[comp.sources.bugs] popi patchlevel 3

nelson@PEAR.ECS.CLARKSON.EDU (12/30/89)

The routine ImgAlloc found in io.c seems to have a bug.  First it mallocs
an array of pointers, then fills that array in with more malloced pointers.
Now, since the array is accessed using the y coordinate, you would think
that the size of the array would be related to Ysize.  Instead, a reference
is made to Xsize (See below).  This seems wrong to me.
-russ


pixel_t **
ImgAlloc()
{
    pixel_t		**img,
    			**linep,
			**imgend;

    noerr = TRUE;
    if ((img = (pixel_t **) LINT_CAST(Emalloc((unsigned)Xsize * sizeof(pixel_t *)))) == 0)
	return (pixel_t **) 0;

    imgend = &img[Ysize];
    for (linep = img; linep != imgend; ++linep)
	*linep = (pixel_t *) Emalloc((unsigned)Xsize * sizeof (pixel_t));

mathew@jane.Jpl.Nasa.Gov (Mathew Yeates) (12/30/89)

In article <2347@pear.ecs.clarkson.edu> nelson@sun.soe.clarkson.edu writes:
>The routine ImgAlloc found in io.c seems to have a bug.  First it mallocs
>an array of pointers, then fills that array in with more malloced pointers.
>Now, since the array is accessed using the y coordinate, you would think
>that the size of the array would be related to Ysize.  Instead, a reference
>is made to Xsize (See below).  This seems wrong to me.
>-russ
>
>
>pixel_t **
>ImgAlloc()
>{
>    pixel_t		**img,
>    			**linep,
>			**imgend;
>
>    noerr = TRUE;
>    if ((img = (pixel_t **) LINT_CAST(Emalloc((unsigned)Xsize * sizeof(pixel_t *)))) == 0)
>	return (pixel_t **) 0;
>
>    imgend = &img[Ysize];
>    for (linep = img; linep != imgend; ++linep)
>	*linep = (pixel_t *) Emalloc((unsigned)Xsize * sizeof (pixel_t));

yes this is incorrect. The first should be Y, the second X.

-mathew
mathew@jane.jpl.nasa.gov