Skip to content

[asimage] fix bug in rainbow palette selection - #23725

Open
linev wants to merge 2 commits into
root-project:masterfrom
linev:fix_rainbow_palette
Open

linev wants to merge 2 commits into
root-project:masterfrom
linev:fix_rainbow_palette

Conversation

@linev

@linev linev commented Oct 15, 2026 •

Copy link
Copy Markdown
Member

Predefined rainbow palette has only 10 points, but 12 were copied - overwriting memory outside allocated region.

Failure can be observed with tutorials/visualisation/image/galaxy_image.C trying to select "Rainbow" palette in combobox.

@ferdymercury
Code in the TASPaletteEditor::NewPalette() method must be reviewed.
I see a lot of arithmetic like 0xffff * (pt - 1) / (numPt - 3); which leads to overflow of last calculated point.

@linev
linev requested a review from bellenot October 15, 2026 12:04
@linev linev self-assigned this Oct 15, 2026
@linev linev added the in:GUI label Oct 15, 2026
@linev
linev requested a review from silverweed as a code owner October 15, 2026 12:04
@github-actions

github-actions Bot commented Oct 15, 2026 •

Copy link
Copy Markdown

Test Results

    23 files      23 suites   3d 18h 59m 7s ⏱️
 3 889 tests  3 887 ✅ 0 💤 2 ❌
80 373 runs  80 371 ✅ 0 💤 2 ❌

For more details on these failures, see this check.

Results for commit 3427f9c.

♻️ This comment has been updated with latest results.

@ferdymercury ferdymercury left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

all palettes seem to start at [1], see for example


      case 1:  // gray
         for (pt = 1; pt < Int_t(numPt - 1); pt++) {
         
         

Would it make more sense to instead copy one element less but still start at 1, for consistency?

Or to make the others below also start at 0?

@linev

linev commented Oct 16, 2026

Copy link
Copy Markdown
Member Author

@ferdymercury

Thanks for remark!
Complete arithmetic behind palette initialization here is wired.
And in fact first and last point in palette are duplication of second and N-1 points.
I will update PR

Target array has only 12 elements, but rainbow palette has only 10 points
These 10 points should be copied from offset 1, first and last point will be overwritten
@linev
linev force-pushed the fix_rainbow_palette branch from a7f1a3d to 20f467a Compare October 16, 2026 06:00
Comment thread graf2d/asimage/src/TASPaletteEditor.cxx Outdated
memcpy(newPalette->fColorRed + 1, gRedRainbow, 12 * sizeof(UShort_t));
memcpy(newPalette->fColorGreen + 1, gGreenRainbow, 12 * sizeof(UShort_t));
memcpy(newPalette->fColorBlue + 1, gBlueRainbow, 12 * sizeof(UShort_t));
memcpy(newPalette->fColorRed + 1, gRedRainbow, 10 * sizeof(UShort_t));

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

instead of manually coding this number, which is error-prone, can we either use std::size or std::array and then .size()?
Or, at the very least, a defined constant kNRainbowElems = 10

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is immediate bugfix of ROOT crash which I want backport to 6.40 as well.

I see many other problems here and code need to be reorganized.
See my comments to the PR description.
This can be done as separate PR then.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's not a big change at all to introduce...

@ferdymercury

Copy link
Copy Markdown
Collaborator

I see a lot of arithmetic like 0xffff * (pt - 1) / (numPt - 3); which leads to overflow of last calculated point.

For kGray palette, the loop end condition is pt < numPt - 1, so last calculated point is pt = numPt - 2, which leads to

0xffff * (numPt - 2 - 1) / (numPt - 3) = 0xffff

so the TPalette for gray has 13 elements, first and last elements are reserved, second is 0 and second-last is 65535, and the rest is linearly increasing inbetween

Where did you see the overflow issue?

@linev

linev commented Oct 16, 2026

Copy link
Copy Markdown
Member Author

For kGray palette, the loop end condition is pt < numPt - 1, so last calculated point is pt = numPt - 2, which leads to
0xffff * (numPt - 2 - 1) / (numPt - 3) = 0xffff

There are too many -1 -2 -3 which I miss-interpret. Maybe one can do it more simpler.

Comment thread graf2d/asimage/src/TASPaletteEditor.cxx Outdated
Comment thread graf2d/asimage/src/TASPaletteEditor.cxx Outdated
Comment thread graf2d/asimage/src/TASPaletteEditor.cxx Outdated
@@ -687,9 +687,9 @@ void TASPaletteEditor::NewPalette(Long_t id)

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

on line 680 change to:

numPt = (id == 0 ? kNRainbowElems : 11) + 2;

Comment thread graf2d/asimage/src/TASPaletteEditor.cxx Outdated
Use it in assign methods

Co-authored-by: ferdymercury <ferdymercury@users.noreply.github.com>
@linev
linev force-pushed the fix_rainbow_palette branch from 1902bb0 to 3427f9c Compare October 16, 2026 15:13

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants