Tiles/Ocean.exr core dumps on latest code built from git

[darkyellow]

Hi
I took a new git clone and tried to load Tiles/Ocean.exr from the examples using the below code (which uses the newly built code from git) and I received the below error

double free or corruption (!prev)
Aborted (core dumped)

Other tile example files load fine

InputFile file (fileName);
 Box2i dw = file.header().dataWindow(); int width = dw.max.x - dw.min.x + 1; int height = dw.max.y - dw.min.y + 1;
 Array2D<half> rPixels (height, width); Array2D<half> gPixels (height, width); Array2D<half> bPixels (height, width); Array2D<half> aPixels (height, width); rPixels.resizeErase (height, width); gPixels.resizeErase (height, width); bPixels.resizeErase (height, width); aPixels.resizeErase (height, width);
 FrameBuffer frameBuffer;
 frameBuffer.insert ("R",Slice (IMF::UINT,(char *) (&gPixels[0][0] - dw.min.x -	dw.min.y * width), sizeof (gPixels[0][0]) * 1, sizeof (rPixels[0][0]) * width, 1, 1, 0.0));				
 frameBuffer.insert ("G",Slice (IMF::UINT,(char *) (&gPixels[0][0] - dw.min.x -	dw.min.y * width), sizeof (gPixels[0][0]) * 1, sizeof (gPixels[0][0]) * width, 1, 1, 0.0));				
 frameBuffer.insert ("B",Slice (IMF::UINT,(char *) (&bPixels[0][0] - dw.min.x - dw.min.y * width), sizeof (bPixels[0][0]) * 1, sizeof (bPixels[0][0]) * width, 1, 1, 0.0)); 
 file.setFrameBuffer (frameBuffer);
 file.readPixels (dw.min.y, dw.max.y);

I can provide other info if required

[peterhillman]

In your slice declarations, you need to use HALF not UINT, since you have halfarrays.
Using UINT means the library writes four bytes per pixel into your arrays, even though you've only allocated two bytes for the half, so with the last pixel it writes two bytes beyond the end of the arrays, and something important is being overwritten there.

[darkyellow]

The issue happens with HALF too and other exr example files don't core dump with the UINT set so I don't think this is the issue.

[peterhillman]

Could you provide an entire compilable program to show the problem using HALF, and with all the necessary #include and any namespace statements ? I wrapped your code snippet into a main() to test, but may have done things differently. I identified the issue by running that through valgrind before noticing the UINT. I had exactly the same error message double free or corruption (!prev))on Oceans.exr and a few other test images (e.g. CrissyField.exr), but most were OK. For me, changing UINT to HALF loads every example image without problems.

I would expect only certain image dimensions to crash with UINT. That's because the memory allocator often allocates a few bytes of padding to keep memory nicely aligned. How much padding exists will depend on the array size, which depends on the image dimensions. It will only abort like this if there's no padding and the memory that is overwritten is that used by malloc to do its internal book keeping.

I'm curious why you have IMF::UINT, not Imf::UINT, which is the normal name for the OpenEXR namespace, and wonder whether that might be related to any ongoing issues. In any case, UINT is incorrect - unless you have HALF your arrays will have garbage in them.

[darkyellow]

You were right on the UINT being the issue (the reason why I thought it wasn't the issue was that I was testing on other files with out issues)! I will close this down as there isn't actually an issue. The reason why I am using UINT is purely to trigger the code which does the conversion from half to int. I am building an openexr reader in Java (for a vulkan project I have) and was using the conversion code to help debug.