Package: ufraw-batch,ufraw
Version: 0.22-3
Severity: important
Tags: upstream

I am observing a segmentation fault when processing any file with ufraw
or ufraw-batch with any combination of options I tried. The segfault
happens after closing a file:

(gdb) bt
#0  lfModifier::~lfModifier (this=0x0, __in_chrg=<optimized out>) at 
./libs/lensfun/modifier.cpp:270
#1  0x00007f53406cb2f9 in lfModifier::Destroy (this=0x0) at 
./libs/lensfun/modifier.cpp:143
#2  0x00007f53406cb395 in lf_modifier_destroy (modifier=<optimized out>) at 
./libs/lensfun/modifier.cpp:308
#3  0x0000559485cd368a in ufraw_close (uf=0x559487c6ece0) at ufraw_ufraw.c:770
#4  0x0000559485cce2da in main (argc=<optimized out>, argv=<optimized out>) at 
ufraw-batch.c:107
(gdb)

While ufraw takes care to check uf->TCAmodifier against NULL, it doesn't
in ufraw_ufraw.c line 770 and just passes a NULL pointer to
lf_modifier_destroy. Sounds like all we need here is a NULL pointer
check (untested):

--- a/ufraw_ufraw.c
+++ b/ufraw_ufraw.c
@@ -767,7 +767,8 @@
     g_free(uf->displayProfile);
     g_free(uf->RawHistogram);
 #ifdef HAVE_LENSFUN
-    lf_modifier_destroy(uf->TCAmodifier);
+    if (uf->TCAmodifier != NULL)
+        lf_modifier_destroy(uf->TCAmodifier);
     lf_modifier_destroy(uf->modifier);
 #endif
     ufobject_delete(uf->conf->ufobject);

This pretty much breaks ufraw-batch, because it segfaults after
processing the first file.

Helmut

Reply via email to