OpenSAML user discussion

["Brian Sheely" <>]

Okay, back to the XMLObject code. As I mentioned previously, the
following replicate call is made and crashes on the memcpy. If toRep and
ret do not overlap in memory, my guess would be that toRep is not null
terminated and the memcpy goes past the end of the buffer. In Linux, I'd
know how to look at the calls which preceeded the crash. There's
probably a way to do that in Visual, but I simply tried to follow the
call chain and gave up after what seemed like hundreds of calls. I
assume that the test code either never has to make this call or if it
does, toRep is always null terminated.


char* XMLString::replicate( const char* const    toRep
                          , MemoryManager* const manager)
{
    // If a null string, return a null string
    if (!toRep)
        return 0;

    //
    //  Get the len of the source and allocate a new buffer. Make sure
to
    //  account for the nul terminator.
    //
    const unsigned int srcLen = strlen(toRep);
    char* ret = (char*) manager->allocate((srcLen+1) * sizeof(char));
//new char[srcLen+1];

    // Copy over the text, adjusting for the size of a char
    memcpy(ret, toRep, (srcLen+1) * sizeof(char));
    return ret;
}

Brian Sheely