[gdal-dev] OGRFree(pszSrcWKT) can crash Matlab

[Chaitanya kumar CH]

Joaquim,

You did change pszSrcWkt (
http://code.google.com/p/mirone/source/browse/trunk/mex/gdalwarp_mex.cpp#385
).

You should remove line 385 and move the line 386 to 330.

On Sat, Jan 23, 2010 at 11:17 PM, <jluis at ualg.pt> wrote:

> Quoting Even Rouault <even.rouault at mines-paris.org>:
>
>  Joaquim,
>>
>> you don't provide enough code to really see what's wrong, but my guess is
>> that you misuse GDAL API.
>>
>
> Even
>
> Quite possible the first and I was trying to summarize what happens
>
>
>
>> If you get pszSrcWKT, with
>>
>> pszSrcWKT = GDALGetProjectionRef(hDS);
>>
>
>
> No, I got it from oSrcSRS.exportToWkt( &pszSrcWKT );
>
> See lines 325 & 329 of
>
> code.google.com/p/mirone/source/browse/trunk/mex/gdalwarp_mex.cpp
>
> Joaquim
>
>
>
>> The pszSrcWKT string is owned by the hDS object, so as soon as you destroy
>> the hDS object with GDALClose(), the pointer becomes invalid and points to
>> arbitrary data.
>>
>> For the same reason, you should never free the string returned by
>> GDALGetProjectionRef() with OGRFree() or any other free() call.
>>
>> See http://gdal.org/classGDALDataset.html :
>>
>> GDALDataset::GetProjectionRef() :
>>
>> returns:
>> a pointer to an internal reference string. It should not be altered, freed
>> or expected to last for long.
>>
>> Best regards,
>>
>> Even
>>
>> Le Saturday 23 January 2010 16:04:58 jluis at ualg.pt, vous avez écrit :
>>
>>> Hi,
>>>
>>> I have a serious crash in one of my Matlab MEXs caused by a call to
>>> OGRFree() with an argument of size one (possibly the  null terminator).
>>> This happens on OSX SL (64 bits) but not on Windows (where I still
>>> build at 32 bits)
>>>
>>> Here is, as far as I could trace it, what is happening (SVN version of
>>> the same age as GDAL1.7RC1)
>>>
>>> mexPrintf("---- %s\n%s\n", pszSrcWKT,pszDstWKT);
>>>
>>> That prints
>>>
>>> ---- GEOGCS["WGS 84",DATUM["WGS_1984",SPHEROID["WGS
>>>
>>> 84",6378137,298.257223563,AUTHORITY["EPSG","7030"]],TOWGS84[0,0,0,0,0,0,0],
>>>
>>> AUTHORITY["EPSG","6326"]],PRIMEM["Greenwich",0,AUTHORITY["EPSG","8901"]],UNI
>>>
>>> T["degree",0.0174532925199433,AUTHORITY["EPSG","9108"]],AUTHORITY["EPSG","43
>>> 26"]] PROJCS["UTM Zone 29, Northern Hemisphere",GEOGCS["WGS
>>> 84",DATUM["WGS_1984",SPHEROID["WGS
>>>
>>> 84",6378137,298.257223563,AUTHORITY["EPSG","7030"]],TOWGS84[0,0,0,0,0,0,0],
>>>
>>> AUTHORITY["EPSG","6326"]],PRIMEM["Greenwich",0,AUTHORITY["EPSG","8901"]],UNI
>>>
>>> T["degree",0.0174532925199433,AUTHORITY["EPSG","9108"]],AUTHORITY["EPSG","43
>>>
>>> 26"]],PROJECTION["Transverse_Mercator"],PARAMETER["latitude_of_origin",0],PA
>>>
>>> RAMETER["central_meridian",-9],PARAMETER["scale_factor",0.9996],PARAMETER["f
>>> alse_easting",500000],PARAMETER["false_northing",0],UNIT["Meter",1]]
>>>
>>>
>>> Next the code does:
>>>
>>>        GDALClose( hSrcDS );
>>> mexPrintf("---- %s\n%s\n", pszSrcWKT,pszDstWKT);
>>>
>>> and now pszSrcWKT is empty. See
>>>
>>> ---- PROJCS["UTM Zone 29, Northern Hemisphere",GEOGCS["WGS
>>> 84",DATUM["WGS_1984",SPHEROID["WGS
>>>
>>> 84",6378137,298.257223563,AUTHORITY["EPSG","7030"]],TOWGS84[0,0,0,0,0,0,0],
>>>
>>> AUTHORITY["EPSG","6326"]],PRIMEM["Greenwich",0,AUTHORITY["EPSG","8901"]],UNI
>>>
>>> T["degree",0.0174532925199433,AUTHORITY["EPSG","9108"]],AUTHORITY["EPSG","43
>>>
>>> 26"]],PROJECTION["Transverse_Mercator"],PARAMETER["latitude_of_origin",0],PA
>>>
>>> RAMETER["central_meridian",-9],PARAMETER["scale_factor",0.9996],PARAMETER["f
>>> alse_easting",500000],PARAMETER["false_northing",0],UNIT["Meter",1]]
>>>
>>> If I make it print the size of pszSrcWKT  with strlen(pszSrcWKT) the
>>> answer is 1 and finally the MEX (and the entire MATLAB) crash on the
>>> call
>>>
>>> OGRFree(pszSrcWKT);
>>>
>>>
>>> Joaquim Luis
>>>
>>> ----------------------------------------------------------------
>>> This message was sent using IMP, the Internet Messaging Program.
>>>
>>> _______________________________________________
>>> gdal-dev mailing list
>>> gdal-dev at lists.osgeo.org
>>> http://lists.osgeo.org/mailman/listinfo/gdal-dev
>>>
>>
>>
>>
>>
>
>
> ----------------------------------------------------------------
> This message was sent using IMP, the Internet Messaging Program.
>
>


-- 
Best regards,
Chaitanya kumar CH.
/tʃaɪθənjə/ /kʊmɑr/
+91-9848167848
17.241582N 80.142635E
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.osgeo.org/pipermail/gdal-dev/attachments/20100123/aeee37bd/attachment.html