vtkMetaImageWriter crashes when writing MHD file to long absolute path

#1

Hi all,

I have encountered a problem with the vtkMetaImageWriter when writing mhd files with long absolute paths.

When the absolute path exceeds a certain number of characters (262 in my case), the program crashes with a segfault in the destructor of MetaImage.

The code (adapted from the VTK Example vtkMetaImageWriter) to reproduce this error is here:

// some standard vtk headers
#include <vtkSmartPointer.h>
#include <vtkRenderWindow.h>
#include <vtkRenderWindowInteractor.h>
#include <vtkRenderer.h>

// headers needed for this example
#include <vtkImageData.h>
#include <vtkImageMapper3D.h>
#include <vtkImageCast.h>
#include <vtkMetaImageWriter.h>
#include <vtkMetaImageReader.h>
#include <vtkImageMandelbrotSource.h>
#include <vtkImageActor.h>

int main( int, char* [] )
{
  std::string absolutePathDoCrash = "/home/abcdef/Desktop/delete/itk/ImageFileWriter/build-verylongFOlderNameThat-ExceedTheLimitOf256charachtersxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-Desktop_Qt_5_12_0_Clang_64bit-Debug/abcdefghijklmnopqrstuvwxyzABCDEFGH.mhd";
  std::string absolutePathRaw = "/home/abcdef/Desktop/delete/itk/ImageFileWriter/build-verylongFOlderNameThat-ExceedTheLimitOf256charachtersxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-Desktop_Qt_5_12_0_Clang_64bit-Debug/abcdefghijklmnopqrstuvwxyzABCDEFGH.raw";
  std::string absolutePathNoCrash = "/home/abcdef/Desktop/delete/itk/ImageFileWriter/build-verylongFOlderNameThat-ExceedTheLimitOf256charachtersxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-Desktop_Qt_5_12_0_Clang_64bit-Debug/abcdefghijklmnopqrstuvwxyzABCDEFG.mhd";
  std::string absolutePathNoComme = "/home/abcdef/Desktop/delete/itk/ImageFileWriter/build-verylongFOlderNameThat-ExceedTheLimitOf256charachtersxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-Desktop_Qt_5_12_0_Clang_64bit-Debug/abcdefghijklmnopqrstuvwxyz.mhd";
  
  // Create an image
  vtkSmartPointer<vtkImageMandelbrotSource> source =
    vtkSmartPointer<vtkImageMandelbrotSource>::New();

  vtkSmartPointer<vtkImageCast> castFilter =
    vtkSmartPointer<vtkImageCast>::New();
  castFilter->SetOutputScalarTypeToUnsignedChar();
  castFilter->SetInputConnection( source->GetOutputPort() );
  castFilter->Update();

  vtkSmartPointer<vtkMetaImageWriter> writer =
    vtkSmartPointer<vtkMetaImageWriter>::New();
  writer->SetInputConnection( castFilter->GetOutputPort() );
  writer->SetFileName( absolutePathDoCrash.c_str() );
//  writer->SetRAWFileName( absolutePathRaw.c_str() );
  writer->Write();

  return EXIT_SUCCESS;
}

When I change the filename in the writer to the variable absolutePathNoCrash (one character shorter), the program runs without crash.

In both cases a Comment entry is added in the mhd file that contains the part of the file path from 256th character onward. No Comment entry in the mhd file, when the variable absolutePathNoComme is used as filename.

With all three path variables the mhd and raw file gets written.

No crash happens when the path to the raw file is given explicitly (writer->SetRAWFileName).

This was tested witk VTK8.2 on Ubuntu 18.04

The issue also affects the FileImageWriter in ITK, so my assumption is that this is an issue with the implementation of MetaImage that both VTK and ITK share.

I also posted this on the ITK Discourse (see here).

#2

Update:

The crash was identified as a buffer overflow issue.
An issue was created here.