Page MenuHome

Crash : Malformed .bmp files lead to crash.
Confirmed, NormalPublic

Description

There is no bounds checking in source\blender\imbuf\intern\bmp.c leading to out of bound access if the bmp file is malformed.

repro:

  1. Copy the attached bmp files to the default folder (on windows c:\Users\[username]\Documents\
  2. Click the Shader tab
  3. The file dialog in the upper left will try to make thumbnails, and crash while doing it.

Note: The problem exists in the 16bpp (rgb565) codepath as well but i had nothing that could write that format.

Note2: The header checks also do not respect the buffer bounds, i didn't have time to make to make a crashing bmp, but whoever will work on this will have to fix that as well.

note3: the crashy bmp files are created by taking a regular bmp file and truncating it to about half their size, leading to a correct header, but not enough image data in the file.

[Original report]

System Information
Operating system: Windows 10 Pro, Version 1903, Build: 18362.476
Graphics card: Nvidia GTX 980 TI Driver 441.20

Blender Version
Broken: 2.181 release
Worked: (optional)

On fresh install of 2.81, startup with default project.
Select the Shader tab and Blender crashes with:

found bundled python: C:\Program Files\Blender Foundation\Blender 2.81\2.81\python
Error : EXCEPTION_ACCESS_VIOLATION
Address : 0x00007FF63621A4B0
Module : C:\Program Files\Blender Foundation\Blender 2.81\blender.exe

Revisions and Commits

Related Objects

Event Timeline

Had the same issue with 2.80

Ed H. (Ed-H) updated the task description. (Show Details)Nov 27 2019, 5:38 AM

This is strange, it seems that the graphics driver is one of the latest.
https://www.geforce.com/drivers?nvid=nv-int-bnnr-96776#cid=internal_en-us_banner_gtx_900_series_upgrade

But we do not have much information to know what is happening.
Try after loading Factory Settings. (File -> Defaults -> Load Factory Settings)

Germano Cavalcante (mano-wii) lowered the priority of this task from 90 to 30.Nov 28 2019, 6:06 PM

Did loading the factory settings have any effect?

Germano Cavalcante (mano-wii) raised the priority of this task from 30 to 80.Nov 29 2019, 12:53 PM
Richard Antalik (ISS) changed the task status from Needs Developer to Reproduce to Needs Information from User.Jan 16 2020, 4:33 PM

Is this still an issue with latest build? https://builder.blender.org/download/

Still fails with 2.82:
Build info:

Blender 2.82 (sub 6)
Build: 2020-01-27 00:03:00 Windows Release

Also tested with 2.83:
Still fails.

Build info:

Blender 2.83 (sub 1)
Build: 2020-01-27 00:29:53 Windows Release
Richard Antalik (ISS) changed the task status from Needs Information from User to Needs Developer to Reproduce.Jan 27 2020, 12:07 PM
Ed H. (Ed-H) added a comment.EditedFeb 10 2020, 8:15 AM

Still happening with 'blender-2.83-cdfaddbb1d42-windows64'

Is there anything else I can do on my end?

This comment was removed by Ed H. (Ed-H).

Just tested with 2.90 May 18th alpha. Still crashes on Shader tab.

Was a fix ever found for this? Or can I nolonger use blender

I noticed that if I open this project and click the Shader tab Blender *does not* crash. So maybe there is some initialization or un-initialized value somewhere(?).

Can you try a daily 2.90? When it crashes it should with a bit of luck write out a crash report that may help tracking this down.

Still crashed at 2.90 6/1/2020 build. Here are the debug / info files.
Running NVIDIA drivers 446.14 on 980 TI.

Also tried "factory startup" cmd still no luck.

Seems to crash while trying to generate a thumbnail for a .bmp file, is there any chance you could run ProcessMonitor and see what the last .bmp file was that blender read? and then do 2 two things.

  1. Move it somewhere else, and see if the problem goes away
  2. If the problem does go away, and you could share the troublesome bmp so we could fix the bug that be great
Campbell Barton (campbellbarton) changed the task status from Needs Developer to Reproduce to Needs Information from User.Jun 2 2020, 4:09 AM
Ray molenkamp (LazyDodo) changed the task status from Needs Information from User to Confirmed.EditedJun 2 2020, 4:13 AM

Actually i made some bad .bmp files and can repro easily, there is *NO* bounds checking whatsoever in the bmp loader.

  1. Copy the attached bmp files to the default folder (on windows c:\Users\[username]\Documents\
  2. Click the Shader tab

Note: The problem exists in the 16bpp (rgb565) codepath as well but i had nothing that could write that format.

Note2: The header checks also do not respect the buffer bounds, i didn't have time to make to make a crashing bmp, but whoever will work on this will have to fix that as well.

note3: the crashy bmp files are created by taking a regular bmp file and truncating it to about half their size, leading to a correct header, but not enough image data in the file.

That fixed it.

The file was called "hokie.bmp" and it was not a valid .BMP file. Must have been corrupted. I cannot open it with any other graphics. tool. This file was in the "My Documents" folder; which it looks like Blender goes through and reads all the media there. I probably could change that directory in the upper left frame to point to a more specific place for Blender related media. I have attached problem file here.

Thank you for your analysis.

Not sure if you want it, but i repaired the file by just padding it with white pixels

Ray molenkamp (LazyDodo) renamed this task from Error : EXCEPTION_ACCESS_VIOLATION when selecting the Shader tab on new project to Crash : Malformed .bmp files lead to crash..Jun 2 2020, 5:16 PM
Ray molenkamp (LazyDodo) updated the task description. (Show Details)

I was actually able to open it with microsoft Code(??!) I had to open a valid BMP file first though.
This was probably created by a pinball table editor. I've deleted it, thanks.