Re: Function descriptions longer than 255 cause XML parser error

Travelli Stefano <[email protected]> Wed, 15 Feb 2006 10:09:13 +0100
Newsgroups gmane.comp.windows.devel.jawin
Message-ID <[email protected]>
I have some news about the problem that I'll try to explain. Here is the stack trace:

[EXCEPTION] InfoPanel.generateInfo() failed to generated info
org.jawin.browser.xsl.TransformationException: TransformationManager.transform() failed to transform XML with stylesheet: stylesheets/info/dispatch.xsl - javax.xml.transform.TransformerException: An invalid XML character (Unicode: 0x{2}) was found in the value of attribute "{1}".
        at org.jawin.browser.xsl.TransformationManager.transform(TransformationManager.java:163)
        at org.jawin.browser.info.InfoPanel.generateInfo(InfoPanel.java:68)
        at org.jawin.browser.info.InfoPanel.selectionChanged(InfoPanel.java:61)
        at org.jawin.browser.tree.TypeDataTree.fireSelectionChanged(TypeDataTree.java:61)
        at org.jawin.browser.tree.TypeDataTree$1.valueChanged(TypeDataTree.java:71)
        at javax.swing.JTree.fireValueChanged(JTree.java:2399)
        at javax.swing.JTree$TreeSelectionRedirector.valueChanged(JTree.java:2770)
...
...

Running the tool in debug I found that the offending character cames from this XML:

<dispatch name="IMetisCriteria" 
          description="" 
          guid="{09e881db-f7ab-4ede-9B4D-4164937E6053}" 
          helpFile="" 
          helpReference="0" 
          projectName="Metis" 
          libraryFileName="K:\Progetti\jawin-1.0.19-src\IMetis.dll" 
          packageName="com.gformula.ecolead.metis" 
          saveDirectory="/progetti/ecolead/metis-stub/src" 
          javaEncoding="">
...some functions...
   <function name="description" 
            description="The description refers to the value of the element's desc attribute in xml.  Here are some special cases: Some elements, including instanceviews, do not have a desc attribute and will return an empty string.  In the case of instances, description will return t??? " 
            helpFile="" 
            helpReference="0" 
            invokeKind="DISPATCH_PROPERTYGET" 
            functionKind="FUNC_DISPATCH" 
            paramCount="0" 
            optionalParamCount="0" 
            vTableOffset="28">
           <return propertyType="8" 
             typeName="String" 
             typeString="VT_BSTR" 
             typePointer="VT_PBSTR" 
             javaString="String" 
             javaObjectType="java.lang.String" 
             javaSignature="" 
             javaNativeString="jstring" 
             javaNativeArray="jobjectArray" 
             cppString="CComBSTR" 
             cppDirect="VTS_BSTR" 
             cppPointer="VTS_PBSTR">
                    <idl flag="NONE"/>
           </return>
  </function>
... other functions...
</dispatch>

Don't get confused (as I did) by the fact that the name of the function is itself 'description'. The problem is in the content of _attribute_ 'description', since it ends with garbage chars.

The value is retrieved by the native implementation of ITypeInfo.getDocumentation() that relies on JNIEnv->NewStringUTF() to convert strings. Actually, I can't see any buffer allocation that could be overflowed in Jawin C++ code. So I imported the library in a COM container, that is MS Visual Basic, and... ops: the same garbaged string appears in the object browser!

Finally, I think the bug is not in Jawin but in my COM library. 

My workaround was to modify the constructor of class FunctionNode:

        public FunctionNode(String newName, String newDescription, String newHelpFile, int newHelpReference)
        {
                super(newName, null);
                description = newDescription.length() > 255 ? newDescription.substring(0, 255) : newDescription;
                helpFile = newHelpFile;
                helpReference = newHelpReference;
        }

Maybe this could be a safer way to analyze possibly malformed COM library and eventually any string should be checked. I don't know if a max string length is somehow mandated by the COM specifications.

stefano

-----Original Message-----
From: Discussion of Java/Win32/COM integration with Jawin [mailto:[email protected]] On Behalf Of Josh Passenger
Sent: Wednesday, February 15, 2006 12:30 AM
To: [email protected]
Subject: Re: [JAWIN] Function descriptions longer than 255 cause XML parser error


Hiya,

Can you please post the stack trace?

It would seem that the exception is a buffer overflow in the type extraction code, before the xml intermediate code is executed.

The only solution to this would be to trim that field before populating the doc char [] or increasing the size of this and also trimming strings that are too large.

