Crash while trying to throw MARSHAL execptions on unions

"Michael Teske" <[email protected]> Tue, 08 Feb 2005 16:47:30 +0100

Newsgroups	gmane.comp.corba.orbacus
Organization	Imagnos AG
Message-ID	<[email protected]>

Hi!

A few days ago, we had one of our servers (using Orbacus) crashing
because a client somehow sent corrupted data to it. From the coredump it 
seemed that the server tried to return a MARSHAL exception, but 
unfortunately aborted trying to OB::Free() the half-constucted data 
structures.
After a while analyzing, I could boil the thing down to the small test 
program and idl attached with which it was easy here to reproduce the 
problem with Orbacus 4.2.1-eval under Linux.
Just do
idl DataTypes.idl
and
gcc -I. -I ../OB-4.2.1/include -g orb-crash.cpp DataTypes.cpp -L 
../OB-4.2.1/lib -lOB -lJTC -lpthread -ldl
and
./a.out



The problem seems to come from the generated code in DataTypes.cpp, in
dataTypes::TheData::_OB_unmarshal().

The "TheData" union has a flag, _ob_i_, which indicates if the union has 
been initialized already.
The destructor will free the corresponding string pointer only if _ob_i_ 
is true.
The problem now is, that dataTypes::TheData::_OB_unmarshal() FIRST sets
_ob_i_ to true and THEN calls
StringData = _ob_in -> read_string();

read_string() now may throw a MARSHAL exception, leaving StringData 
uninitialized but  _ob_i_ set to true. On destruction of the 
half-initialized data thr program aborts in OB::Free().

A quick fix would be to put _ob_i_ = true at the END of 
dataTypes::TheData::_OB_unmarshal(), would that be ok?

In the end one probably should fix the idl compiler to do it right...


Greetings,
	Michael

_______________________________________________
OB-Users Mailing List - [email protected]
http://mail.ooc.nf.ca/mailman/listinfo/ob-users
Visit our support FAQ before you send a message.
http://www.orbacus.com/faq/support.html

DataTypes.idl (text/x-idl, 1.6 KB)

/******************************************************************************
 *
 * Product:     X-Quote
 *
 * Title:       Data IDL
 *
 * Copyright:   (C) 2000-2001 Computer Services Kaisha (Deutschland) GmbH
 *
 *****************************************************************************/


#ifndef DataTypes_idl
#define DataTypes_idl 1


/**
 * The different Types of Data we deal with
 *
 * Formats for special types :
 *
 * PriceType   :  Sign,13 digits,Decimalpoint,6 digits,leading and not
 *                significant ceroes, e.g. +0000012345678.123000
 * VolumeType  :  Sign,13 digits,Decimalpoint,4 digits,leading and not
 *                significant ceroes, e.g. +00000123456789.1230
 * QuantityType:  Sign,17 digits, leading ceroes, e.g. : +00000123456789123
 * DateType    :  8 characters : CCYYMMTT
 * TimeType    :  8 characters : HHMMSSCC
 */

module dataTypes {

  /*@(#)*/const string InterfaceVersion = "$Revision: 1.3 $";

  /**
   * The different Types of Data we deal with
   */
  enum DataType {
    StringType,
    CharType,
    CardinalType,
    IntegerType
  };


  typedef string _String;
  typedef char _Char;
  typedef unsigned long _Cardinal;
  typedef long _Integer;



  /**
   * A universal Data Type.
   */
  union TheData switch (DataType) {
    case StringType:
      _String StringData;
    case CharType:
      _Char CharData;
    case CardinalType:
      _Cardinal CardinalData;
    case IntegerType:
      _Integer IntegerData;
  };

  /**
   * Field is defined as Name-Value pair
   */
  struct Field {
    string Name;
    TheData Value;
  };

 



};
#endif // DataTypes_idl

orb-crash.cpp (text/x-c++, 1.1 KB)


char correct_datatype[] = {
  0x05,0x00 ,0x00,0x00, 0x61,0x72 ,0x65,0x61 ,0x00,0xff ,0x31,0xff   
  ,0x00,0x00 ,0x00,0x00 ,0x09,0x00 ,0x00,0x00 ,0x42,0x75 ,0x73,0x69 ,0x6e,0x65 ,0x73,0x73   
  ,0x00,0xf7 ,0xbd,0xff };
  



#include "OB/CORBA.h"
#include "OB/Stream.h"
#include "DataTypes.h"


int main (int argc, char **argv)
{                   
 

  {
    // prevent uninitialized memory from being 0x00
    int *lala = new int[2024];
    for (int i = 0; i < 2023; i++)
      lala[i] = 0xdeadbeef;
    delete[] lala;
  }
 

  for (int i = 0; i < 2; i++) 
  {
    OCI::Buffer_var buf = new OCI::Buffer;
    buf->alloc(sizeof(correct_datatype));
    memcpy (buf->data_, correct_datatype, sizeof(correct_datatype));
    OB::InputStream_var _ob_in = new OB::InputStream(buf, 0, false);
    dataTypes::Field test_field;
    try {
      dataTypes::Field::_OB_unmarshal(test_field, _ob_in);
    } catch (CORBA::SystemException &e) {
      std::cerr << "got Exception: " << e << "\n";
    }

    // so, now overwite some terminating 0x00 to generate an exception
    correct_datatype[28] = 0x20;
  }

 
  return 0;

}