[gdal-dev] OGRFree(pszSrcWKT) can crash Matlab

[Even Rouault]

Joaquim,

you don't provide enough code to really see what's wrong, but my guess is that you misuse GDAL API.

If you get pszSrcWKT, with

pszSrcWKT = GDALGetProjectionRef(hDS);

The pszSrcWKT string is owned by the hDS object, so as soon as you destroy the hDS object with GDALClose(), the pointer becomes invalid and points to arbitrary data.

For the same reason, you should never free the string returned by GDALGetProjectionRef() with OGRFree() or any other free() call.

See http://gdal.org/classGDALDataset.html :

GDALDataset::GetProjectionRef() :

returns:
a pointer to an internal reference string. It should not be altered, freed or expected to last for long.

Best regards,

Even

Le Saturday 23 January 2010 16:04:58 jluis at ualg.pt, vous avez écrit :
> Hi,
>
> I have a serious crash in one of my Matlab MEXs caused by a call to
> OGRFree() with an argument of size one (possibly the  null terminator).
> This happens on OSX SL (64 bits) but not on Windows (where I still
> build at 32 bits)
>
> Here is, as far as I could trace it, what is happening (SVN version of
> the same age as GDAL1.7RC1)
>
> mexPrintf("---- %s\n%s\n", pszSrcWKT,pszDstWKT);
>
> That prints
>
> ---- GEOGCS["WGS 84",DATUM["WGS_1984",SPHEROID["WGS
> 84",6378137,298.257223563,AUTHORITY["EPSG","7030"]],TOWGS84[0,0,0,0,0,0,0],
>AUTHORITY["EPSG","6326"]],PRIMEM["Greenwich",0,AUTHORITY["EPSG","8901"]],UNI
>T["degree",0.0174532925199433,AUTHORITY["EPSG","9108"]],AUTHORITY["EPSG","43
>26"]] PROJCS["UTM Zone 29, Northern Hemisphere",GEOGCS["WGS
> 84",DATUM["WGS_1984",SPHEROID["WGS
> 84",6378137,298.257223563,AUTHORITY["EPSG","7030"]],TOWGS84[0,0,0,0,0,0,0],
>AUTHORITY["EPSG","6326"]],PRIMEM["Greenwich",0,AUTHORITY["EPSG","8901"]],UNI
>T["degree",0.0174532925199433,AUTHORITY["EPSG","9108"]],AUTHORITY["EPSG","43
>26"]],PROJECTION["Transverse_Mercator"],PARAMETER["latitude_of_origin",0],PA
>RAMETER["central_meridian",-9],PARAMETER["scale_factor",0.9996],PARAMETER["f
>alse_easting",500000],PARAMETER["false_northing",0],UNIT["Meter",1]]
>
>
> Next the code does:
>
> 	GDALClose( hSrcDS );
> mexPrintf("---- %s\n%s\n", pszSrcWKT,pszDstWKT);
>
> and now pszSrcWKT is empty. See
>
> ---- 
> PROJCS["UTM Zone 29, Northern Hemisphere",GEOGCS["WGS
> 84",DATUM["WGS_1984",SPHEROID["WGS
> 84",6378137,298.257223563,AUTHORITY["EPSG","7030"]],TOWGS84[0,0,0,0,0,0,0],
>AUTHORITY["EPSG","6326"]],PRIMEM["Greenwich",0,AUTHORITY["EPSG","8901"]],UNI
>T["degree",0.0174532925199433,AUTHORITY["EPSG","9108"]],AUTHORITY["EPSG","43
>26"]],PROJECTION["Transverse_Mercator"],PARAMETER["latitude_of_origin",0],PA
>RAMETER["central_meridian",-9],PARAMETER["scale_factor",0.9996],PARAMETER["f
>alse_easting",500000],PARAMETER["false_northing",0],UNIT["Meter",1]]
>
> If I make it print the size of pszSrcWKT  with strlen(pszSrcWKT) the
> answer is 1 and finally the MEX (and the entire MATLAB) crash on the
> call
>
> OGRFree(pszSrcWKT);
>
>
> Joaquim Luis
>
> ----------------------------------------------------------------
> This message was sent using IMP, the Internet Messaging Program.
>
> _______________________________________________
> gdal-dev mailing list
> gdal-dev at lists.osgeo.org
> http://lists.osgeo.org/mailman/listinfo/gdal-dev


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.osgeo.org/pipermail/gdal-dev/attachments/20100123/d91f43a4/attachment.html