problem modifying axutil_stream_t in AXIOM_DATA_SOURCE node

["Lefrancois, Carl" <Ca...@axa-canada.com>]

Hi list,

Please help with some unexpected behaviour.  This morning I started
using the functions axutil_stream_read and axutil_stream_write to modify
the contents of an AXIOM_DATA_SOURCE node in my payload, and I am
getting program crashes.

I am using WSDL2C generated code stubs, and modifying the
axis2_stub_xx.c file to make changes to the payload.  I inserted a
function at the top of the file and call this function just after the
payload is generated on the line:

	payload = adb_<type>_serialize(_<type>, env, NULL, NULL,
AXIS2_TRUE, NULL, NULL);
      modify_stream_contents(payload, env);

My function navigates the payload node to find the AXIOM_DATA_SOURCE
node.  It then reads the contents into a buffer and does some
modification, then writes the modified data back into the stream.  I'm
including a minimal version of the function below that only reads the
stream and writes it back again without modification. 

The behaviour is strange: if the axutil_stream_write function specifies
a small count, the program doesn't crash.  In my case, I can specify up
to 1665 bytes without a crash.  (the full message size is 16860)

Am I doing something bad here? Are these stream functions meant to be
used in another way? The crash appears to be because of a buffer
overflow that mangles the state of other variables in the system.

(Axis2/C is version 1.3.0)

Any help is appreciated.

Carl


void modify_stream_contents(axiom_node_t *_node, const axutil_env_t
*env)
{
  axiom_data_source_t *dataSource = NULL;
  axutil_stream_t * stream = NULL;
  axiom_node_t *currentNode = NULL;
  axis2_char_t *buffer = NULL;
  size_t streamSize = 0;
  size_t readSize = 0;

  // navigate to node that contains stream
  currentNode = _node;
  while (currentNode && (axiom_node_get_node_type(currentNode, env) !=
AXIOM_ELEMENT))
  {
    currentNode = axiom_node_get_next_sibling(currentNode, env);
  }
  currentNode = axiom_node_get_first_child(currentNode, env);
  if (!currentNode || (axiom_node_get_node_type(currentNode, env) !=
AXIOM_DATA_SOURCE)) return;
  
  // get stream
  dataSource = (axiom_data_source_t *)
axiom_node_get_data_element(currentNode, env);
  stream = axiom_data_source_get_stream(dataSource, env);
  if (!stream) return;

  streamSize = axutil_stream_get_len(stream, env);
  buffer = (char *) AXIS2_MALLOC (env->allocator, sizeof (char) *
(streamSize));
  readSize = axutil_stream_read (stream, env, buffer, streamSize);
  readSize = axutil_stream_write (stream, env, buffer, 1665  );
//  readSize = axutil_stream_write (stream, env, buffer, streamSize  );
  AXIS2_FREE (env->allocator, buffer);
}
  _____  

"Ce message est confidentiel, a l'usage exclusif du destinataire
ci-dessus et son contenu ne represente en aucun cas un engagement de la
part de AXA, sauf en cas de stipulation expresse et par ecrit de la part
de AXA. Toute publication, utilisation ou diffusion, meme partielle,
doit etre autorisee prealablement. Si vous n'etes pas destinataire de ce
message, merci d'en avertir immediatement l'expediteur."

"This e-mail message is confidential, for the exclusive use of the
addressee and its contents shall not constitute a commitment by AXA,
except as otherwise specifically provided in writing by AXA. Any
unauthorized disclosure, use or dissemination, either whole or partial,
is prohibited. If you are not the intended recipient of the message,
please notify the sender immediately."

---------------------------------------------------------------------
To unsubscribe, e-mail: axis-c-user-unsubscribe@ws.apache.org
For additional commands, e-mail: axis-c-user-help@ws.apache.org

Re: problem modifying axutil_stream_t in AXIOM_DATA_SOURCE node

[Samisa Abeysinghe <sa...@wso2.com>]

Lefrancois, Carl wrote:
> Hi list,
>
> Please help with some unexpected behaviour.  This morning I started
> using the functions axutil_stream_read and axutil_stream_write to modify
> the contents of an AXIOM_DATA_SOURCE node in my payload, and I am
> getting program crashes.
>   

Can you send in the traces of the crashes?

