DO NOT REPLY [Bug 25624] New: - Valgrind reports "Source and destination overlap in memcpy"

[bu...@apache.org]

DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG 
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://nagoya.apache.org/bugzilla/show_bug.cgi?id=25624>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND 
INSERTED IN THE BUG DATABASE.

http://nagoya.apache.org/bugzilla/show_bug.cgi?id=25624

Valgrind reports "Source and destination overlap in memcpy"

           Summary: Valgrind reports "Source and destination overlap in
                    memcpy"
           Product: Xerces-C++
           Version: 2.3.0
          Platform: Other
        OS/Version: All
            Status: NEW
          Severity: Minor
          Priority: Other
         Component: Miscellaneous
        AssignedTo: xerces-c-dev@xml.apache.org
        ReportedBy: dominik.stadler@gmx.at


While looking for a problem in our application, I ran valgrind and saw the
following report. I know this does normally work fine, but I though I report it,
maybe there is an easy fix for this.

Valgrind reports:
==17958== Source and destination overlap in memcpy(0x450987CC, 0x450987CC, 40)
==17958==    at 0x40024665: memcpy (mac_replace_strmem.c:93)
==17958==    by 0x40E15F55: xercesc_2_3::XMLBuffer::set(unsigned short const *,
unsigned int) (XMLBuffer.cpp:122)
==17958==    by 0x40D8380D:
xercesc_2_3::IGXMLScanner::resolveSchemaGrammar(unsigned short const *, unsigned
short const *) (IGXMLScanner2.cpp:1325)
==17958==    by 0x40D832CF:
xercesc_2_3::IGXMLScanner::scanRawAttrListforNameSpaces(xercesc_2_3::RefVectorOf<xercesc_2_3::KVStringPair>
const *, int) (IGXMLScanner2.cpp:1249)
==17958==    by 0x40D8C84D: xercesc_2_3::IGXMLScanner::scanStartTagNS(bool &)
(IGXMLScanner.cpp:2034)
==17958==    by 0x40D89717: xercesc_2_3::IGXMLScanner::scanContent(bool)
(IGXMLScanner.cpp:849)
==17958==    by 0x40D87D54:
xercesc_2_3::IGXMLScanner::scanDocument(xercesc_2_3::InputSource const &)
(IGXMLScanner.cpp:209)
==17958==    by 0x40E22B87: xercesc_2_3::XMLScanner::scanDocument(unsigned short
const *) (XMLScanner.cpp:419)
==17958==    by 0x40E23105: xercesc_2_3::XMLScanner::scanDocument(char const *)
(XMLScanner.cpp:427)
==17958==    by 0x40CF22EF: xercesc_2_3::AbstractDOMParser::parse(char const *)
(AbstractDOMParser.cpp:477)


The code in XMLBuffer.cpp is:
void XMLBuffer::set(const XMLCh* const chars, const unsigned int count)
{
    ...
    memcpy(fBuffer, chars, actualCount * sizeof(XMLCh));

so the pointer "XMLCh* chars" that is passed in is from the XMLBuffer itself.


The code in IGXMLScanner2.cpp is:

        // Create a buffer for expanding the system id
        XMLBufBid bbSys(&fBufMgr);
        XMLBuffer& expSysId = bbSys.getBuffer();
        XMLBuffer& normalizedSysId = bbSys.getBuffer();

        ...

        if (fEntityHandler)
        {
            ...
        }
        else
        {
            expSysId.set(normalizedURI);
        }

Why are there two equal references to an XMLBuffer used? wouldn't it just be
possible to remove one of them? Then the call to set() is actually an assignment
to itself and could go away completely.

I checked the code and it seems this is still the same for 2.4 and CVS-LATEST.

---------------------------------------------------------------------
To unsubscribe, e-mail: xerces-c-dev-unsubscribe@xml.apache.org
For additional commands, e-mail: xerces-c-dev-help@xml.apache.org