DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG 
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://nagoya.apache.org/bugzilla/show_bug.cgi?id=25218>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND 
INSERTED IN THE BUG DATABASE.

http://nagoya.apache.org/bugzilla/show_bug.cgi?id=25218

Array Bound Read, causing inconsistent segmentation violation in 
XMLFormatter::formatBuf

           Summary: Array Bound Read, causing inconsistent segmentation
                    violation in XMLFormatter::formatBuf
           Product: Xerces-C++
           Version: 2.3.0
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: Critical
          Priority: Other
         Component: Utilities
        AssignedTo: [EMAIL PROTECTED]
        ReportedBy: [EMAIL PROTECTED]


from XMLFormatter.cpp, line 363

when tmpPtr == endPtr it still gets dereferenced:

            while (!inEscapeList(actualEsc, *tmpPtr) && (tmpPtr < endPtr))
                tmpPtr++;

this should have been:

            while ((tmpPtr < endPtr)) && !inEscapeList(actualEsc, *tmpPtr))
                tmpPtr++;

It shows up as an array bound read in Purify when the array of characters is 
not null terminated.
This is very evil since it will only cause a problem if the string was 
allocated at the very end of the free store.

---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Reply via email to