Details
Description
XMLStringTokenizer uses a RefVectorOf<XMLCh> for token storage (fTokens).
Unfortunately, the XMLCh * is allocated through new[], and later deallocated by
RefVectorOf<> with delete (instead of delete[]).
I suspect that this is a widespread problem in the library.
From XMLStringTokenizer.h:
// -----------------------------------------------------------------------
// Private data members
//
// fOffset
// The current position in the parsed string.
//
// fStringLen
// The length of the string parsed (for convenience).
//
// fString
// The string to be parsed
//
// fDelimeters
// A set of delimeter characters
//
// fTokens
// A vector of the token strings
// -----------------------------------------------------------------------
int fOffset;
int fStringLen;
XMLCh* fString;
XMLCh* fDelimeters;
RefVectorOf<XMLCh>* fTokens;
From XMLStringTokenizer.cpp:
// ---------------------------------------------------------------------------
// XMLStringTokenizer: Management methods
// ---------------------------------------------------------------------------
XMLCh* XMLStringTokenizer::nextToken() {
if (fOffset >= fStringLen)
{ return 0; } bool tokFound = false;
int startIndex = fOffset;
int endIndex = fOffset;
for (; endIndex < fStringLen; endIndex++) {
if (isDelimeter(fString[endIndex])) {
if (tokFound)
{ break; } startIndex++;
continue;
}
tokFound = true;
}
fOffset = endIndex;
if (tokFound)
{ XMLCh* tokStr = new XMLCh[(endIndex - startIndex) + 1]; XMLString::subString(tokStr, fString, startIndex, endIndex); fTokens->addElement(tokStr); return tokStr; } return 0;
}
The line: XMLCh* tokStr = new XMLCh[(endIndex - startIndex) + 1];
is a problem.