Address issues reported by Undefined Behavior Sanitizer running IlmImfTest #828
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Peter Hillman <peterh@wetafx.co.nz>
…r undefined) Signed-off-by: Peter Hillman <peterh@wetafx.co.nz>
Signed-off-by: Peter Hillman <peterh@wetafx.co.nz>
Signed-off-by: Peter Hillman <peterh@wetafx.co.nz>
cary-ilm
reviewed
Sep 5, 2020
| @@ -99,12 +103,18 @@ bool compare(const FrameBuffer& asRead, | |||
| exit(1); | |||
| } | |||
|
|
|||
|
|
|||
| // | |||
| // extract value written to gile | |||
cary-ilm
reviewed
Sep 5, 2020
| @@ -150,7 +150,7 @@ readWriteFiles (const char fileName1[], | |||
| file2.setFrameBuffer (pixels2 - dx - dy * w, 1, w); | |||
| file2.readPixels (dw.min.y, dw.max.y); | |||
|
|
|||
| for (int i = 0; i < w * h; ++h) | |||
| for (size_t i = 0; i < w * h; ++i) | |||
cary-ilm
reviewed
Sep 5, 2020
|
|
||
| // cast to half float if necessary | ||
| if(it.slice().type==OPENEXR_IMF_INTERNAL_NAMESPACE::FLOAT) | ||
| { | ||
| * (float *)(it.slice().base + y*it.slice().yStride + x*it.slice().xStride) = value; | ||
|
|
||
| * reinterpret_cast<float*>(base + y*it.slice().yStride + x*it.slice().xStride) = value; |
There was a problem hiding this comment.
These statements sure would be easier to read split in two, with a pointer variable assignment followed by the *ptr = value:
float* ptr = reinterpret_cast<float*>(base + y*it.slice().yStride + x*it.slice().xStride);
*ptr = value;
Signed-off-by: Peter Hillman <peterh@wetafx.co.nz>
cary-ilm
approved these changes
Sep 7, 2020
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Running IlmImfTest when compiling with clang's UndefinedBehaviorSanitizer (UBSan) reported various issues, which are addressed here.
IlmThread
The only way to join an IlmThread (i.e. wait for it to finish) is to delete it, as there's a join() in the base class destructor. However, that means a thread derived from IlmThread will have its destructor called while it is running. The thread object's vtable will change underneath it, making it impossible to call virtual functions. I think it might also lead to a use-after-free issue, as the derived class destructor will be called while it is running.
This change adds a
join()to the Thread function. The ThreadPool uses this to ensure worker threads have terminated before deleting them. Code directly using Thread should callThread::join()before the object is deleted (or goes out of scope).Thread::joinis not virtual, so the ABI is backwards compatiblePointer overflow
The
Slicemechanism inFrameBuffercan require 'negative pointers' for thebaseitem when the image bbox is cropped, as it points to the coordinates of pixel (0,0) which may be outside the image data. Performing arithmetic on a pointer that results in negative values is undefined behavior. This change usesintptr_tfor such math instead ofchar*which sneakily suppresses the warning.Pointer alignment
4 byte ints and floats can only be read/written from 4-byte aligned addresses, and 8 byte ints from 8-byte aligned addresses. A partial fix supported float access, for 32 bit ARM processors. This extends the fix to all types.
minor bugfixes
UBSan also spotted a few issues in the test suite: a division by zero, indexing into unintialized Array2Ds, and an iterator that didn't iterate