jpeg-recompress crash with smallfry

[werker]

When I try to compress the following image with the smallfry method, jpeg-recompress crashes. I use the Windows binary (version 2.1.1).

http://i.imgur.com/YQYf8zc.jpg

Could the image dimensions 3000x1705 be the problem?

[shinnn]

I can reproduce the problem on my Mac OS X 10.10.3.

$ jpeg-recompress -V
2.1.0
$ jpeg-recompress -m smallfry in.jpg out.jpg
Metadata size is 0kb
Segmentation fault: 11

Passing the image via STDIN also fails.

$ cat in.jpg | jpeg-recompress -m smallfry -- - out.jpg
Metadata size is 0kb
Segmentation fault: 11

Without -m smallfry, it can produce a new image.

$ jpeg-recompress in.jpg out.jpg
Metadata size is 0kb
ssim at q=67 (40 - 95): 0.990573
Output file would be larger than input!

[danielgtaylor]

Interesting, I'll need to look into this when I get a chance. Is this a new issue in version 2.1.x? Does it work for smaller images?

[ghost]

smallfry crashes, because input images has uneven width/height. e.g. 1007 x 1001.

[tseven]

I can confirm the bug exists on 2.1.1 for OS X. The image it was crashing on for me was 608x505 which supports @Biozynotiker conclusion.

[kirillgroshkov]

Have the same issue. Have 2 images, looking pretty similar:

1. http://i.imgur.com/2JXLpSW.jpg (727x433)
2. http://i.imgur.com/KBITtnU.jpg (735x431)

First one crashes on 'smallfry' method, the second one doesn't. They both have uneven dimensions. The exact command line is:

jpeg-recompress.exe -m smallfry Skoda_Fabia_RS2000_Concept_Car_2011_Ferrari_Red_White_Steels_1.jpg

If I disable subsampling - it works:

jpeg-recompress.exe -m smallfry -S disable Skoda_Fabia_RS2000_Concept_Car_2011_Ferrari_Red_White_Steels_1.jpg

Is it possible to investigate further?

ps: Using version 2.1.1

[Dexus]

Will this ever reviewed and maybe fixed? Or do i neet to always to cut a pixel to make it round width and heigh?

[Dexus]

gdb:

Program received signal SIGSEGV, Segmentation fault.
0x00005555555591d1 in aae_factor (
    orig=0x7ffff69ef020 '\003' <repeats 24 times>, '\004' <repeats 80 times>, '\003' <repeats 40 times>, "\004\004\004\004\004\004\004\004", '\003' <repeats 48 times>...,
    cmp=0x7ffff5651020 '\003' <repeats 24 times>, '\004' <repeats 80 times>, '\003' <repeats 40 times>, "\004\004\004\004\004\004\004\004", '\003' <repeats 48 times>..., orig_stride=3000, cmp_stride=3000, width=3000, height=1705, max=255 '\377') at src/smallfry.c:103
103                 calc /= (abs(HDVAL(j, -1) - DVAL(j)) + abs(HDVAL(j, 1) - HDVAL(j, 2)) + 0.0001) / 2.0;

gdb bt full:

