[gdal-dev] OGRFree(pszSrcWKT) can crash Matlab

[jluis at ualg.pt]

Quoting Even Rouault <even.rouault at mines-paris.org>:

> Joaquim,
>
> you don't provide enough code to really see what's wrong, but my  
> guess is that you misuse GDAL API.

Even

Quite possible the first and I was trying to summarize what happens


>
> If you get pszSrcWKT, with
>
> pszSrcWKT = GDALGetProjectionRef(hDS);


No, I got it from oSrcSRS.exportToWkt( &pszSrcWKT );

See lines 325 & 329 of

code.google.com/p/mirone/source/browse/trunk/mex/gdalwarp_mex.cpp

Joaquim


>
> The pszSrcWKT string is owned by the hDS object, so as soon as you  
> destroy the hDS object with GDALClose(), the pointer becomes invalid  
> and points to arbitrary data.
>
> For the same reason, you should never free the string returned by  
> GDALGetProjectionRef() with OGRFree() or any other free() call.
>
> See http://gdal.org/classGDALDataset.html :
>
> GDALDataset::GetProjectionRef() :
>
> returns:
> a pointer to an internal reference string. It should not be altered,  
> freed or expected to last for long.
>
> Best regards,
>
> Even
>
> Le Saturday 23 January 2010 16:04:58 jluis at ualg.pt, vous avez écrit :
>> Hi,
>>
>> I have a serious crash in one of my Matlab MEXs caused by a call to
>> OGRFree() with an argument of size one (possibly the  null terminator).
>> This happens on OSX SL (64 bits) but not on Windows (where I still
>> build at 32 bits)
>>
>> Here is, as far as I could trace it, what is happening (SVN version of
>> the same age as GDAL1.7RC1)
>>
>> mexPrintf("---- %s\n%s\n", pszSrcWKT,pszDstWKT);
>>
>> That prints
>>
>> ---- GEOGCS["WGS 84",DATUM["WGS_1984",SPHEROID["WGS
>> 84",6378137,298.257223563,AUTHORITY["EPSG","7030"]],TOWGS84[0,0,0,0,0,0,0],
>> AUTHORITY["EPSG","6326"]],PRIMEM["Greenwich",0,AUTHORITY["EPSG","8901"]],UNI
>> T["degree",0.0174532925199433,AUTHORITY["EPSG","9108"]],AUTHORITY["EPSG","43
>> 26"]] PROJCS["UTM Zone 29, Northern Hemisphere",GEOGCS["WGS
>> 84",DATUM["WGS_1984",SPHEROID["WGS
>> 84",6378137,298.257223563,AUTHORITY["EPSG","7030"]],TOWGS84[0,0,0,0,0,0,0],
>> AUTHORITY["EPSG","6326"]],PRIMEM["Greenwich",0,AUTHORITY["EPSG","8901"]],UNI
>> T["degree",0.0174532925199433,AUTHORITY["EPSG","9108"]],AUTHORITY["EPSG","43
>> 26"]],PROJECTION["Transverse_Mercator"],PARAMETER["latitude_of_origin",0],PA
>> RAMETER["central_meridian",-9],PARAMETER["scale_factor",0.9996],PARAMETER["f
>> alse_easting",500000],PARAMETER["false_northing",0],UNIT["Meter",1]]
>>
>>
>> Next the code does:
>>
>> 	GDALClose( hSrcDS );
>> mexPrintf("---- %s\n%s\n", pszSrcWKT,pszDstWKT);
>>
>> and now pszSrcWKT is empty. See
>>
>> ---- 
>> PROJCS["UTM Zone 29, Northern Hemisphere",GEOGCS["WGS
>> 84",DATUM["WGS_1984",SPHEROID["WGS
>> 84",6378137,298.257223563,AUTHORITY["EPSG","7030"]],TOWGS84[0,0,0,0,0,0,0],
>> AUTHORITY["EPSG","6326"]],PRIMEM["Greenwich",0,AUTHORITY["EPSG","8901"]],UNI
>> T["degree",0.0174532925199433,AUTHORITY["EPSG","9108"]],AUTHORITY["EPSG","43
>> 26"]],PROJECTION["Transverse_Mercator"],PARAMETER["latitude_of_origin",0],PA
>> RAMETER["central_meridian",-9],PARAMETER["scale_factor",0.9996],PARAMETER["f
>> alse_easting",500000],PARAMETER["false_northing",0],UNIT["Meter",1]]
>>
>> If I make it print the size of pszSrcWKT  with strlen(pszSrcWKT) the
>> answer is 1 and finally the MEX (and the entire MATLAB) crash on the
>> call
>>
>> OGRFree(pszSrcWKT);
>>
>>
>> Joaquim Luis
>>
>> ----------------------------------------------------------------
>> This message was sent using IMP, the Internet Messaging Program.
>>
>> _______________________________________________
>> gdal-dev mailing list
>> gdal-dev at lists.osgeo.org
>> http://lists.osgeo.org/mailman/listinfo/gdal-dev
>
>
>



----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.