Crash when use ImageFileReader read jpeg

[Hconk]

Description

If compile with release version. When I use ImageFileReader read some broke jpeg image, it's crash in Update function. I expected throw an exception.
But success in Debug.

Steps to Reproduce

Build With Release.
https://gist.github.com/Hconk/5b1bed75ebb3c62757277a1367d61edb

Expected behavior

If image broke, expect throw an exception.

Actual behavior

Crash at update.

Reproducibility

Release Version.

Versions

c4960ee

Environment

• CMake: 3.21.1
• OS: Centos 7.3 / Windows 10
• ITK Version: 5.2.1 / master branch
• compile: gcc10.2 / gcc 4.8 / vs2017

Additional Information

Test data.
Google Drive

[dzenanz]

I can't reproduce your error with a recent master 05ae9a5.

#include <itkJPEGImageIO.h>
#include <itkImageFileReader.h>

int main(int, char**) {
  constexpr unsigned int Dimension = 2;
  using PixelType = unsigned char;
  using ImageType = itk::Image<PixelType, Dimension>;
  itk::JPEGImageIO::Pointer io;
  io = itk::JPEGImageIO::New();
  itk::ImageFileReader<ImageType>::Pointer JPEGReader;
  JPEGReader = itk::ImageFileReader<ImageType>::New();
  JPEGReader->SetFileName("C:/a/211869_09365_55_55.jpg");
  JPEGReader->SetImageIO(io);
  try
  {
    JPEGReader->Update();
    std::cout << *JPEGReader->GetOutput();
  }
  catch (itk::ExceptionObject& err)
  {
    std::cerr << "ExceptionObject caught !" << std::endl;
    std::cerr << err << std::endl;
  }

  std::cout << "ITK Read Jpeg Demo.\n";
  return 0;
}

produces

Image (0000028596779BF0)
  RTTI typeinfo:   class itk::Image<unsigned char,2>
  Reference Count: 1
  Modified Time: 76
  Debug: Off
  Object Name:
  Observers:
    none
  Source: (00000285967745B0)
  Source output name: Primary
  Release Data: Off
  Data Released: False
  Global Release Data: Off
  PipelineMTime: 68
  UpdateMTime: 77
  RealTimeStamp: 0 seconds
  LargestPossibleRegion:
    Dimension: 2
    Index: [0, 0]
    Size: [1200, 1400]
  BufferedRegion:
    Dimension: 2
    Index: [0, 0]
    Size: [1200, 1400]
  RequestedRegion:
    Dimension: 2
    Index: [0, 0]
    Size: [1200, 1400]
  Spacing: [1, 1]
  Origin: [0, 0]
  Direction:
1 0
0 1

  IndexToPointMatrix:
1 0
0 1

  PointToIndexMatrix:
1 0
0 1

  Inverse Direction:
1 0
0 1

  PixelContainer:
    ImportImageContainer (0000028596779E20)
      RTTI typeinfo:   class itk::ImportImageContainer<unsigned __int64,unsigned char>
      Reference Count: 1
      Modified Time: 74
      Debug: Off
      Object Name:
      Observers:
        none
      Pointer: 00000285969BF070
      Container manages memory: true
      Size: 1680000
      Capacity: 1680000
ITK Read Jpeg Demo.

C:\Misc\Tester\Debug\tester.exe (process 29296) exited with code 0.

[Hconk]

I can't reproduce your error with a recent master 05ae9a5.

#include <itkJPEGImageIO.h>
#include <itkImageFileReader.h>

int main(int, char**) {
  constexpr unsigned int Dimension = 2;
  using PixelType = unsigned char;
  using ImageType = itk::Image<PixelType, Dimension>;
  itk::JPEGImageIO::Pointer io;
  io = itk::JPEGImageIO::New();
  itk::ImageFileReader<ImageType>::Pointer JPEGReader;
  JPEGReader = itk::ImageFileReader<ImageType>::New();
  JPEGReader->SetFileName("C:/a/211869_09365_55_55.jpg");
  JPEGReader->SetImageIO(io);
  try
  {
    JPEGReader->Update();
    std::cout << *JPEGReader->GetOutput();
  }
  catch (itk::ExceptionObject& err)
  {
    std::cerr << "ExceptionObject caught !" << std::endl;
    std::cerr << err << std::endl;
  }

  std::cout << "ITK Read Jpeg Demo.\n";
  return 0;
}

produces

Image (0000028596779BF0)
  RTTI typeinfo:   class itk::Image<unsigned char,2>
  Reference Count: 1
  Modified Time: 76
  Debug: Off
  Object Name:
  Observers:
    none
  Source: (00000285967745B0)
  Source output name: Primary
  Release Data: Off
  Data Released: False
  Global Release Data: Off
  PipelineMTime: 68
  UpdateMTime: 77
  RealTimeStamp: 0 seconds
  LargestPossibleRegion:
    Dimension: 2
    Index: [0, 0]
    Size: [1200, 1400]
  BufferedRegion:
    Dimension: 2
    Index: [0, 0]
    Size: [1200, 1400]
  RequestedRegion:
    Dimension: 2
    Index: [0, 0]
    Size: [1200, 1400]
  Spacing: [1, 1]
  Origin: [0, 0]
  Direction:
1 0
0 1

