Memory overwrite while zooming an ECW image

[oren]

Symptom: When calling GDALRasterIO() with a target region larger than the source region (the super sampling case), it causes a memory overwrite.

Solution: In ECWRasterBand::IRasterIO(), “ecwdataset.cpp”, line 446 - change the last parameter of memcpy() from “nLineSpace” to “nBufXSize * nPixelSpace”.

[warmerdam]

Oren,

I tried forcing supersampling with a command like:

gdal_translate -srcwin 0 0 8101 600 -outsize 9000 700 ClearLake.ecw out.tif

and amoung other things this reported:

ECWRasterBand: RasterIO(nXOff=0,nYOff=0,nXSize=8101,nYSize=317 -> 9000x370)

However, according to valgrind there was no buffer overwrites occuring. Can you give me more information on how to trigger this error? Does it require a situation nLineSpace is unusual? I'm guessing that it does.

[Even Rouault]

I could reproduce the problem with an unusual size of buffer:

#include <gdal.h>

int main(int argc, char* argv[])
{
  GDALAllRegister();
  GDALDatasetH hDS = GDALOpen(argv[1], GA_ReadOnly);
  int nBufXSize = 2;
  int nBufYSize = 4;
  int nPixelSpace = 2;
  int nLineSpace = nPixelSpace * nBufXSize;
  char* buf = (char*)malloc((nBufYSize-1)*nLineSpace+(nBufXSize-1)*nPixelSpace+1);
  GDALRasterIO( GDALGetRasterBand(hDS, 1), GF_Read, 0, 0, 1, 2, buf, nBufXSize, nBufYSize, GDT_Byte, nPixelSpace, nLineSpace);
  free(buf);
  GDALClose(hDS);
  return 0;
}

In the case, the suggested fix doesn't work.

Fix to follow.

[Even Rouault]

Fixed in trunk (r16724) and branches/1.6 (r16725)