SixLabors / ImageSharp

:camera: A modern, cross-platform, 2D Graphics library for .NET
https://sixlabors.com/products/imagesharp/
Other
7.34k stars 847 forks source link

`Fatal error. Internal CLR error` when working with image created by pointer-based overload of `Image.WrapMemory<TPixel>` #2779

Closed KirillAldashkin closed 1 month ago

KirillAldashkin commented 1 month ago

Prerequisites

ImageSharp version

3.1.5

Other ImageSharp packages and versions

none

Environment (Operating system, version and so on)

Windows 11 23H2 22631.3880

.NET Framework version

.NET SDK 8.0

Description

This happens when using WrapMemory<TPixel>(void* pointer, int bufferSizeInBytes, int width, int height) and passing buffer that is too small for given width, height and TPixel even with correct bufferSizeInBytes value

Expected behaviour

Exception saying that given buffer is too small for given image size and pixel format

Actual behaviour

Fatal error. Internal CLR error

Steps to Reproduce

Run this code

using SixLabors.ImageSharp;
using SixLabors.ImageSharp.PixelFormats;
using System.Runtime.InteropServices;

unsafe
{
    // these two lines are correct: no overflow ("checked") and no overrun ("bufferSize" is used)
    int bufferSize = checked(8192 * 8192);
    void* data = NativeMemory.Alloc(checked((nuint)bufferSize));
    // passing correct buffer size
    using Image<Rgba64> img = Image.WrapMemory<Rgba64>(data, bufferSize, 8192, 8192);
    // oops!
    img.SaveAsPng("output.png");
    // already crashed at this point
    NativeMemory.Free(data);
}

Images

No response

KirillAldashkin commented 1 month ago

Already found the reason: https://github.com/SixLabors/ImageSharp/blob/65ae451622f5f801f1002e731129d7b105fa430c/src/ImageSharp/Image.WrapMemory.cs#L428 bufferSizeInBytes (in bytes) is compared with memoryManager.Memory.Span.Length (in pixels). X bytes is smaller than X multibyte pixels so it overruns passed buffer