can.

I've found a bug in which Rawtherapee segfaults when a certain lens correction profile
is applied to RAW images. This profile is the default profile for the Tokina 11-16mm
wide angle lens that ships with Adobe software. Please find the LCP and an example
RAW file that exhibits the crash here:
http://bicycle.csail.mit.edu/rawtherapee/

When I load my RAW files (shot on a Nikon D5100 and the Tokina lens), everything seems
to work great. However, almost instantly after I apply the above LCP to correct distortion
and vignetting, Rawtherapee segfaults and closes. Other non-Tokina profiles seem to
work fine for these images, so it seems to just be a problem with this profile.

I admit I haven't looked into the code at all, but I have attached gdb saved the stacktrace
when the segfault occurs - please find its print out in the attached file (segfault.txt).

I'm running Ubuntu 12.04 64-bit.

Thank you very much for your help. Again I am willing to help out in any way I can.
Let me know if you would like any more info.

All the best,
Steve

======
Rawtherapee version information:
Branch: default
Version: 4.0.9.65
Changeset: e64b57efdeda
Compiler: gcc 4.6
Processor: undefined
System: Linux
Bit depth: 64 bits
Gtkmm: V2.24.2
Build type: debug
Build flags:  -march=native -fopenmp -g
Link flags:   -march=native
OpenMP support: ON
MMAP support: ON

Reported by sjlevine29 on 2012-07-06 04:20:18

• Attachment: segfault.txt

该提问来源于开源项目：Beep6581/RawTherapee

Answer 1

Update: I dug a little futher using gdb. It turns out the segfault occurs in LCPProfile::calcParams(...)
on the line 

float f=aPersModel[pm]->focLen;

(this is line 332 in changeset 1956).

The error occurs because aPersModel contains a sprinkling of null references for this
profile within the range of persModelCount (which is 128). See below for an example.
Additionally, upon calling aPersModel[i]->print() a few times for various values of
i, it looks like the parsed aPersModels don't reflect the data from the LCP profile
file. So, I'm guessing this may be an LCP file parsing bug.

That's it for now... Let me know if there's anything more you would like.

Cheers,
Steve


======
See the zeros? 

(gdb) print aPersModel
$21 = {0x7fffc47d2610, 0x7fffc47d0390, 0x7fffc5759520, 0x7fffc57596f0, 0x7fffc5756ac0,
0x7fffc5756c90, 
  0x7fffc5756e60, 0x7fffc5757030, 0x7fffc5757200, 0x7fffc57573d0, 0x7fffc57575a0, 0x7fffc5757770,

  0x7fffc5757940, 0x7fffc5757b10, 0x7fffc5757ce0, 0x7fffc5757eb0, 0x7fffc5758080, 0x7fffc5758250,

  0x7fffc5758420, 0x7fffc57585f0, 0x7fffc57587c0, 0x7fffc575e250, 0x7fffc575e420, 0x7fffc575e5f0,

  0x7fffc575e7c0, 0x7fffc575e990, 0x7fffc575eb60, 0x7fffc575ef00, 0x7fffc575f0d0, 0x7fffc575f2a0,

  0x7fffc575f470, 0x7fffc575f640, 0x7fffc575f810, 0x7fffc575f9e0, 0x7fffc575fbb0, 0x7fffc575fd80,
0x0, 
  0x7fffc5760120, 0x7fffc57602f0, 0x7fffc57604c0, 0x7fffc5760690, 0x7fffc5760860, 0x7fffc5760a30,

  0x7fffc5760c00, 0x7fffc5760dd0, 0x7fffc5760fa0, 0x0, 0x7fffc5761340, 0x7fffc5761510,
0x7fffc57616e0, 
  0x7fffc57618b0, 0x7fffc5761a80, 0x7fffc5761c50, 0x7fffc5761e20, 0x0, 0x7fffc5761ff0,
0x7fffc57621c0, 
  0x7fffc5762390, 0x7fffc5762730, 0x7fffc5762900, 0x7fffc5762ad0, 0x0, 0x7fffc5762ca0,
0x7fffc5762e70, 
  0x7fffc5763210, 0x7fffc57633e0, 0x7fffc57635b0, 0x7fffc5763780, 0x7fffc5763950, 0x7fffc5763b20,

  0x7fffc5763cf0, 0x0, 0x7fffc5764090, 0x7fffc5764260, 0x7fffc5764430, 0x7fffc5764600,
0x7fffc57647d0, 
  0x7fffc57649a0, 0x7fffc5764b70, 0x7fffc5764d40, 0x0, 0x7fffc57650e0, 0x7fffc57652b0,
0x7fffc5765480, 
  0x7fffc5765650, 0x7fffc5765820, 0x7fffc57659f0, 0x0, 0x7fffc5765bc0, 0x7fffc5765d90,
0x7fffc5765f60, 
  0x7fffc5766130, 0x7fffc5766300, 0x7fffc57664d0, 0x7fffc5766870, 0x7fffc5766a40, 0x7fffc5766c10,

  0x7fffc5766de0, 0x7fffc5766fb0, 0x7fffc5767180, 0x0, 0x7fffc5767520, 0x7fffc57676f0,
0x7fffc57678c0, 
  0x7fffc5767a90, 0x7fffc5767c60, 0x0, 0x7fffc5768000, 0x7fffc57681d0, 0x7fffc57683a0,
0x7fffc5768570, 
  0x7fffc5768740, 0x0, 0x7fffc5768910, 0x7fffc5768ae0, 0x7fffc5768cb0, 0x7fffc5768e80,
0x7fffc5769050, 
  0x7fffc5769220, 0x7fffc57693f0, 0x7fffc57695c0, 0x7fffc5769790, 0x7fffc5769960, 0x7fffc5769b30,

  0x7fffc5769d00, 0x7fffc5769ed0, 0x7fffc576a0a0, 0x7fffc576a270, 0x0 <repeats times>}

</repeats>

Reported by sjlevine29 on 2012-07-07 05:22:46