[XAM Developer] C HTTP VIM Defect report - memory corruption.

[Mike A]

I discovered some memory corruption with the C HTTP VIM when the
xam.properties file contains more than a few items. If the total
number of fields in the XAM Library goes over 10, when the library
initializes the new XSystem instance, memory is corrupted. (I also
remembered why I don't like hunting down memory issues in C and C+
+ :-)

This example xam.properties file will cause the error using unmodified
C HTTP VIM:

# C VIM Aliases
.xam.config.vim.alias.httpvim=xam_vim_http32
.xam.config.vim.alias.xam_vim_http=xam_vim_http32

# To attempt to break the intialization defect in XferBuffer.cpp
com.example.list.1=abcdefg
com.example.list.2=hijklmnop
com.example.list.3=qrstu
com.example.list.4=vwxyz
com.example.list.5=12345
com.example.list.6=67890
com.example.list.7=!@#$
com.example.list.8=<>?
com.example.list.9=The-last-one

# Logging
xam_int..xam.log.level=5
xam_int..xam.log.verbosity=5
.xam.log.path=xam.log


I traced this down to a defect in the HTTP Vim class XferBuffer.cpp.
The code didn't calculate the buffer extension properly. The patch is
a single line:

Index: XferBuffer.cpp
===================================================================
--- XferBuffer.cpp (revision 12)
+++ XferBuffer.cpp (working copy)
@@ -174,6 +174,8 @@
{
// add a number of blocks
xam_int vNewNumTotalBlocks = mNumTotalBlocks + mBlockIncrement;
+ mNumTotalBlocks = vNewNumTotalBlocks;
+
xam_int vSize = vNewNumTotalBlocks * sizeof(char*);
if ( mBlock == (char**)0 )
mBlock = (char**)XAM_POSIX::xam_malloc(vSize);


The patch may be applied by hand, or it can be picked up from the
Google Code group at:

http://code.google.com/p/xam-fixes/

(not an official SNIA site).

Mike A

--
You received this message because you are subscribed to the "XAM Developers Group" group.
To post to this group, send email to
xam-develo...@googlegroups.com
To unsubscribe from this group, send email to
xam-developers-g...@googlegroups.com
For more options, visit this group at
http://groups.google.com/group/xam-developers-group?hl=en
Reminder that due to the SNIA IP Policy, only bug reports can be accepted as feedback for the specification or code.