DO NOT REPLY [Bug 3764] New: - Memory allocation problem in DOMString class

[bu...@apache.org]

DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG 
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://nagoya.apache.org/bugzilla/show_bug.cgi?id=3764>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND 
INSERTED IN THE BUG DATABASE.

http://nagoya.apache.org/bugzilla/show_bug.cgi?id=3764

Memory allocation problem in DOMString class

           Summary: Memory allocation problem in DOMString class
           Product: Xerces-C++
           Version: 1.5.1
          Platform: PC
        OS/Version: Windows NT/2K
            Status: NEW
          Severity: Normal
          Priority: Other
         Component: DOM
        AssignedTo: xerces-c-dev@xml.apache.org
        ReportedBy: serbanutav@yahoo.com


The char *DOMString::transcode() function should allocate memory for the 
returned string, and the caller should free the memory. However, when I try to 
delete the string, it chrashes on the debug version. On the release version it 
seems ok, but I can't tell if the memory is freed or not.

On the debug version the error is an assertion that fails, _ASSERTE
(_BLOCK_TYPE_IS_VALID(pHead->nBlockUse)) in DBGDEL.CPP.

I use Visual C++ 6.0 Enterprise Edition.

A sample code that crashes follows. However, all programs that I tried crashed 
when I tried to free the string. The "<<" operator was copy-pasted from the 
DOMPrint example distributed with xerces 1.5.1 for Win32 (the DOMPrint.cpp 
file).

#include <iostream>
using namespace std;

#include "dom/DOMString.hpp"
#include "util/PlatformUtils.hpp"

ostream& operator<< (ostream& target, const DOMString& s)
{
    char *p = s.transcode();
    target << p;
    delete [] p; //this is the line that generates the program crash
    return target;
}

int main(int argc, char* argv[])
{
    try{
        XMLPlatformUtils::Initialize();
    }catch (...){
		return 1;
    }

	DOMString s("Hello world");

	cout<<s;
	
	XMLPlatformUtils::Terminate();

	printf("Hello World!\n");
	return 0;
}

When I removed the delete [] p; line the program did not crash, but I think the 
memory is not freed.

---------------------------------------------------------------------
To unsubscribe, e-mail: xerces-c-dev-unsubscribe@xml.apache.org
For additional commands, e-mail: xerces-c-dev-help@xml.apache.org