AnsweredAssumed Answered

ImageToolBox bug report

Question asked by HuangAn on May 10, 2011
Latest reply on May 16, 2011 by Roopa

SoftwareModules\ImageProcessingToolbox-BF-Rel1.4.0_PROD\c_ref\contours_ref.c

 

 

ADI_ITB_MODULE_STATUS adi_contour_segment_image(
                                                ADI_CONTOUR_DYNAMIC_MEM_ALLOC   *pDMA,
                                                const ADI_CONT_RUN_LEN_HDR      *pRunLenListHdr,
                                                uint32_t                        nHeight,
                                                ADI_CONT_SEGMENT_HDR            **pSegmentListHdr,
                                                uint32_t                        *pNumSegments
                                                )
{
    uint32_t                    i;
    uint32_t                    nSegCount;
    uint32_t                    nSegNum;
    uint32_t                    bIsPresent;
    ADI_CONT_RUN_LEN_NODE       *pRunLenNodeTemp;
    ADI_CONT_SEGMENT_HDR        *pSegmentListTempHdr;
    ADI_ITB_STATUS              nReturnValue;
    ADI_CONT_EQU_SEGMENT_HDR    *pEquSegmentListHdr;

 

    nSegCount = 0U;
    pRunLenNodeTemp = NULL;
    pSegmentListTempHdr = NULL;
    pEquSegmentListHdr = NULL;

 

    for (i = 0U; i < nHeight; i++)
    {
        if (pRunLenListHdr[i].pNext != NULL)
        {
            pRunLenNodeTemp = pRunLenListHdr[i].pNext;
            while (pRunLenNodeTemp != NULL)
            {
                if (*pSegmentListHdr == NULL)
                {
                    pSegmentListTempHdr = (ADI_CONT_SEGMENT_HDR *)pDMA->pMemAlloc(pDMA,
                                                                                  (ADI_CONTOUR_SEG_HDR),
                                                                                  1U);
                    if (pSegmentListTempHdr == NULL)
                    {
                        return ((ADI_ITB_MODULE_CONTOURS << 16) | ADI_ITB_STATUS_INSUFFICIENT_MEM);
                    }

 

                    pSegmentListTempHdr->nSegNum = nSegCount;
                    nSegCount++;
                    pSegmentListTempHdr->pNextInSegmentList = NULL;
                    pSegmentListTempHdr->pDown = NULL;
                    *pSegmentListHdr = pSegmentListTempHdr;
                }
                else
                {
                    nReturnValue = isSegmentPresent(pDMA,
                                                    &pRunLenListHdr[i - 1U],
                                                    pRunLenNodeTemp,
                                                    &nSegNum,
                                                    &pEquSegmentListHdr,
                                                    &bIsPresent);

 

 

when i equals 0, the second param of isSegmentPresent tries to access pRunLenListHdr[-1]. i think it may lead to unexpected result in some case.

Outcomes