#0  0x00005555555591d1 in aae_factor (
    orig=0x7ffff69ef020 '\003' <repeats 24 times>, '\004' <repeats 80 times>, '\003' <repeats 40 times>, "\004\004\004\004\004\004\004\004", '\003' <repeats 48 times>...,
    cmp=0x7ffff5651020 '\003' <repeats 24 times>, '\004' <repeats 80 times>, '\003' <repeats 40 times>, "\004\004\004\004\004\004\004\004", '\003' <repeats 48 times>..., orig_stride=3000, cmp_stride=3000, width=3000, height=1705, max=255 '\377') at src/smallfry.c:103
        calc = 0
        old = 0x7ffff6ece528 "!\037\037\"&%!\034\033\034\035\036\037 !!\"\031\030\037 \033\036'430,($##\036\"'($\037\032\031%#\035\032\"077&$ \035\034\036$(\"#$%$\"\037\034&\037\027\032*5/\"\r\020\026\037&&\036\027\031\031\031\030\033\",3\" \034\032\031\034!$\031\025\021\023\033\"&&\026\026\025\026\026\030\031\032\027\027\027\026\027\030\033\035% \031\026\027\033\036  !\036\030\027\034\035\033\030\027\030\034 \"\037\035\027\024\024\031 !\034\026\030\027\027\030\033\034\035\034\036(0.$\034\033\035\026\031\034\036\035\033\027\024\037\037 \037\037\037 !!$&% \035\034\036\034\032\030\027\031\034\036\036"...
        new = 0x7ffff5b30528 "\"!!#'&\"\035\033\033\034\035\037  !!\032\031\037 \035 '541-($##\037\"&'$\037\033\030$!\034\033#/89&%\"\037\035 %*!\"$%$!\036\034%\035\027\032(3.#\016\021\026\037%%\036\027\031\030\027\027\032\"+2\"\037\033\031\032\035!$\031\024\021\023\032!$$\025\025\026\026\027\030\031\032\030\030\027\027\030\032\034\036$\037\030\025\027\033\036\037!!\036\031\030\034\035\034\027\027\031\034 !\037\035\026\024\025\031\037 \034\027\031\030\027\031\033\035\035\035 )0/%\035\033\035\027\031\034\036\036\033\027\024\037\037\037\037\036\036\037 !#%#\037\034\034\036\035\032\027\027\032\034\036\036"...
        ret = 6.9533472698316384e-310
        sum = 150195.2101908926
        cfmax = 3.1927905166168227e-307
        cf = 0.9641320796852233
        i = 1703
        j = 872
        cnt = 1274543
#1  0x000055555555952c in smallfry_metric (
    inbuf=0x7ffff69ef020 '\003' <repeats 24 times>, '\004' <repeats 80 times>, '\003' <repeats 40 times>, "\004\004\004\004\004\004\004\004", '\003' <repeats 48 times>...,
    outbuf=0x7ffff5651020 '\003' <repeats 24 times>, '\004' <repeats 80 times>, '\003' <repeats 40 times>, "\004\004\004\004\004\004\004\004", '\003' <repeats 48 times>..., width=3000, height=1705) at src/smallfry.c:151
        p = 0.9641320796852233
        a = 4.9406564584124654e-324
        b = 5.7434649360450604e-135
        max = 255 '\377'
#2  0x0000555555557186 in main (argc=11, argv=0x7fffffffeb08) at jpeg-recompress.c:397
        metric = 104.777657
        quality = 80
        progressive = 1
        optimize = 1
        attempt = 0
        buf = 0x7ffff7f45020 "\377\330\377", <incomplete sequence \340>
        bufSize = 451358
        original = 0x7ffff6ed0020 "\003\003\005\003\003\005\003\003\005\003\003\005\003\003\005\003\003\005\003\003\005\003\003\005\003\003\005\003\003\005\003\003\005\003\003\005\003\003\005\003\003\005\003\003\005\003\003\005\003\003\005\003\003\005\003\003\005\003\003\005\003\003\005\003\003\005\003\003\005\003\003\005\004\004\006\004\004\006\004\004\006\004\004\006\004\004\006\004\004\006\004\004\006\004\004\006\003\004\006\003\004\006\003\004\006\003\004\006\003\004\006\003\004\006\003\004\006\003\004\006\003\004\006\003\004\006\003\004\006\003\004\006\003\004\006\003\004\006\003\004\006\003\004\006\003\004\006\003\004\006\003\004\006\003\004\006\003\004\006\003\004\006\003\004\006\003\004\006\003\004\006\003\004\006\003\004\006\003\004\006\003\004\006\003\004\006\003\004\006\003\004\006\003\004\006\003\004\006\003\004"...
---Type <return> to continue, or q <return> to quit---
        originalSize = 15345000
        originalGray = 0x7ffff69ef020 '\003' <repeats 24 times>, '\004' <repeats 80 times>, '\003' <repeats 40 times>, "\004\004\004\004\004\004\004\004", '\003' <repeats 48 times>...
        originalGraySize = 5115000
