[gdal-dev] OGRFree(pszSrcWKT) can crash Matlab

[jluis at ualg.pt]

Hi,

I have a serious crash in one of my Matlab MEXs caused by a call to  
OGRFree() with an argument of size one (possibly the  null terminator).
This happens on OSX SL (64 bits) but not on Windows (where I still  
build at 32 bits)

Here is, as far as I could trace it, what is happening (SVN version of  
the same age as GDAL1.7RC1)

mexPrintf("---- %s\n%s\n", pszSrcWKT,pszDstWKT);

That prints

---- GEOGCS["WGS 84",DATUM["WGS_1984",SPHEROID["WGS  
84",6378137,298.257223563,AUTHORITY["EPSG","7030"]],TOWGS84[0,0,0,0,0,0,0],AUTHORITY["EPSG","6326"]],PRIMEM["Greenwich",0,AUTHORITY["EPSG","8901"]],UNIT["degree",0.0174532925199433,AUTHORITY["EPSG","9108"]],AUTHORITY["EPSG","4326"]]
PROJCS["UTM Zone 29, Northern Hemisphere",GEOGCS["WGS  
84",DATUM["WGS_1984",SPHEROID["WGS  
84",6378137,298.257223563,AUTHORITY["EPSG","7030"]],TOWGS84[0,0,0,0,0,0,0],AUTHORITY["EPSG","6326"]],PRIMEM["Greenwich",0,AUTHORITY["EPSG","8901"]],UNIT["degree",0.0174532925199433,AUTHORITY["EPSG","9108"]],AUTHORITY["EPSG","4326"]],PROJECTION["Transverse_Mercator"],PARAMETER["latitude_of_origin",0],PARAMETER["central_meridian",-9],PARAMETER["scale_factor",0.9996],PARAMETER["false_easting",500000],PARAMETER["false_northing",0],UNIT["Meter",1]]


Next the code does:

	GDALClose( hSrcDS );
mexPrintf("---- %s\n%s\n", pszSrcWKT,pszDstWKT);

and now pszSrcWKT is empty. See

---- 
PROJCS["UTM Zone 29, Northern Hemisphere",GEOGCS["WGS  
84",DATUM["WGS_1984",SPHEROID["WGS  
84",6378137,298.257223563,AUTHORITY["EPSG","7030"]],TOWGS84[0,0,0,0,0,0,0],AUTHORITY["EPSG","6326"]],PRIMEM["Greenwich",0,AUTHORITY["EPSG","8901"]],UNIT["degree",0.0174532925199433,AUTHORITY["EPSG","9108"]],AUTHORITY["EPSG","4326"]],PROJECTION["Transverse_Mercator"],PARAMETER["latitude_of_origin",0],PARAMETER["central_meridian",-9],PARAMETER["scale_factor",0.9996],PARAMETER["false_easting",500000],PARAMETER["false_northing",0],UNIT["Meter",1]]

If I make it print the size of pszSrcWKT  with strlen(pszSrcWKT) the  
answer is 1 and finally the MEX (and the entire MATLAB) crash on the  
call

OGRFree(pszSrcWKT);


Joaquim Luis

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.