Archived issue #0028327
BSplCLib can cause memory corruption in degenerated cases
Description
Some methods of BSplCLib are directly using the memory address of the knots array. This can lead to reading invalid memory addresses and/or crashes. If the indexing operator would be used instead, this would just simply lead to throwing an exception instead of reading memory garbage. I am pretty sure that on a modern C++ compiler this would not lead to performance fallback (at least it did not in our case), but indeed it needs more investigation.
Patch is attached.
Patch is attached.
Steps to reproduce
Not available
Public activity
7 archived notes
Participants are labeled by their role within this record.
Istvan, do you have a test case for which BSplCLib::KnotForm goes out of array bounds?
I see the similar code for BSplCLib::MultForm, near the line 640.
One of our users was trying to import an IGS file, and it always crashed for him. We figured out from the crash logs that this was the problem, but we did not have access to the IGS file.
Branch [archived branch] has been created by Participant.
[revision removed]
Detailed log of new commits:
Author: msv
Date: Wed Feb 1 11:35:50 2017 +0300
0028327: BSplCLib can cause memory corruption in degenerated cases
The code of the methods BSplCLib::KnotForm and BSplCLib::MultForm has been made safe by giving up using of address of array item for iteration on the Array1. Also the checking for degenerated case has been added to prevent out of bounds exception.
[revision removed]
Detailed log of new commits:
Author: msv
Date: Wed Feb 1 11:35:50 2017 +0300
0028327: BSplCLib can cause memory corruption in degenerated cases
The code of the methods BSplCLib::KnotForm and BSplCLib::MultForm has been made safe by giving up using of address of array item for iteration on the Array1. Also the checking for degenerated case has been added to prevent out of bounds exception.
Please test.
Dear BugMaster,
Branch CR28327 from occt git-repository (and master from products git-repository) was compiled on Linux, MacOS and Windows platforms and tested.
[revision removed]
Number of compiler warnings:
occt component:
Linux: 0 (0 on master)
Windows: 0 (0 on master)
MasOS: 0 (0 on master)
products component:
Linux: 63
Windows: 0
MacOS: 1146
Regressions/Differences:
Not detected
Testing cases:
Not needed
Testing on Linux:
Total MEMORY difference: 92389727 / 92303976 [+0.09%]
Total CPU difference: 19771.190000000177 / 19914.260000000217 [-0.72%]
Testing on Windows:
Total MEMORY difference: 57618548 / 57618048 [+0.00%]
Total CPU difference: 18559.04896749855 / 18683.178963198647 [-0.66%]
Branch CR28327 from occt git-repository (and master from products git-repository) was compiled on Linux, MacOS and Windows platforms and tested.
[revision removed]
Number of compiler warnings:
occt component:
Linux: 0 (0 on master)
Windows: 0 (0 on master)
MasOS: 0 (0 on master)
products component:
Linux: 63
Windows: 0
MacOS: 1146
Regressions/Differences:
Not detected
Testing cases:
Not needed
Testing on Linux:
Total MEMORY difference: 92389727 / 92303976 [+0.09%]
Total CPU difference: 19771.190000000177 / 19914.260000000217 [-0.72%]
Testing on Windows:
Total MEMORY difference: 57618548 / 57618048 [+0.00%]
Total CPU difference: 18559.04896749855 / 18683.178963198647 [-0.66%]
Branch [archived branch] has been deleted by Participant.
[revision removed]
[revision removed]