        compressed = 0x7ffff4bf4020 "\377\330\377", <incomplete sequence \340>
        compressedSize = 444641
        compressedGray = 0x7ffff5651020 '\003' <repeats 24 times>, '\004' <repeats 80 times>, '\003' <repeats 40 times>, "\004\004\004\004\004\004\004\004", '\003' <repeats 48 times>...
        compressedGraySize = 5115000
        tmpImage = 0x0
        width = 3000
        height = 1705
        metaBuf = 0x7ffff7ffe9c0 "\020\275\377\367\377\177"
        metaSize = 0
        file = 0x0
        cmd = {data = 0x0, usage = 0x5555555b5478 "[options] input.jpg compressed-output.jpg", arg = 0x7ffff7ffe8e0 "100",
          name = 0x7fffffffed64 "/opt/jpeg-archive/jpeg-recompress", version = 0x5555555b5960 "2.1.1", option_count = 17, options = {{optional_arg = 0,
              required_arg = 0, argname = 0x7ffff7ffe280 "", large = 0x7ffff7ffe2a0 "--version", small = 0x5555555b5b3c "-V",
              large_with_arg = 0x5555555b5b32 "--version", description = 0x5555555b5b1b "output program version", cb = 0x5555555595a0 <command_version>}, {
              optional_arg = 0, required_arg = 0, argname = 0x7ffff7ffe2c0 "", large = 0x7ffff7ffe2e0 "--help", small = 0x5555555b5b5e "-h",
              large_with_arg = 0x5555555b5b57 "--help", description = 0x5555555b5b3f "output help information", cb = 0x5555555595d2 <command_help>}, {
              optional_arg = 1, required_arg = 0, argname = 0x7ffff7ffe300 "[arg]", large = 0x7ffff7ffe320 "--target", small = 0x5555555b54cd "-t",
              large_with_arg = 0x5555555b54be "--target [arg]", description = 0x5555555b54a2 "Set target quality [0.9999]", cb = 0x555555556253 <setTarget>}, {
              optional_arg = 1, required_arg = 0, argname = 0x7ffff7ffe340 "[arg]", large = 0x7ffff7ffe360 "--quality", small = 0x5555555b551b "-q",
              large_with_arg = 0x5555555b550b "--quality [arg]", description = 0x5555555b54d0 "Set a quality preset: low, medium, high, veryhigh [medium]",
              cb = 0x55555555627e <setQuality>}, {optional_arg = 1, required_arg = 0, argname = 0x7ffff7ffe380 "[arg]", large = 0x7ffff7ffe3a0 "--min",
              small = 0x5555555b5544 "-n", large_with_arg = 0x5555555b5538 "--min [arg]", description = 0x5555555b551e "Minimum JPEG quality [40]",
              cb = 0x555555556419 <setMinimum>}, {optional_arg = 1, required_arg = 0, argname = 0x7ffff7ffe3c0 "[arg]", large = 0x7ffff7ffe3e0 "--max",
              small = 0x5555555b556d "-x", large_with_arg = 0x5555555b5561 "--max [arg]", description = 0x5555555b5547 "Maximum JPEG quality [95]",
              cb = 0x55555555643e <setMaximum>}, {optional_arg = 1, required_arg = 0, argname = 0x7ffff7ffe400 "[arg]", large = 0x7ffff7ffe420 "--loops",
              small = 0x5555555b55a4 "-l", large_with_arg = 0x5555555b5596 "--loops [arg]", description = 0x5555555b5570 "Set the number of runs to attempt [6]",
              cb = 0x55555555622e <setAttempts>}, {optional_arg = 0, required_arg = 0, argname = 0x7ffff7ffe440 "", large = 0x7ffff7ffe460 "--accurate",
              small = 0x5555555b55cc "-a", large_with_arg = 0x5555555b55c1 "--accurate", description = 0x5555555b55a7 "Favor accuracy over speed",
              cb = 0x5555555564f8 <setAccurate>}, {optional_arg = 1, required_arg = 0, argname = 0x7ffff7ffe480 "[arg]", large = 0x7ffff7ffe4a0 "--method",
              small = 0x5555555b562b "-m", large_with_arg = 0x5555555b561c "--method [arg]",
              description = 0x5555555b55d0 "Set comparison method to one of 'mpe', 'ssim', 'ms-ssim', 'smallfry' [ssim]", cb = 0x55555555634f <setMethod>}, {
              optional_arg = 0, required_arg = 0, argname = 0x7ffff7ffe4c0 "", large = 0x7ffff7ffe4e0 "--strip", small = 0x5555555b5645 "-s",
              large_with_arg = 0x5555555b563d "--strip", description = 0x5555555b562e "Strip metadata", cb = 0x555555556463 <setStrip>}, {optional_arg = 1,
