使用ImageMagick C API的FileToBlob()读取stdin时内存错误求助

问题背景 #

我需要使用ImageMagick C API读取文件，由于要读取标准输入（stdin）两次，因此计划先将标准输入内容读取为Blob。

初始代码片段 #

size_t blob_length = 0;
ExceptionInfo blob_exception;
printf("about to read blob\n");
void *blob = FileToBlob(filename, 99999999, &blob_length, &blob_exception);
printf("read blob: %ld\n", blob_length);

错误现象 #

当filename为普通文件名时程序运行正常，但将其设为特殊值"-"（表示读取标准输入）时，触发如下错误：

about to read blob
realloc(): invalid next size
Aborted (core dumped)

GDB栈跟踪信息 #

#0  0x00007ffff60a14dc in ?? () from /usr/lib/libc.so.6
#1  0x00007ffff6051998 in raise () from /usr/lib/libc.so.6
#2  0x00007ffff603b53d in abort () from /usr/lib/libc.so.6
#3  0x00007ffff609567e in ?? () from /usr/lib/libc.so.6
#4  0x00007ffff60ab26c in ?? () from /usr/lib/libc.so.6
#5  0x00007ffff60af00c in ?? () from /usr/lib/libc.so.6
#6  0x00007ffff60afd12 in realloc () from /usr/lib/libc.so.6
#7  0x00007ffff7916924 in ResizeMagickMemory () from /usr/lib/libMagickCore-7.Q16HDRI.so.10
#8  0x00007ffff7845d4c in FileToBlob () from /usr/lib/libMagickCore-7.Q16HDRI.so.10
#9  0x0000555555556fa5 in scan_image (filename=filename@entry=0x7fffffffe259 "-")
    at zbarimg/zbarimg.c:187
#10 0x0000555555556840 in main (argc=2, argv=0x7fffffffde28) at zbarimg/zbarimg.c:480

环境与困惑 #

使用的是ImageMagick 7.1.0-47 Q16-HDRI版本。查看在线源码时发现，源码中只调用了ResizeQuantumMemory而非ResizeMagickMemory，对此感到困惑。我推测错误出在自己的代码中（本人是C语言新手），但不确定具体问题所在。

简化后的测试代码 #

为了重现问题，我简化了程序，仅保留必要代码：

//gcc -I/usr/include/ImageMagick-7 -fopenmp -DMAGICKCORE_HDRI_ENABLE=1 -DMAGICKCORE_QUANTUM_DEPTH=16 -lMagickWand-7.Q16HDRI -lMagickCore-7.Q16HDRI magick.c
#include <MagickWand/MagickWand.h>

static int scan_image(const char *filename)
{
    size_t blob_length = 0;
    ExceptionInfo blob_exception;
    printf("about to read blob\n"); 
    void *blob = FileToBlob(filename, 99999999, &blob_length, &blob_exception);
    printf("read blob: %ld\n", blob_length); 
}

int main(int argc, const char *argv[])
{
    scan_image("-");
    return 0;
}

Valgrind检测输出 #

==947372== Memcheck, a memory error detector
==947372== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et al.
==947372== Using Valgrind-3.19.0 and LibVEX; rerun with -h for copyright info
==947372== Command: ./a.out
==947372== 
about to read blob
==947372== Syscall param read(buf) points to unaddressable byte(s)
==947372==    at 0x4E1EDF1: read (read.c:26)
==947372==    by 0x4A17D72: UnknownInlinedFun (unistd.h:38)
==947372==    by 0x4A17D72: FileToBlob (blob.c:1473)
==947372==    by 0x1091B3: scan_image (in /home/zachary/a.out)
==947372==    by 0x109207: main (in /home/zachary/a.out)
==947372==  Address 0x7a338b1 is 0 bytes after a block of size 81,921 alloc'd
==947372==    at 0x4846CC3: realloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==947372==    by 0x4AE8923: ResizeMagickMemory (memory.c:1407)
==947372==    by 0x4A17D4B: FileToBlob (blob.c:1485)
==947372==    by 0x1091B3: scan_image (in /home/zachary/a.out)
==947372==    by 0x109207: main (in /home/zachary/a.out)
==947372== 
--947372-- VALGRIND INTERNAL ERROR: Valgrind received a signal 7 (SIGBUS) - exiting
--947372-- si_code=128;  Faulting address: 0x0;  sp: 0x1002ca9e40

valgrind: the 'impossible' happened:
   Killed by fatal signal

host stacktrace:
==947372==    at 0x5804D09B: ??? (in /usr/lib/valgrind/memcheck-amd64-linux)
==947372==    by 0x580056B2: ??? (in /usr/lib/valgrind/memcheck-amd64-linux)
==947372==    by 0x5809B33D: ??? (in /usr/lib/valgrind/memcheck-amd64-linux)
==947372==    by 0x580E40C0: ??? (in /usr/lib/valgrind/memcheck-amd64-linux)

sched status:
  running_tid=1

Thread 1: status = VgTs_Runnable (lwpid 947372)
==947372==    at 0x4846CC3: realloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==947372==    by 0x4AE8923: ResizeMagickMemory (memory.c:1407)
==947372==    by 0x4A17D4B: FileToBlob (blob.c:1485)
==947372==    by 0x1091B3: scan_image (in /home/zachary/a.out)
==947372==    by 0x109207: main (in /home/zachary/a.out)
client stack range: [0x1FFEFFA000 0x1FFF000FFF] client SP: 0x1FFEFFFC30
valgrind stack range: [0x1002BAA000 0x1002CA9FFF] top usage: 17872 of 1048576

内容的提问来源于stack exchange，提问作者Zachary Vance