Its likely to be a fix required in the C++ which means Roger....

Josh


>From: Travelli Stefano <[email protected]>
>Reply-To: Discussion of Java/Win32/COM integration with Jawin 
><[email protected]>
>To: [email protected]
>Subject: [JAWIN] Function descriptions longer than 255 cause XML parser 
>error
>Date: Tue, 14 Feb 2006 11:25:46 +0100
>MIME-Version: 1.0
>Received: from discuss.develop.com ([66.129.110.38]) by 
>bay0-mc2-f2.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.211); Tue, 
>14 Feb 2006 02:40:51 -0800
>Received: from develop-lserv (66.129.110.38) by discuss.develop.com 
>(LSMTP for Windows NT v1.1b) with SMTP id 
><[email protected]>; Tue, 14 Feb 2006 5:15:26 -0500
>Received: from DISCUSS.DEVELOP.COM by DISCUSS.DEVELOP.COM (LISTSERV-TCP/IP
>         release 1.8e) with spool id 3728628 for [email protected];
>          Tue, 14 Feb 2006 05:15:26 -0500
>Received: from srv-mta.gformula.com (62.101.80.188) by discuss.develop.com
>         (LSMTP for Windows NT v1.1b) with SMTP id 
><[email protected]>; Tue, 14 Feb 2006 5:00:25 -0500
>Received: from srv-mta.gformula.com (localhost [127.0.0.1]) by 
>srv-mta.gformula.com (Postfix) with ESMTP id 883BA613A for 
><[email protected]>; Tue, 14 Feb 2006 11:25:46 +0100 (CET)
>Received: from srvposta.gformula.net (srvposta [172.20.0.40]) by 
>srv-mta.gformula.com (Postfix) with ESMTP id 6BC496133 for 
><[email protected]>; Tue, 14 Feb 2006 11:25:46 +0100 (CET)
>X-Message-Info: NDMZeIBu+soUDY6yBHeEocmdwYIotfAr4l1fpjVoC4c=
>x-mimeole: Produced By Microsoft Exchange V6.0.6603.0
>X-MS-Has-Attach:
>X-MS-TNEF-Correlator:
>Thread-Topic: Function descriptions longer than 255 cause XML parser 
>error
>Thread-Index: AcYxUNO2GPQijf/3QW+A+2g0PaxOgg==
>X-Virus-Scanned: ClamAV using ClamSMTP
>Precedence: list
>Return-Path: [email protected]
>X-OriginalArrivalTime: 14 Feb 2006 10:40:51.0340 (UTC)
>FILETIME=[1FDF1CC0:01C63153]
>
>While generating stubs with the type browser I encountered several XML 
>parser exceptions caused by illegal unicode characters in the XML 
>stream.
>
>Digging into the code I found that the problem comes from some 
>functions in my COM DLL which have very long descriptions. Such strings 
>are retrieved with the ITypeInfo.getDocumentation() native method and 
>then they populate the XML "description" element. It seems that the 
>pBstrDocString[] has garbage after 255 characters.
>
>Unfortunately I'm not so fluent in c++, neither I have the compiler on 
>my PC at the moment, so as a workaround I modified the java code in 
>order to truncate such strings, though it should be better managing the 
>case in the native DLL.
>
>I'm using 1.0.19, but the same happens with 2.0 alpha1.
>
>Regards.
>
>
>
>
>
>Stefano Travelli
>Mobile +39 335 69 32 813
>[email protected] <mailto:[email protected]>
>
>Gruppo Formula S.p.A.
>Piazzale Ezio Tarantelli 100
>00144 Roma Italy
>skype://stefanotravelli
>Fax +39 06 5220 7598
>  <http://www.formula.it/> www.formula.it
>
>
>Il presente messaggio di posta elettronica e i relativi allegati sono 
>strettamente confidenziali, soggetti alle leggi vigenti e inviati 
>presupponendo che il destinatario effettuerà un appropriato controllo 
>per individuare eventuali virus. Se ricevi questo messaggio di posta 
>elettronica per errore, per favore telefonaci: è assolutamente vietato 
>usare, copiare, o divulgare il messaggio e ogni informazione in esso 
>contenuta, tranne che al destinatario originario. Le comunicazioni 
>internet non sono sicure e Gruppo Formula S.p.A. non è responsabile 
>per eventuali abusi di terze parti, per alterazioni nel corso della 
>trasmissione, né per danneggiamenti causati da virus o altre anomalie.
>
>