You are viewing a plain text version of this content. The canonical link for it is here.
Posted to java-dev@axis.apache.org by Floyd Brown <fb...@terahop.com> on 2008/03/27 13:40:50 UTC

"double free or corruption" with adb serialization (forgot to specify version of build)

Issue with WSDL2C java generator? (version distribution-SNAPSHOT-bin.zip
15-Mar-2008 02:44  )

I used the WSDL2C tool to gen ADB code for my axis2c client/service. I
noticed that all the sections inside "adb_clasXXX_serialize()" with the
comment "parsing xxx element" seem to create to variables called
"end_input_str" and "start_input_str". After the code calls
"auxutil_stream_write()" for both variables, the code calls AXIS2_FREE()
on "end_input_str" in both cases (so "start_input_str" does not get
deleted). This causes a glibc "double free or corrupt" problem.

--snip--

/*
                      * parsing areaID element
                      */

                            sprintf(start_input_str, "<%s%sareaID>",
                                 p_prefix?p_prefix:"",
                                 (p_prefix && axutil_strcmp(p_prefix,
""))?":":"");
                            
                        start_input_str_len =
axutil_strlen(start_input_str);
                        sprintf(end_input_str, "</%s%sareaID>",
                                 p_prefix?p_prefix:"",
                                 (p_prefix && axutil_strcmp(p_prefix,
""))?":":"");
                        end_input_str_len =
axutil_strlen(end_input_str);
                    
                           text_value_3 = _RegReq->property_areaID;
                           
                           axutil_stream_write(stream, env,
start_input_str, start_input_str_len);
                           AXIS2_FREE(env->allocator,end_input_str);
                           
                            
                           text_value_3_temp =
axutil_xml_quote_string(env, text_value_3, AXIS2_TRUE);
                           if (text_value_3_temp)
                           {
                               axutil_stream_write(stream, env,
text_value_3_temp, axutil_strlen(text_value_3_temp));
                               AXIS2_FREE(env->allocator,
text_value_3_temp);
                           }
                           else
                           {
                               axutil_stream_write(stream, env,
text_value_3, axutil_strlen(text_value_3));
                           }
                           
                           axutil_stream_write(stream, env,
end_input_str, end_input_str_len);
                           AXIS2_FREE(env->allocator,end_input_str);

Thanks


Re: "double free or corruption" with adb serialization (forgot to specify version of build)

Posted by Dimuthu Gamage <di...@gmail.com>.
Hi Floyd,
This is corrected in the latest svn. And we applied the patch you sent.

Thanks
Dimuthu

On Thu, Mar 27, 2008 at 6:10 PM, Floyd Brown <fb...@terahop.com> wrote:
>
>  Issue with WSDL2C java generator? (version distribution-SNAPSHOT-bin.zip
> 15-Mar-2008 02:44  )
>
>  I used the WSDL2C tool to gen ADB code for my axis2c client/service. I
> noticed that all the sections inside "adb_clasXXX_serialize()" with the
> comment "parsing xxx element" seem to create to variables called
> "end_input_str" and "start_input_str". After the code calls
> "auxutil_stream_write()" for both variables, the code calls AXIS2_FREE() on
> "end_input_str" in both cases (so "start_input_str" does not get deleted).
> This causes a glibc "double free or corrupt" problem.
>
>  --snip--
>
>  /*
>                        * parsing areaID element
>                        */
>
>                              sprintf(start_input_str, "<%s%sareaID>",
>                                   p_prefix?p_prefix:"",
>                                   (p_prefix && axutil_strcmp(p_prefix,
> ""))?":":"");
>
>                          start_input_str_len =
> axutil_strlen(start_input_str);
>                          sprintf(end_input_str, "</%s%sareaID>",
>                                   p_prefix?p_prefix:"",
>                                   (p_prefix && axutil_strcmp(p_prefix,
> ""))?":":"");
>                          end_input_str_len = axutil_strlen(end_input_str);
>
>                             text_value_3 = _RegReq->property_areaID;
>
>                             axutil_stream_write(stream, env,
> start_input_str, start_input_str_len);
>                             AXIS2_FREE(env->allocator,end_input_str);
>
>
>                             text_value_3_temp = axutil_xml_quote_string(env,
> text_value_3, AXIS2_TRUE);
>                             if (text_value_3_temp)
>                             {
>                                 axutil_stream_write(stream, env,
> text_value_3_temp, axutil_strlen(text_value_3_temp));
>                                 AXIS2_FREE(env->allocator,
> text_value_3_temp);
>                             }
>                             else
>                             {
>                                 axutil_stream_write(stream, env,
> text_value_3, axutil_strlen(text_value_3));
>                             }
>
>                             axutil_stream_write(stream, env, end_input_str,
> end_input_str_len);
>                             AXIS2_FREE(env->allocator,end_input_str);
>
>  Thanks
>
>

---------------------------------------------------------------------
To unsubscribe, e-mail: axis-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: axis-dev-help@ws.apache.org