{"record":{"id":"4ed607b49b4a0a7f","repo":"Yalantis/uCrop","slug":"cimg-appname-math-parser-cimg-s-function-4ed607","errorCode":null,"errorMessage":"\"[\" cimg_appname \"_math_parser] CImg<%s>: Function 'copy()': Out-of-bounds variable pointer (length: %ld, increment: %ld, offset start: %ld, offset end: %ld, offset max: %u).\"","messagePattern":"\"\\[\" cimg_appname \"_math_parser\\] CImg<(.+?)>: Function 'copy\\(\\)': Out-of-bounds variable pointer \\(length: %ld, increment: %ld, offset start: %ld, offset end: %ld, offset max: %u\\)\\.\"","errorType":"exception","errorClass":"CImgArgumentException","httpStatus":null,"severity":"error","filePath":"ucrop/src/main/jni/CImg.h","lineNumber":28844,"sourceCode":"              abs_val = cimg::abs(val);\n              if (abs_val>abs_valmaxabs) { valmaxabs = val; abs_valmaxabs = abs_val; }\n            }\n          } else {\n            val = _mp_arg(i);\n            abs_val = cimg::abs(val);\n            if (abs_val>abs_valmaxabs) { valmaxabs = val; abs_valmaxabs = abs_val; }\n          }\n        }\n        return valmaxabs;\n      }\n\n      static double* _mp_memcopy_double(_cimg_math_parser& mp, const unsigned int ind, const ulongT *const p_ref,\n                                        const longT siz, const long inc) {\n        const longT\n          off = *p_ref?p_ref[1] + (longT)mp.mem[(longT)p_ref[2]] + 1:ind,\n          eoff = off + (siz - 1)*inc;\n        if (off<0 || eoff>=mp.mem.width())\n          throw CImgArgumentException(\"[\" cimg_appname \"_math_parser] CImg<%s>: Function 'copy()': \"\n                                      \"Out-of-bounds variable pointer \"\n                                      \"(length: %ld, increment: %ld, offset start: %ld, \"\n                                      \"offset end: %ld, offset max: %u).\",\n                                      mp.imgin.pixel_type(),siz,inc,off,eoff,mp.mem._width - 1);\n        return &mp.mem[off];\n      }\n\n      static float* _mp_memcopy_float(_cimg_math_parser& mp, const ulongT *const p_ref,\n                                      const longT siz, const long inc, const bool is_out) {\n        const unsigned ind = (unsigned int)p_ref[1];\n        const CImg<T> &img = is_out?\n          (ind==~0U?mp.imgout:mp.imglist[cimg::mod((int)mp.mem[ind],mp.imglist.width())]):\n          (ind==~0U?mp.imgin:mp.imglist[cimg::mod((int)mp.mem[ind],mp.imglist.width())]);\n        const bool is_relative = (bool)p_ref[2];\n        int ox, oy, oz, oc;\n        longT off = 0;\n        if (is_relative) {\n          ox = (int)mp.mem[_cimg_mp_slot_x];","sourceCodeStart":28826,"sourceCodeEnd":28862,"githubUrl":"https://github.com/Yalantis/uCrop/blob/f788b534b48c144edf786c8cddbf0e029e637804/ucrop/src/main/jni/CImg.h#L28826-L28862","documentation":"The math parser 'copy()' function copies a block of values into the parser's variable memory (mp.mem). Before copying it computes the end offset off + (siz-1)*inc and verifies the whole destination range lies inside mp.mem; otherwise it throws CImgArgumentException describing length, increment, start and end offsets and the maximum valid offset.","triggerScenarios":"An expression like `copy(dest,siz,inc,src...)` where the destination variable pointer offset plus (length-1)*increment exceeds the variable memory width, e.g. copying N elements into a small vector variable, or an increment too large for the target variable size.","commonSituations":"Resizing input images/vectors without updating hard-coded copy lengths; using vector variables declared with fewer elements than the copy length; negative or oversized increments in strided copies.","solutions":["Ensure the destination variable is declared with at least (siz-1)*inc + 1 elements before calling copy().","Reduce the 'siz' length argument or the increment to fit within the target variable's allocated size.","Check that the destination offset expression (p_ref[1] + mp.mem[...] + 1) points to the intended variable and not past the end of mem.","Catch CImgArgumentException and log the length/increment/offsets to diagnose which argument is wrong."],"exampleFix":"// before: V = vector(4); copy(V, 8, 1, src)\n// after:  V = vector(8); copy(V, 8, 1, src)","handlingStrategy":"validation","validationCode":"if (siz < 0 || inc <= 0 || off < 0 || off + (siz - 1) * inc >= memWidth)\n  throw std::runtime_error(\"copy() would overflow variable memory\");","typeGuard":null,"tryCatchPattern":"try { img.evaluate(expr); } catch (const CImgArgumentException& e) { log(\"copy() out of bounds: \" << e.what()); }","preventionTips":["Declare destination vector variables with (siz-1)*inc+1 elements","Keep copy lengths in sync with variable declarations","Prefer unit strides unless strided copy is required"],"tags":["cimg","math-parser","index-out-of-bounds"],"backgroundTag":"index-out-of-bounds","analyzedSha":"f788b534b48c144edf786c8cddbf0e029e637804","analyzedAt":"2026-09-08T08:36:04.887Z","contentChangedAt":"2026-09-08T08:36:04.887Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}