Repository navigation
BUG: Stop returning -1 from functions that return size_t - #111
Open
hjmjohnson wants to merge 2 commits into
Open
hjmjohnson wants to merge 2 commits into
hjmjohnson wants to merge 2 commits into
Conversation
hjmjohnson
marked this pull request as ready for review
September 24, 2026 12:17
hjmjohnson
force-pushed
the
pr/fix-size-t-error-returns
branch
from
October 6, 2026 14:35
d9f5d2d to
987acbd
Compare
znzread(), znzwrite() and nifti_read_buffer() all return size_t and
all returned -1 to report an error. In a size_t that value is
SIZE_MAX, larger than any length a caller can have asked for, so a
caller that tests the result with '<' reads the error as a complete
transfer:
ii = nifti_read_buffer(fp, nim->data, ntot, nim);
if( ii < ntot ){ ... } /* SIZE_MAX < ntot is false */
The visible effect is that a truncated image loads as if it were
whole: nifti_image_read() prints its short-read warning, ignores the
failure and returns an image whose tail is uninitialized heap.
FslReadVolumes() has the same problem one level up, dividing the
returned byte count by the volume size to report SIZE_MAX/volbytes
volumes read.
These now return 0 on error, which every one of these callers already
treats as failure. The return contract is now stated beside
nifti_read_buffer() and in znzlib.h. The published return types in
znzlib.h and nifti1_io.h are unchanged.
The nifti2 equivalents return int64_t, where -1 is representable,
and are left alone.
Writes a 31x31x31 float image and three damaged copies of it, and asserts nifti_image_read() returns NULL for each copy and a populated image for the original, so a blanket refusal cannot pass: - a .nii 1000 bytes short (the fread path of znzread); - a .nii.gz 1000 bytes short, where gzread returns a short count; - a .nii.gz whose deflate stream ends in a block of reserved type after half the file, so gzread fails with -1 inside the image data. Without the fix the first and third copies come back accepted with nvox=29791 and an uninitialized tail. The truncated .nii.gz is rejected with or without the fix; it guards the short-count path. The znzwrite() error branch is not exercised, since gzwrite() does not return a negative count.
hjmjohnson
force-pushed
the
pr/fix-size-t-error-returns
branch
from
November 6, 2026 16:54
987acbd to
19d840a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
znzread(),znzwrite(), andnifti_read_buffer()returnsize_tbut reported errors as -1 (SIZE_MAX), which every<caller read as a complete transfer. They now return 0 on error.Effect for ITK and other readers: a truncated or corrupt
.nii/.nii.gznow makesnifti_image_read()return NULL instead of loading an image with an uninitialized tail.Re-submission of #43, reverted from
masteron 2026-09-24 so it can be reviewed before merging. Review round 1 added the.nii.gztest cases and the return-contract notes.Base:
master. Independent: nothing has to land before it.Commits
Test coverage
nifti_short_read_testwrites a reference image and three damaged copies:.nii1000 bytes short: fails without thenifti1_io.cfix;.nii.gz1000 bytes short:gzreadreturns a short count, rejected with or without the fix;.nii.gzwhose deflate stream hits a reserved block type mid-image:gzreadreturns -1, fails without theznzlib.cfix.The
znzwrite()error branch is not exercised;gzwrite()reports errors as 0, not a negative count.Ordering for all the re-submitted work is tracked in #84.