Uploaded image for project: 'Xerces-C++'
  1. Xerces-C++
  2. XERCESC-1251

makeContentModel in ComplexTypeInfo could crash Xerces when creating a MixedContentModel

    XMLWordPrintableJSON

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Critical
    • Resolution: Fixed
    • Affects Version/s: 2.5.0
    • Fix Version/s: 2.6.0
    • Labels:
      None
    • Environment:
      Windows Xp Sp1

      Description

      In makeContentModel method in complextypeinfo.cpp, the following code could crash Xerces:

      aSpecNode = new (fMemoryManager) ContentSpecNode(*fContentSpec);
      aSpecNode = convertContentSpecTree(aSpecNode, checkUPA);
      retModel = buildContentModel(aSpecNode);
      delete aSpecNode;

      In the case when buildContentModel creates a MixedContentModel model, the statement "delete aSpecNode" freed fChildren in MixedContentModel. Later access to fChildren could crash Xerces.

      We ran into some crashes due to this bug. One possible fix is to create a QName in the class MixedContentModel:

      line 212

      for (unsigned int index = 0; index < fCount; index++)

      { fChildren[index] = new QName(*children.elementAt(index)); fChildTypes[index] = childTypes.elementAt(index); }

        Attachments

          Activity

            People

            • Assignee:
              Unassigned
              Reporter:
              afang Andrew Fang
            • Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: