Saving PNGs causes segfault

[Jordan Christiansen]

I found a reproducible segfault crash on the tip of master.

Steps to reproduce:

1. Open GIMP, create and save a PNG file.
2. Open the PNG in GrafX2.
3. Click "Save as" and change the name of the file to be a different name than the original file.
4. Click "Save".

Just in case, I've attached a basic PNG file that I was able to use to reproduce the issue.

Details of my system:
Ubuntu 18.10 x86_64
I compiled with the default compile-time options (just "make")

Stack trace:

#0  0x00005555555f4423 in Save_PNG_Sub (context=context@entry=0x7fffffffcb50, 
    file=file@entry=0x55555574baa0, buffer=buffer@entry=0x0, 
    buffer_size=buffer_size@entry=0x0) at fileformats.c:6965
#1  0x00005555555f4487 in Save_PNG (context=0x7fffffffcb50)
    at fileformats.c:6981
#2  0x00005555555a3db8 in Save_image (context=context@entry=0x7fffffffcb50)
    at loadsave.c:1121
#3  0x0000555555588e12 in Save_picture (type=type@entry=CONTEXT_MAIN_IMAGE)
    at buttons.c:3562
#4  0x0000555555588fbe in Button_Save (btn=<optimized out>) at buttons.c:3594
#5  0x00005555555a9f40 in Select_button (btn_number=btn_number@entry=44, 
    click=<optimized out>) at engine.c:506
#6  0x00005555555b0c0f in Main_handler () at engine.c:1584
#7  0x000055555556fd27 in main (argc=<optimized out>, argv=<optimized out>)
    at main.c:1378

fileformats.c:6965 is:

	    *buffer = memory_buffer.buffer;

Context:

6960	
6961	  if (Row_pointers)
6962	    free(Row_pointers);
6963	  if (memory_buffer.buffer)
6964	  {
6965	    *buffer = memory_buffer.buffer;
6966	    *buffer_size = memory_buffer.offset;
6967	  }
6968	}
6969

[Jordan Christiansen]

File that causes a segfault in GrafX2

[Jordan Christiansen]

Actually, it's a simpler problem than that. Saving any PNG is broken. I made a mistake in my testing earlier.

This bug was introduced in ​3e1d6b16: Copy support for X11.

[Thomas Bernard]

Indeed this is a bug introduced when splitting Save_PNG() function.

see ​https://gitlab.com/GrafX2/grafX2/merge_requests/157

[Thomas Bernard]

fixed in 2.6.2483
see ​https://gitlab.com/GrafX2/grafX2/-/jobs/148653871/artifacts/browse