Samisa...

> I am using WSDL2C generated code stubs, and modifying the
> axis2_stub_xx.c file to make changes to the payload.  I inserted a
> function at the top of the file and call this function just after the
> payload is generated on the line:
>
> 	payload = adb_<type>_serialize(_<type>, env, NULL, NULL,
> AXIS2_TRUE, NULL, NULL);
>       modify_stream_contents(payload, env);
>
> My function navigates the payload node to find the AXIOM_DATA_SOURCE
> node.  It then reads the contents into a buffer and does some
> modification, then writes the modified data back into the stream.  I'm
> including a minimal version of the function below that only reads the
> stream and writes it back again without modification. 
>
> The behaviour is strange: if the axutil_stream_write function specifies
> a small count, the program doesn't crash.  In my case, I can specify up
> to 1665 bytes without a crash.  (the full message size is 16860)
>
> Am I doing something bad here? Are these stream functions meant to be
> used in another way? The crash appears to be because of a buffer
> overflow that mangles the state of other variables in the system.
>
> (Axis2/C is version 1.3.0)
>
> Any help is appreciated.
>
> Carl
>
>
> void modify_stream_contents(axiom_node_t *_node, const axutil_env_t
> *env)
> {
>   axiom_data_source_t *dataSource = NULL;
>   axutil_stream_t * stream = NULL;
>   axiom_node_t *currentNode = NULL;
>   axis2_char_t *buffer = NULL;
>   size_t streamSize = 0;
>   size_t readSize = 0;
>
>   // navigate to node that contains stream
>   currentNode = _node;
>   while (currentNode && (axiom_node_get_node_type(currentNode, env) !=
> AXIOM_ELEMENT))
>   {
>     currentNode = axiom_node_get_next_sibling(currentNode, env);
>   }
>   currentNode = axiom_node_get_first_child(currentNode, env);
>   if (!currentNode || (axiom_node_get_node_type(currentNode, env) !=
> AXIOM_DATA_SOURCE)) return;
>   
>   // get stream
>   dataSource = (axiom_data_source_t *)
> axiom_node_get_data_element(currentNode, env);
>   stream = axiom_data_source_get_stream(dataSource, env);
>   if (!stream) return;
>
>   streamSize = axutil_stream_get_len(stream, env);
>   buffer = (char *) AXIS2_MALLOC (env->allocator, sizeof (char) *
> (streamSize));
>   readSize = axutil_stream_read (stream, env, buffer, streamSize);
>   readSize = axutil_stream_write (stream, env, buffer, 1665  );
> //  readSize = axutil_stream_write (stream, env, buffer, streamSize  );
>   AXIS2_FREE (env->allocator, buffer);
> }
>   _____  
>
> "Ce message est confidentiel, a l'usage exclusif du destinataire
> ci-dessus et son contenu ne represente en aucun cas un engagement de la
> part de AXA, sauf en cas de stipulation expresse et par ecrit de la part
> de AXA. Toute publication, utilisation ou diffusion, meme partielle,
> doit etre autorisee prealablement. Si vous n'etes pas destinataire de ce
> message, merci d'en avertir immediatement l'expediteur."
>
> "This e-mail message is confidential, for the exclusive use of the
> addressee and its contents shall not constitute a commitment by AXA,
> except as otherwise specifically provided in writing by AXA. Any
> unauthorized disclosure, use or dissemination, either whole or partial,
> is prohibited. If you are not the intended recipient of the message,
> please notify the sender immediately."
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: axis-c-user-unsubscribe@ws.apache.org
> For additional commands, e-mail: axis-c-user-help@ws.apache.org
>
>
>
>   


-- 
Samisa Abeysinghe 
Director, Engineering; WSO2 Inc.

http://www.wso2.com/ - "The Open Source SOA Company"


---------------------------------------------------------------------
To unsubscribe, e-mail: axis-c-user-unsubscribe@ws.apache.org
For additional commands, e-mail: axis-c-user-help@ws.apache.org