crash when reverting corrupted ppm image

[Chris Moore]

Emacs crashes every time for me when I do the following:

1) download http://dooglus.rincevent.net/random/file2.ppm.bz2 (157KB)
2) bunzip2 the file
3) C-x C-f file2.ppm RET
4) C-x C-v RET

Here's the backtrace I see:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1219708000 (LWP 30968)]
pbm_load (f=0x8605310, img=0x87a0e10) at image.c:5756
5756                    b = *p++;
(gdb) where
#0  pbm_load (f=0x8605310, img=0x87a0e10) at image.c:5756
#1  0x080ecfdc in lookup_image (f=0x8605310, spec=139033901) at image.c:1863
#2  0x08080ea7 in handle_single_display_spec (it=0xbf871254, spec=<value 
optimized out>, object=142422636,
    position=0xbf8712f4, display_replaced_before_p=0) at xdisp.c:4248
#3  0x080816f2 in handle_display_prop (it=0xbf871254) at xdisp.c:3851
#4  0x08074ebe in handle_stop (it=0xbf871254) at xdisp.c:3047
#5  0x08082893 in start_display (it=0xbf871254, w=0x8605478, pos={charpos = 1, 
bytepos = 1}) at xdisp.c:2733
#6  0x08085686 in try_window (window=140530812, pos={charpos = 1, bytepos = 1}, 
check_margins=1) at xdisp.c:13558
#7  0x080874b7 in redisplay_window (window=140530812, just_this_one_p=0) at 
xdisp.c:13187
#8  0x08088a73 in redisplay_window_0 (window=140530812) at xdisp.c:11784
#9  0x0815b401 in internal_condition_case_1 (bfun=0x8088a50 
<redisplay_window_0>, arg=140530812, handlers=137458917,
    hfun=0x80661c0 <redisplay_window_error>) at eval.c:1529
#10 0x08075267 in redisplay_windows (window=0) at xdisp.c:11763
#11 0x0808928f in redisplay_internal (preserve_echo_area=<value optimized out>) 
at xdisp.c:11323
#12 0x08100c62 in read_char (commandflag=1, nmaps=2, maps=0xbf873010, 
prev_event=137472201,
    used_mouse_menu=0xbf8730b8, end_time=0x0) at keyboard.c:2670
#13 0x08103572 in read_key_sequence (keybuf=0xbf873164, bufsize=30, 
prompt=137472201, dont_downcase_last=0,
    can_return_switch_frame=1, fix_current_buffer=1) at keyboard.c:9133
#14 0x08105035 in command_loop_1 () at keyboard.c:1618
#15 0x0815b63b in internal_condition_case (bfun=0x8104ea0 <command_loop_1>, 
handlers=137516857,
    hfun=0x80ff7b0 <cmd_error>) at eval.c:1481
#16 0x080feb7e in command_loop_2 () at keyboard.c:1329
#17 0x0815b6fc in internal_catch (tag=137510841, func=0x80feb50 
<command_loop_2>, arg=137472201) at eval.c:1222
#18 0x080ff5fe in command_loop () at keyboard.c:1308
#19 0x080ff988 in recursive_edit_1 () at keyboard.c:1006
#20 0x080ffa75 in Frecursive_edit () at keyboard.c:1067
#21 0x080f58d2 in main (argc=Cannot access memory at address 0x0
) at emacs.c:1761

(gdb) p p
$1 = (unsigned char *) 0xb70e0000 <Address 0xb70e0000 out of bounds>
(gdb) p *p
Cannot access memory at address 0xb70e0000

In GNU Emacs 22.0.95.11 (i686-pc-linux-gnu, GTK+ Version 2.8.20)
 of 2007-03-18 on trpaslik
Windowing system distributor `The X.Org Foundation', version 11.0.70101000
configured using `configure  '--with-gtk' '--prefix' '/usr/local' '--with-xpm' 
'--with-jpeg' '--with-png' '--with-gif''