Opened 18 years ago

Closed 18 years ago

#1803 closed defect (fixed)

setting layerObj.metadata is unsafe and cause segfault or access violation

Reported by: szekerest Owned by: szekerest
Priority: high Milestone:
Component: MapScript-C# Version: unspecified
Severity: critical Keywords:
Cc:

Description

With the current implementation setting layerObj.metadata with a newly created
metadata object may cause cause segfault or access violation.

Creating a new object (HashTableObj in this case) sets the internal swigCMemOwn
flag to true indicating that the referenced unmanaged memory should be destroyed
on finalization. Calling setmetadata will copy the the memory of the unmanaged
hashTableObj structure but the internal items will not be copied.
Therefore the items of the hashtable of the layer will be destroyed when the
finalization of the created HashTableObj occurs.

Resolution: layerObj.metadata should be read only. One should get the reference
of the hashtable of the layer and add the items as needed.

Attachments (2)

drawmap.cs (552 bytes ) - added by szekerest 18 years ago.
drawmap.cs
DrawMap.java (655 bytes ) - added by szekerest 18 years ago.
drawmap.java

Download all attachments as: .zip

Change History (7)

comment:1 by szekerest, 18 years ago

Severity: normalcritical
Status: newassigned
After looking into the code i have found several other places this problem
persists. By setting these properties a raw copy of the object is done however
the  subsequent referenced objects will not be copied.

classObj.label  (labelObj)
classObj.metadata  (hashTableObj)
classObj.layer  (layerObj)
fontSetObj.fonts  (hashTableObj)
imageObj.format  (outputFormatObj)
labelPathObj.path (lineObj)
legendObj.label  (labelObj)
legendObj.map  (mapObj)
mapObj.symbolset (symbolSetObj)
mapObj.fontset  (fontSetObj)
mapObj.labelcache  (labelCacheObj)
mapObj.reference  (referenceMapObj)
mapObj.scalebar  (scalebarObj)
mapObj.legend  (legendObj)
mapObj.querymap (queryMapObj)
mapObj.web  (webObj)
mapObj.configoptions  (hashTableObj)
webObj.map  (mapObj)
webObj.metadata  (hashTableObj)

One should avoid to set these parameters until it is fixed.

Marking this problem as critical.

Tamas

comment:2 by tomkralidis, 18 years ago

Tamas,

Trying this in perl mapscript returns no error:

my $layer = new mapscript::layerObj() || die "Can't create layerObj: $!\n";
$layer->{metadata}->set("wms_name", "gfoo");
print $layer->{metadata}->get("wms_name") ."\n";

Is this what you mean?

comment:3 by tomkralidis, 18 years ago

Trying this in perl gives me error:

[devgeo:/home/tkralidi/dd]$ perl dd.pl
Can't locate auto/mapscript/layerObj/set.al in @INC (@INC 
contains: /usr/lib/per
l5/site_perl/5.8.6/i386-linux-thread-multi /usr/lib/perl5/site_perl/5.8.5/i386-
l
inux-thread-multi /usr/lib/perl5/site_perl/5.8.4/i386-linux-thread-
multi /usr/li
b/perl5/site_perl/5.8.3/i386-linux-thread-
multi /usr/lib/perl5/site_perl/5.8.6 /
usr/lib/perl5/site_perl/5.8.5 /usr/lib/perl5/site_perl/5.8.4 /usr/lib/perl5/sit
e
_perl/5.8.3 /usr/lib/perl5/site_perl /usr/lib/perl5/vendor_perl/5.8.6/i386-
linux
-thread-multi /usr/lib/perl5/vendor_perl/5.8.5/i386-linux-thread-
multi /usr/lib/
perl5/vendor_perl/5.8.4/i386-linux-thread-
multi /usr/lib/perl5/vendor_perl/5.8.3
/i386-linux-thread-
multi /usr/lib/perl5/vendor_perl/5.8.6 /usr/lib/perl5/vendor_
perl/5.8.5 /usr/lib/perl5/vendor_perl/5.8.4 /usr/lib/perl5/vendor_perl/5.8.3 /u
s
r/lib/perl5/vendor_perl /usr/lib/perl5/5.8.6/i386-linux-thread-
multi /usr/lib/pe
rl5/5.8.6 .) at dd.pl line 11

by szekerest, 18 years ago

Attachment: drawmap.cs added

drawmap.cs

comment:4 by szekerest, 18 years ago

Added a simple example to reproduce the problem for C#. The simplest way to test
it is to replace the drawmap.cs with this code and use

nmake -f makefile.vc
nmake -f makefile.vc test

on windows for example.   

by szekerest, 18 years ago

Attachment: DrawMap.java added

drawmap.java

comment:5 by szekerest, 18 years ago

Resolution: fixed
Status: assignedclosed
Added the corresponding java example.

Upon the developer's agreement i've committed the necessary changes and closing
this bug.


Note: See TracTickets for help on using tickets.