Changes between Initial Version and Version 1 of Ticket #5464


Ignore:
Timestamp:
May 8, 2014, 10:47:23 AM (10 years ago)
Author:
Even Rouault
Comment:

Legend:

Unmodified
Added
Removed
Modified

  • Ticket #5464 – Description

    initial v1  
    11There are situations where a few bytes can be written after then end of a buffer.
    22For example with the attached dataset.
     3
     4
     5{{{
     6$ valgrind ogrinfo /vsizip/ticket5464.gdb.zip/tmp.gdb/a00000003.gdbtable -al
     7==23995== Memcheck, a memory error detector
     8==23995== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al.
     9==23995== Using Valgrind-3.6.0.SVN-Debian and LibVEX; rerun with -h for copyright info
     10==23995== Command: ogrinfo /vsizip/ticket5464.gdb.zip/tmp.gdb/a00000003.gdbtable -al
     11==23995==
     12Had to open data source read-only.
     13INFO: Open of `/vsizip/ticket5464.gdb.zip/tmp.gdb/a00000003.gdbtable'
     14      using driver `OpenFileGDB' successful.
     15
     16Layer name: GDB_SpatialRefs
     17Geometry: Unknown (any)
     18Feature Count: 2
     19Layer SRS WKT:
     20(unknown)
     21FID Column = ID
     22SRTEXT: String (0.0)
     23FalseX: Real (0.0)
     24FalseY: Real (0.0)
     25XYUnits: Real (0.0)
     26FalseZ: Real (0.0)
     27ZUnits: Real (0.0)
     28FalseM: Real (0.0)
     29MUnits: Real (0.0)
     30XYTolerance: Real (0.0)
     31ZTolerance: Real (0.0)
     32MTolerance: Real (0.0)
     33OGRFeature(GDB_SpatialRefs):1
     34  SRTEXT (String) = GEOGCS["GCS_WGS_1984",DATUM["D_WGS_1984",SPHEROID["WGS_1984",6378137.0,298.257223563]],PRIMEM["Greenwich",0.0],UNIT["Degree",0.0174532925199433]]
     35  FalseX (Real) = -180
     36  FalseY (Real) = -90
     37  XYUnits (Real) = 1000000
     38  FalseZ (Real) = (null)
     39  ZUnits (Real) = (null)
     40  FalseM (Real) = (null)
     41  MUnits (Real) = (null)
     42  XYTolerance (Real) = 2e-06
     43  ZTolerance (Real) = (null)
     44  MTolerance (Real) = (null)
     45
     46==23995== Invalid write of size 1
     47==23995==    at 0x5A9D483: OpenFileGDB::FileGDBTable::SelectRow(int) (filegdbtable.cpp:1082)
     48==23995==    by 0x5D09FBD: OGROpenFileGDBLayer::GetNextFeature() (ogropenfilegdblayer.cpp:1249)
     49==23995==    by 0x40434D: ReportOnLayer(OGRLayer*, char const*, char const*, OGRGeometry*) (ogrinfo.cpp:557)
     50==23995==    by 0x403929: main (ogrinfo.cpp:334)
     51==23995==  Address 0x17785ab2 is 0 bytes after a block of size 242 alloc'd
     52==23995==    at 0x4C274A8: malloc (vg_replace_malloc.c:236)
     53==23995==    by 0x5A05BB1: VSIMalloc (cpl_vsisimple.cpp:505)
     54==23995==    by 0x5A9BD7C: OpenFileGDB::FileGDBTable::Open(char const*) (filegdbtable.cpp:670)
     55==23995==    by 0x5D06F89: OGROpenFileGDBLayer::BuildLayerDefinition() (ogropenfilegdblayer.cpp:255)
     56==23995==    by 0x5D07723: OGROpenFileGDBLayer::GetGeomType() (ogropenfilegdblayer.cpp:414)
     57==23995==    by 0x403D89: ReportOnLayer(OGRLayer*, char const*, char const*, OGRGeometry*) (ogrinfo.cpp:460)
     58==23995==    by 0x403929: main (ogrinfo.cpp:334)
     59==23995==
     60OGRFeature(GDB_SpatialRefs):2
     61  SRTEXT (String) = GEOGCS["GCS_Australian_Antarctic_1998",DATUM["D_Australian_Antarctic_1998",SPHEROID["GRS_1980",6378137.0,298.257222101]],PRIMEM["Greenwich",0.0],UNIT["Degree",0.0174532925199433]]
     62  FalseX (Real) = -400
     63  FalseY (Real) = -400
     64  XYUnits (Real) = 1000000000
     65  FalseZ (Real) = -100000
     66  ZUnits (Real) = 10000
     67  FalseM (Real) = (null)
     68  MUnits (Real) = (null)
     69  XYTolerance (Real) = 8.983153e-09
     70  ZTolerance (Real) = 0.001
     71  MTolerance (Real) = (null)
     72}}}