              required_arg = 0, argname = 0x7ffff7ffe500 "[arg]", large = 0x7ffff7ffe520 "--defish", small = 0x5555555b5671 "-d",
              large_with_arg = 0x5555555b5662 "--defish [arg]", description = 0x5555555b5648 "Set defish strength [0.0]", cb = 0x555555556478 <setDefish>}, {
              optional_arg = 1, required_arg = 0, argname = 0x7ffff7ffe540 "[arg]", large = 0x7ffff7ffe560 "--zoom", small = 0x5555555b5697 "-z",
              large_with_arg = 0x5555555b568a "--zoom [arg]", description = 0x5555555b5674 "Set defish zoom [1.0]", cb = 0x5555555564a3 <setZoom>}, {optional_arg = 0,
              required_arg = 0, argname = 0x7ffff7ffe580 "", large = 0x7ffff7ffe5a0 "--ppm", small = 0x5555555b56c9 "-r", large_with_arg = 0x5555555b56c3 "--ppm",
---Type <return> to continue, or q <return> to quit---
              description = 0x5555555b56a0 "Parse input as PPM instead of JPEG", cb = 0x5555555564ce <setPpm>}, {optional_arg = 0, required_arg = 0,
              argname = 0x7ffff7ffe5c0 "", large = 0x7ffff7ffe5e0 "--no-copy", small = 0x5555555b570c "-c", large_with_arg = 0x5555555b5702 "--no-copy",
              description = 0x5555555b56d0 "Disable copying files that will not be compressed", cb = 0x5555555564e3 <setCopyFiles>}, {optional_arg = 0,
              required_arg = 0, argname = 0x7ffff7ffe600 "", large = 0x7ffff7ffe640 "--no-progressive", small = 0x5555555b573d "-p",
              large_with_arg = 0x5555555b572c "--no-progressive", description = 0x5555555b570f "Disable progressive encoding",
              cb = 0x555555556404 <setNoProgressive>}, {optional_arg = 1, required_arg = 0, argname = 0x7ffff7ffe680 "[arg]", large = 0x7ffff7ffe6c0 "--subsample",
              small = 0x5555555b5798 "-S", large_with_arg = 0x5555555b5786 "--subsample [arg]",
              description = 0x5555555b5740 "Set subsampling method. Valid values: 'default', 'disable'. [default]", cb = 0x55555555670c <setSubsampling>}, {
              optional_arg = 0, required_arg = 0, argname = 0x7ffff7ffe700 "", large = 0x7ffff7ffe720 "--quiet", small = 0x5555555b57ba "-Q",
              large_with_arg = 0x5555555b57b2 "--quiet", description = 0x5555555b579b "Only print out errors.", cb = 0x55555555678c <setQuiet>}, {
              optional_arg = -136537396, required_arg = 32767, argname = 0x200000000000000 <error: Cannot access memory at address 0x200000000000000>,
              large = 0x7ffff7ffda60 "", small = 0x555555554966 "stderr",
              large_with_arg = 0x7ffff7dc9b91 <_dlstart+883> "\353\036E\205\377u\vL\211\347\350\371\375\377\377A\211\307H\211\352D\211\376L\211\347\350)\376\377\377H\205\300t]f\203x\006", description = 0x7ffff7d75f68 "\a\004", cb = 0x1c8bf23900000000}, {optional_arg = 7483336, required_arg = 0, argname = 0x555555554966 "stderr",
              large = 0x555555555eb0 "\260\360)", small = 0x0, large_with_arg = 0x7ffff7ffd880 "", description = 0x5555557f30b0 <stderr> "\300\260\377\367\377\177",
              cb = 0x555555554818}, {optional_arg = -136536028, required_arg = 32767, argname = 0x3 <error: Cannot access memory at address 0x3>, large = 0x0,
              small = 0x18 <error: Cannot access memory at address 0x18>, large_with_arg = 0x0, description = 0x555555554000 "\177ELF\002\001\001",
              cb = 0x5555555542d8}, {optional_arg = 1431652664, required_arg = 21845, argname = 0x5 <error: Cannot access memory at address 0x5>, large = 0x0,
              small = 0x0, large_with_arg = 0x0, description = 0x7ffff7ffd880 "", cb = 0x7fffffffe750}, {optional_arg = 15872, required_arg = 67108865,
              argname = 0x7ffff7ffd880 "",
              large = 0x7ffff7da895b <mprotect+53> "Z\303SH\270\376\377\377\377\377\377\377\177H\203\354pH9\302L\211D$`v\021\350$\204\376\377", <incomplete sequence \307>, small = 0x0, large_with_arg = 0x7ffff7dca913 "\205\300t6\350\203d\374\377\203\070&t,H\213s\bH\215=\232\372\002",
