[Serialization] Segfaults on invalid input

Hi all, I've played a bit with boost::serialize and discoverd two problems (one segfault and one maybe related memeory exhaustion). Segfault: demo_xml from boost::serialize examples. I've changed the output format to text_archiv. If i increase the length of a string in the text_archiv by 2, it gives a segfault. All files could be found at: http://einsteinmg.dyndns.org/projects/boost_segf. - valgrind output (demo_xml.log) - gdb backtrace (demo_xml_gdb_backtrace) - normal input file (demo.txt) - input file which results in segfault (demoin.txt) I changed the length of the string "24th Street" from 11 to 13 same results for other strings. - demo_xml (compiled with -O2 -g3 for x86-32 gnu/linux, gcc 4.0.3-1) - the core file (core.gz) - and the sourcefiles demo_xml.{hpp,cpp} Memory exhaustion: Shows a similar problem, but with a very simple testobject (with just 2 std::string's). The output of this program should only 4 small lines but is 130MB (many printed \0). All files could be found at: http://einsteinmg.dyndns.org/projects/boost_memex - valgrind output (ser.log.gz, is 67MB unzipped) - program output with false input file (ser_false_output.gz, ~130MB unzipped) - normal output file (ser_out.txt) - evil input file (ser_in.txt) the length of the first string ("test1") is incremented by 2 - ser (compiled with -O2 -g3 for x86-32 gnu/linux, gcc 4.0.3-1) Boost version is 1.33.1. Hope that helps, solving this bug. Greetings, Michael Gebetsroither
participants (1)
-
Michael Gebetsroither