axis-java-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From bugzi...@apache.org
Subject DO NOT REPLY [Bug 26170] New: - Apache Module: mod_axis2 causes crash
Date Thu, 15 Jan 2004 16:08:35 GMT
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG 
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://nagoya.apache.org/bugzilla/show_bug.cgi?id=26170>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND 
INSERTED IN THE BUG DATABASE.

http://nagoya.apache.org/bugzilla/show_bug.cgi?id=26170

Apache Module: mod_axis2 causes crash

           Summary: Apache Module: mod_axis2 causes crash
           Product: Axis-C++
           Version: 1.0 Final
          Platform: Other
        OS/Version: Other
            Status: NEW
          Severity: Normal
          Priority: Other
         Component: Transport (Server)
        AssignedTo: axis-dev@ws.apache.org
        ReportedBy: roland.kosovsky@abacus.ch


"sstr->so.http.op_headercount" is not set to 0 in file "mod_axis2.c". During my
tests this caused a crash (in "mod_axis.c" it is zeroed).

mod_axis2.c, Ln 138:
static int mod_axis_method_handler (request_rec *req_rec)
...
    sstr = malloc(sizeof(Ax_soapstream));
    memset(sstr, 0, sizeof(Ax_soapstream)); // <<<<< insert this line


However a found an other bug:
 ...
 if(0 != process_request(sstr))
     {
         /*ap_rputs("SOAP Engine failed to response",req_rec);*/
         return OK;  // ###### sstr will never be freed!!!!!
     }
     if (sstr->so.http.op_headers)
         free(sstr->so.http.op_headers);
     free(sstr);
...


My suggestion is to create to object on stack so it will be deleted for free:
  Ax_soapstream obj;
  memset(&obj, 0, sizeof(obj));
  Ax_soapstream* sstr = &obj;  
  ...

Mime
View raw message