              description = 0x1203fea <error: Cannot access memory at address 0x1203fea>, cb = 0x1}, {optional_arg = 0, required_arg = 0,
              argname = 0x29ee08 <error: Cannot access memory at address 0x29ee08>, large = 0x0, small = 0x938 <error: Cannot access memory at address 0x938>,
              large_with_arg = 0x2d8 <error: Cannot access memory at address 0x2d8>, description = 0xc68 <error: Cannot access memory at address 0xc68>, cb = 0x1260},
            {optional_arg = 24, required_arg = 0, argname = 0x32e <error: Cannot access memory at address 0x32e>,
              large = 0x18 <error: Cannot access memory at address 0x18>, small = 0x1ec8 <error: Cannot access memory at address 0x1ec8>,
              large_with_arg = 0x613a2 <error: Cannot access memory at address 0x613a2>, description = 0x0, cb = 0x0}, {optional_arg = 0, required_arg = 0,
              argname = 0x0, large = 0x0, small = 0x0, large_with_arg = 0x0, description = 0x7ffff7ffd9e0 "\001", cb = 0x0}, {optional_arg = 0, required_arg = 0,
              argname = 0x0, large = 0x0, small = 0x0, large_with_arg = 0x0, description = 0x0, cb = 0x0}, {optional_arg = 0, required_arg = 0,
              argname = 0x7fffffffeb08 "d\355\377\377\377\177", large = 0x168 <error: Cannot access memory at address 0x168>,
              small = 0x7ffff7ffdc48 "H\334\377\367\377\177", large_with_arg = 0x0, description = 0x7ffff7dcc119 <__dls3+2248> <incomplete sequence \307>,
              cb = 0x7fffffffec18}, {optional_arg = -5368, required_arg = 32767, argname = 0x0, large = 0x38 <error: Cannot access memory at address 0x38>,
              small = 0x8283fbf8 <error: Cannot access memory at address 0x8283fbf8>, large_with_arg = 0x0, description = 0x0, cb = 0x555555554040}, {
              optional_arg = 56, required_arg = 0, argname = 0x8 <error: Cannot access memory at address 0x8>,
              large = 0x1000 <error: Cannot access memory at address 0x1000>, small = 0x7ffff7d73000 "\177ELF\002\001\001", large_with_arg = 0x0,
              description = 0x5555555560bf <_start> "H1\355H\211\347H\215\065\354\313)", cb = 0x0}, {optional_arg = 0, required_arg = 0, argname = 0x0, large = 0x0,
              small = 0x0, large_with_arg = 0x7fffffffed59 "x86_64", description = 0xf8bfbff <error: Cannot access memory at address 0xf8bfbff>, cb = 0x64}, {
              optional_arg = 0, required_arg = 0, argname = 0x0, large = 0x0, small = 0x0, large_with_arg = 0x0,
              description = 0x7ffff7d908f1 <__init_ssp+29> "\353\nHi\303mN\306AH\211\003dH\213\004%", cb = 0x0}, {optional_arg = -134227840, required_arg = 32767,
              argname = 0x0, large = 0x555555555ed3 <incomplete sequence \303>, small = 0x0,
              large_with_arg = 0x7ffff7dca9f7 "\366D$\003\002u\006\205\355t*\353CL\213\264", <incomplete sequence \330>,
              description = 0x1203fea <error: Cannot access memory at address 0x1203fea>, cb = 0x1}}, argc = 2, argv = {
---Type <return> to continue, or q <return> to quit---
            0x7ffff7ffe900 "/tmp/PBNYfBP1JttX2ZYyO86p9GYPQxhGK21U/demo_img_02_l.jpg", 0x7ffff7ffe960 "/tmp/PBNYfBP1JttX2ZYyO86p9GYPQxhGK21U/demo_img_02_2.jpg", 0x0,
            0x2d8 <error: Cannot access memory at address 0x2d8>, 0xc68 <error: Cannot access memory at address 0xc68>,
            0x1260 <error: Cannot access memory at address 0x1260>, 0x18 <error: Cannot access memory at address 0x18>,
            0x32e <error: Cannot access memory at address 0x32e>, 0x18 <error: Cannot access memory at address 0x18>,
            0x1ec8 <error: Cannot access memory at address 0x1ec8>, 0x613a2 <error: Cannot access memory at address 0x613a2>, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
            0x7ffff7ffd9e0 "\001", 0x0 <repeats 11 times>, 0x7fffffffeb08 "d\355\377\377\377\177", 0xb <error: Cannot access memory at address 0xb>},
          nargv = 0x7ffff7ffe740}
        min = 80
        max = 79
        percent = 0
        saved = 0

