[sane-devel] [PATCH] scanimage segfault with ScanMaker IIHR

[Ralf Horstmann]

Hello all,

I use an old ScanMaker IIHR attached to a HP PA-RISC 712/80 running
OpenBSD. This works fine as long as I use saned with xsane running on a
different machine.

Using scanimage in color mode locally on that machine results in
segfaults after scanning a few seconds, because the buffer allocated for
holding the image is not big enough. Seems scanimage doesn't work well
with Microtek scanners that needs three passes to scan color images.

The following patch fixed it for me.

Cheers,
Ralf

diff --git a/frontend/scanimage.c b/frontend/scanimage.c
index ce958df..544eaa1 100644
--- a/frontend/scanimage.c
+++ b/frontend/scanimage.c
@@ -66,6 +66,7 @@ typedef struct
   int height;
   int x;
   int y;
+  int bytes_per_pixel;
 }
 Image;
 
@@ -1163,10 +1164,10 @@ advance (Image * image)
 	  size_t old_size = 0, new_size;
 
 	  if (image->data)
-	    old_size = image->height * image->width;
+	    old_size = image->height * image->width * image->bytes_per_pixel;
 
 	  image->height += STRIP_HEIGHT;
-	  new_size = image->height * image->width;
+	  new_size = image->height * image->width * image->bytes_per_pixel;
 
 	  if (image->data)
 	    image->data = realloc (image->data, new_size);
@@ -1186,10 +1187,11 @@ static SANE_Status
 scan_it (void)
 {
   int i, len, first_frame = 1, offset = 0, must_buffer = 0, hundred_percent;
+  int onepass = 1;
   SANE_Byte min = 0xff, max = 0;
   SANE_Parameters parm;
   SANE_Status status;
-  Image image = { 0, 0, 0, 0, 0 };
+  Image image = { 0, 0, 0, 0, 0, 1 };
   static const char *format_name[] = {
     "gray", "RGB", "red", "green", "blue"
   };
@@ -1255,6 +1257,7 @@ scan_it (void)
 	      assert (parm.depth == 8);
 	      must_buffer = 1;
 	      offset = parm.format - SANE_FRAME_RED;
+	      onepass = 0;
 	      break;
 
 	    case SANE_FRAME_RGB:
@@ -1292,6 +1295,8 @@ scan_it (void)
 		 case, we need to buffer all data before we can write
 		 the image.  */
 	      image.width = parm.bytes_per_line;
+	      if (!onepass)
+		      image.bytes_per_pixel = 3;
 
 	      if (parm.lines >= 0)
 		/* See advance(); we allocate one extra line so we
@@ -1474,7 +1479,7 @@ scan_it (void)
 	}
 #endif
 
-	fwrite (image.data, 1, image.height * image.width, stdout);
+	fwrite (image.data, 1, image.height * image.width * image.bytes_per_pixel, stdout);
     }
 
   /* flush the output buffer */
@@ -1529,7 +1534,7 @@ test_it (void)
   int i, len;
   SANE_Parameters parm;
   SANE_Status status;
-  Image image = { 0, 0, 0, 0, 0 };
+  Image image = { 0, 0, 0, 0, 0, 1 };
   static const char *format_name[] =
     { "gray", "RGB", "red", "green", "blue" };