0025537: XmlMPrsStd_PositionDriver::Paste runtime check crash.

Increased a size of buffer in array of 'char' to fit the largest possible conversion from 'double' to %.17g string.

diff --git a/src/XmlMDataXtd/XmlMDataXtd_PositionDriver.cxx b/src/XmlMDataXtd/XmlMDataXtd_PositionDriver.cxx
index 60aaa106fd3e1d24750a000057fa4813b9a51c3d..2117364d31fd07a054b64705e56dec993a4c5574 100644 (file)
--- a/src/XmlMDataXtd/XmlMDataXtd_PositionDriver.cxx
+++ b/src/XmlMDataXtd/XmlMDataXtd_PositionDriver.cxx
@@ -122,7 +122,7 @@ void XmlMDataXtd_PositionDriver::Paste
   if (!aTPos.IsNull())
   {
     gp_Pnt aPos = aTPos->GetPosition();
-    char buf [64];
+    char buf [75]; // (24 + 1) * 3
     Sprintf (buf, "%.17g %.17g %.17g", aPos.X(), aPos.Y(), aPos.Z());
     XmlObjMgt::SetStringValue(theTarget.Element(), buf);
   }

diff --git a/src/XmlMXCAFDoc/XmlMXCAFDoc_CentroidDriver.cxx b/src/XmlMXCAFDoc/XmlMXCAFDoc_CentroidDriver.cxx
index 0166afae0d580f190b11780df4aca28b85966ea0..100a91776ed5f67b801549d7a585f46b14eb9166 100644 (file)
--- a/src/XmlMXCAFDoc/XmlMXCAFDoc_CentroidDriver.cxx
+++ b/src/XmlMXCAFDoc/XmlMXCAFDoc_CentroidDriver.cxx
@@ -121,7 +121,7 @@ void XmlMXCAFDoc_CentroidDriver::Paste
   if (!aTPos.IsNull())
   {
     gp_Pnt aPos = aTPos->Get();
-    char buf [64];
+    char buf[75]; // (24 + 1) * 3
     Sprintf (buf, "%.17g %.17g %.17g", aPos.X(), aPos.Y(), aPos.Z());
     XmlObjMgt::SetStringValue(theTarget.Element(), buf);
   }

diff --git a/src/XmlObjMgt/XmlObjMgt_GP.cxx b/src/XmlObjMgt/XmlObjMgt_GP.cxx
index 1a6e5604e71ab06b910d87fafdcdc35dac4c92e4..ddb9db049e5fa362d1779b70e358e932c0e8aed0 100644 (file)
--- a/src/XmlObjMgt/XmlObjMgt_GP.cxx
+++ b/src/XmlObjMgt/XmlObjMgt_GP.cxx
@@ -61,7 +61,7 @@ XmlObjMgt_DOMString XmlObjMgt_GP::Translate (const gp_Mat& aMat)
 //=======================================================================
 XmlObjMgt_DOMString XmlObjMgt_GP::Translate (const gp_XYZ& anXYZ)
 {
-  char buf [64];
+  char buf [75]; // (24 + 1) * 3
   Sprintf (buf, "%.17g %.17g %.17g", anXYZ.X(), anXYZ.Y(), anXYZ.Z());
   return XmlObjMgt_DOMString (buf);
 }

diff --git a/tests/bugs/caf/bug25537 b/tests/bugs/caf/bug25537
new file mode 100644 (file)
index 0000000..1da77c1
--- /dev/null
+++ b/tests/bugs/caf/bug25537
@@ -0,0 +1,29 @@
+puts "============"
+puts "OCC25537"
+puts "============"
+puts ""
+#######################################################################
+# XmlMPrsStd_PositionDriver::Paste runtime check crash.
+#######################################################################
+pload XDEDRAW
+
+NewDocument Doc XmlXCAF
+
+# number that takes 24 symbols in %.17g string
+set aBigNum -0.0000000000123456789123456789
+
+# Create TDataXtd_Position and XCAFDoc_Centroid attributes (same problem in writing XML)
+# 100 labels to have a stable exception (memory corruption)
+for {set i 1} {$i < 100} {incr i} {
+  set aLab1 0:1:$i
+  SetPosition Doc $aLab1 $aBigNum $aBigNum $aBigNum
+  set aLab2 0:2:$i
+  Label Doc $aLab2
+  XSetCentroid Doc $aLab2 $aBigNum $aBigNum $aBigNum
+}
+
+set aFile ${imagedir}/bug25537_test.xml
+SaveAs Doc ${aFile}
+
+## ==> No exception
+Close Doc