[XERCESC-2088] Bad casting from DOMTextImpl to DOMElementImpl

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.1.1, 3.1.2, 3.1.3, 3.1.4
• Fix Version/s: 3.2.0
• Component/s: DOM
• Environment: ubuntu 16.04 LTS, Intel(R) Core(TM) i7-6700 CPU @ 3.40GHz, 16GB
• Assignee: Scott Cantor
• Reporter: Yuseok Jeon
• Created: 22/Mar/17 05:04
• Updated: 30/Dec/19 14:45
• Resolved: 05/Jul/17 18:53

Description

Hi all,

Our recently developed type confusion detection tool reports a type_confusion error in the "xercesc/dom/imple/DOMCasts.hpp"

xercesc/dom/imple/DOMCasts.hpp, line 146

static inline DOMNodeImpl *castToNodeImpl(const DOMNode *p)
{
DOMElementImpl *pE = (DOMElementImpl *)p;
return &(pE->fNode);
}

p is pointing to the object allocated as DOMTextImpl, and it is casted into DOMElementImpl. However, since DOMElementImpl is not a subobject of DOMTextImpl, it is violating C++ standard rules 5.2.9/11 (down casting is undefined if the object that the pointer to be casted points to is not a suboject of down casting type) and causes undefined behaviors.

There are similar type-confusion cases as below links.

• (libstdc++) https://gcc.gnu.org/bugzilla/show_bug.cgi?id=60734
• (Firefox) https://bugzilla.mozilla.org/show_bug.cgi?id=1074280

I attached a actual type confusion report and object relationship information.

Issue Links

• causes: XERCESC-2131 DOMParentNode::appendChildFast is not efficient due to multiple dynamic_casts
• causes: XERCESC-2157 Xerces C++ rtti requirement.