  IndexToPointMatrix:
1 0
0 1

  PointToIndexMatrix:
1 0
0 1

  Inverse Direction:
1 0
0 1

  PixelContainer:
    ImportImageContainer (0000028596779E20)
      RTTI typeinfo:   class itk::ImportImageContainer<unsigned __int64,unsigned char>
      Reference Count: 1
      Modified Time: 74
      Debug: Off
      Object Name:
      Observers:
        none
      Pointer: 00000285969BF070
      Container manages memory: true
      Size: 1680000
      Capacity: 1680000
ITK Read Jpeg Demo.

C:\Misc\Tester\Debug\tester.exe (process 29296) exited with code 0.

Did you test with the release version? I only reproduce in release.

[dzenanz]

I tried both Debug and RelWithDebInfo builds, and they both work.

[issakomi]

On Debian 10 the file crashes everything related to ITK's JPEG IO: my app, Slicer (tested nightly build), that test program. In Release and RelWithDebInfo builds, Debug builds survive. Eye of Mate and Gimp don't crash. The file is broken. I shall try later to look closer, that crash in my paid program is worrying (i have own DICOM IO and rely on ITK for other formats).

Edit: tested current ITK master, BTW.

Edit:
Valgrind output with Debug build has no errors.
Valgrind output with RelWithDebInfo:

Edit: deleted long Valgrind output

[issakomi]

Probably i have done a temporary fixed...
The error happens in jpeg_destroy_decompress(&cinfo); I have re-written several times the Read function to find it out and tested additionally with version 4.12 with system JPEG (also crashed, BTW). So finally i looked inside Gimp code (Gimp doesn't fail on the file).
The minimal solution is to add if (setjmp (jerr.setjmp_buffer)) block at the beginning of the while loop

  // read the bulk data
  unsigned int remainingRows;
  while (cinfo.output_scanline < cinfo.output_height)
  {
////////////////////////////////
    if (setjmp (jerr.setjmp_buffer))
    {
      std::cout << "goto quit:" << std::endl;
      goto quit;
    }
////////////////////////////////
    remainingRows = cinfo.output_height - cinfo.output_scanline;
    jpeg_read_scanlines(&cinfo, &row_pointers[cinfo.output_scanline], remainingRows);
  }

and quit: before jpeg_destroy_decompress at the end of Read function, to skip jpeg_finish_decompress call in case of an error.

quit:             // <-------------------
  // destroy the decompression object
  jpeg_destroy_decompress(&cinfo);

  delete[] row_pointers;
}

@Hconk Maybe you could validate?

P.S. Please don't write me that "goto" is bad. It is not the final solution, it is minimal working for now.

[Hconk]

@issakomi Thanks, I validate your patch code, It's work for me, This problem has bothered me for a long time.

[Hconk]

I tried both Debug and RelWithDebInfo builds, and they both work.

Thanks for you tried, I use Github Action build this demo to reproduce this case.

Demo Project: https://github.com/Hconk/ReadJpegDemo
Test with Debug result: https://github.com/Hconk/ReadJpegDemo/runs/4466987270?check_suite_focus=true
Test with Release result: https://github.com/Hconk/ReadJpegDemo/runs/4466987349?check_suite_focus=true

I temporarily use @issakomi solution to fix the problem.If the final solution is updated, I would be happy to verify.

[issakomi]

@Hconk Thank you for testing.

For reference s. similar GIMP approach

Edit: maybe a warning can be fired additionally

[Hconk]

@issakomi Great, I need process large number of images, some warnning maybe help me find broken image. Thanks for your work.

[issakomi]

Yes. Wrapping of setjump here is bug.

I have replaced wrapSetjmp(itk_jpeg_error_mgr & jerr) everywhere with (setjmp(jerr.setjmp_buffer)) without that temporary fix above and results of the test program is:

r@deb:~/Desktop/test_jpeg/build$ ./readjpeg 
ExceptionObject caught !

itk::ExceptionObject (0x555e03ae2d40)
Location: "unknown" 
File: /home/r/itkf/ITK/Modules/IO/JPEG/src/itkJPEGImageIO.cxx
Line: 186
Description: ITK ERROR: JPEGImageIO(0x555e03adee50): libjpeg could not read file: bug.jpg


ITK Read Jpeg Demo.

I shall look closer.