[marcing]

+1 I have it on multiple images, size does not matter. I do not use smallfry at all because of this.

[lfos]

I just tried to reproduce this with current master but everything works fine for me... Does this only happen under OS X and Windows?

[marcing]

For me it happens on windows, but only for some JPEGs.

[rsuzuki0]

This happens to me about 1 out of 20 JPEGs and also only with smallfry. The problem is image-specific and reliable.

[jlebar]

I am also hitting this.

I built with asan and -O0 -g and got the following

==29033==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x000117f9099a at pc 0x00010c31d2ea bp 0x7ffee38eb930 sp 0x7ffee38eb928
READ of size 1 at 0x000117f9099a thread T0
    #0 0x10c31d2e9 in aae_factor smallfry.c:103
    #1 0x10c31c047 in smallfry_metric smallfry.c:151
    #2 0x10c315c93 in main jpeg-recompress.c:470
    #3 0x7fff661a52e4 in start (libdyld.dylib:x86_64+0x112e4)

0x000117f9099a is located 0 bytes to the right of 28090778-byte region [0x0001164c6800,0x000117f9099a)
allocated by thread T0 here:
    #0 0x10c40e7d3 in wrap_malloc (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x607d3)
    #1 0x10c31bcbe in grayscale edit.c:69
    #2 0x10c3152a9 in main jpeg-recompress.c:393
    #3 0x7fff661a52e4 in start (libdyld.dylib:x86_64+0x112e4)

SUMMARY: AddressSanitizer: heap-buffer-overflow smallfry.c:103 in aae_factor
Shadow bytes around the buggy address:
  0x100022ff20e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100022ff20f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100022ff2100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100022ff2110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100022ff2120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x100022ff2130: 00 00 00[02]fa fa fa fa fa fa fa fa fa fa fa fa
  0x100022ff2140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x100022ff2150: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x100022ff2160: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x100022ff2170: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x100022ff2180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==29033==ABORTING
Abort trap: 6

[jlebar]

Here is the image that I'm crashing on -- hopefully github doesn't recompress it. :)