Re: ORBit bug?

[Dietmar Maurer <dietmar ximian com>]

Darin Adler wrote:

on 3/5/01 4:17 AM, Dietmar Maurer at dietmar ximian com wrote:

> The demarshalling code does not allocate memory for the name. Instead it
> uses a pointer into the receive buffer:
>
>     set._buffer[_ORBIT_tmpvar_3].name = (void *) _ORBIT_curptr;
>
> and later the code calls:
>
>     Bonobo_PropertySet__free(&set, NULL, CORBA_TRUE);
>
> Notice that release_strings is TRUE. So the memory is freed twice?

Ownership of individual elements in a sequence is controlled by a separate
flag named _release. If that's false, the elements in _buffer are not freed.
I'm guessing (without looking at the code) that it's false in this case.

Sure, but the code sets this flag to TRUE.
void
_ORBIT_skel_Bonobo_PropertyBag_setValues(POA_Bonobo_PropertyBag *
                                         _ORBIT_servant,
                                         GIOPRecvBuffer * _ORBIT_recv_buffer,
                                         CORBA_Environment * ev,
                                         void (*_impl_setValues)
                                         (PortableServer_Servant _servant,
                                          const Bonobo_PropertySet * set,
                                          CORBA_Environment * ev))
{
   Bonobo_PropertySet set = { 0, 0, NULL, CORBA_FALSE };

   {                            /* demarshalling */
      guchar *_ORBIT_curptr;
      register CORBA_unsigned_long _ORBIT_tmpvar_3;
      register CORBA_unsigned_long _ORBIT_tmpvar_4;
      CORBA_unsigned_long _ORBIT_tmpvar_5;

      _ORBIT_curptr = GIOP_RECV_BUFFER(_ORBIT_recv_buffer)->cur;
      if (giop_msg_conversion_needed(GIOP_MESSAGE_BUFFER(_ORBIT_recv_buffer))) {
         _ORBIT_curptr = ALIGN_ADDRESS(_ORBIT_curptr, 4);
         
            (*((guint32 *) & (set._length))) =
            GUINT32_SWAP_LE_BE(*((guint32 *) _ORBIT_curptr));
            _ORBIT_curptr += 4;
         set._maximum = set._length;
         set._buffer = CORBA_sequence_Bonobo_Pair_allocbuf(set._length);
         set._release = CORBA_TRUE;
         for (_ORBIT_tmpvar_3 = 0; _ORBIT_tmpvar_3 < set._length;
              _ORBIT_tmpvar_3++) {
            _ORBIT_curptr = ALIGN_ADDRESS(_ORBIT_curptr, 4);
            
               (*((guint32 *) & (_ORBIT_tmpvar_5))) =
               GUINT32_SWAP_LE_BE(*((guint32 *) _ORBIT_curptr));
            _ORBIT_curptr += 4;
            set._buffer[_ORBIT_tmpvar_3].name = (void *) _ORBIT_curptr;
            _ORBIT_curptr +=
               sizeof(set._buffer[_ORBIT_tmpvar_3].name[_ORBIT_tmpvar_4]) *
               _ORBIT_tmpvar_5;
            GIOP_RECV_BUFFER(_ORBIT_recv_buffer)->cur = _ORBIT_curptr;
            ORBit_demarshal_any(_ORBIT_recv_buffer,
                                &(set._buffer[_ORBIT_tmpvar_3].value),
                                CORBA_TRUE,
                                (((ORBit_ObjectKey
                                   *) _ORBIT_servant->_private)->object->
                                 orb));
            _ORBIT_curptr = GIOP_RECV_BUFFER(_ORBIT_recv_buffer)->cur;
         }

      } else {
         _ORBIT_curptr = ALIGN_ADDRESS(_ORBIT_curptr, 4);
         set._length = *((CORBA_unsigned_long *) _ORBIT_curptr);
         _ORBIT_curptr += 4;
         set._maximum = set._length;
         set._buffer = CORBA_sequence_Bonobo_Pair_allocbuf(set._length);
         set._release = CORBA_TRUE;
         for (_ORBIT_tmpvar_3 = 0; _ORBIT_tmpvar_3 < set._length;
              _ORBIT_tmpvar_3++) {
            _ORBIT_curptr = ALIGN_ADDRESS(_ORBIT_curptr, 4);
            _ORBIT_tmpvar_5 = *((CORBA_unsigned_long *) _ORBIT_curptr);
            _ORBIT_curptr += 4;
            set._buffer[_ORBIT_tmpvar_3].name = (void *) _ORBIT_curptr;
            _ORBIT_curptr +=
               sizeof(set._buffer[_ORBIT_tmpvar_3].name[_ORBIT_tmpvar_4]) *
               _ORBIT_tmpvar_5;
            GIOP_RECV_BUFFER(_ORBIT_recv_buffer)->cur = _ORBIT_curptr;
            ORBit_demarshal_any(_ORBIT_recv_buffer,
                                &(set._buffer[_ORBIT_tmpvar_3].value),
                                CORBA_TRUE,
                                (((ORBit_ObjectKey
                                   *) _ORBIT_servant->_private)->object->
                                 orb));
            _ORBIT_curptr = GIOP_RECV_BUFFER(_ORBIT_recv_buffer)->cur;
         }

      }
   }
   _impl_setValues(_ORBIT_servant, &(set), ev);
   {                            /* marshalling */
      register GIOPSendBuffer *_ORBIT_send_buffer;

      _ORBIT_send_buffer =
         giop_send_reply_buffer_use(GIOP_MESSAGE_BUFFER(_ORBIT_recv_buffer)->
                                    connection, NULL,
                                    _ORBIT_recv_buffer->message.u.request.
                                    request_id, ev->_major);
      if (_ORBIT_send_buffer) {
         if (ev->_major == CORBA_NO_EXCEPTION) {
         } else if (ev->_major == CORBA_USER_EXCEPTION) {
            static const ORBit_exception_marshal_info _ORBIT_user_exceptions[]
               = { {(const CORBA_TypeCode)
                    &TC_Bonobo_Property_InvalidValue_struct,
                    (gpointer) _ORBIT_Bonobo_Property_InvalidValue_marshal},
               {(const CORBA_TypeCode)
                &TC_Bonobo_Property_ReadOnlyProperty_struct,
                (gpointer) _ORBIT_Bonobo_Property_ReadOnlyProperty_marshal},
               {CORBA_OBJECT_NIL, NULL} };

            ORBit_send_user_exception(_ORBIT_send_buffer, ev,
                                      _ORBIT_user_exceptions);
         } else
            ORBit_send_system_exception(_ORBIT_send_buffer, ev);
         giop_send_buffer_write(_ORBIT_send_buffer);
         giop_send_buffer_unuse(_ORBIT_send_buffer);
      }
      Bonobo_PropertySet__free(&set, NULL, CORBA_TRUE);
   }
}