Memory access error due to 'memcmp'

[GoogleCodeExporter]

I tried to use rapidjson on the large json, and valgrind/memcheck finds errors, 
see below. The offending line is this:

if (name[member->name.data_.s.length] == '\0' && 
memcmp(member->name.data_.s.str, name, member->name.data_.s.length * 
sizeof(Ch)) == 0)

This happens during map value lookup. 'memcmp' can't be used in this place, 
because some keys can be longer than the supplied value, and it is illegal to 
read a string past its terminating zero character.

In fact, this bug can cause segmentation fault if the end of the string 
supplied by the caller would happen to align with the end of the memory segment.

---error log---
==81117== Invalid read of size 1
==81117==    at 0x110A543: memcmp (mc_replace_strmem.c:1001)
==81117==    by 0x49F01C: rapidjson::GenericValue<rapidjson::UTF8<char>, 
rapidjson::MemoryPoolAllocator<rapidjson::CrtAllocator> >::FindMember(char 
const*) (document.h:271) 
==81117==    by 0x49EECC: rapidjson::GenericValue<rapidjson::UTF8<char>, 
rapidjson::MemoryPoolAllocator<rapidjson::CrtAllocator> >::operator[](char 
const*) (document.h:239)
==81117==    by 0x49EE9C: rapidjson::GenericValue<rapidjson::UTF8<char>, 
rapidjson::MemoryPoolAllocator<rapidjson::CrtAllocator> >::operator[](char 
const*) const (document.h:247)

Original issue reported on code.google.com by yuriv...@gmail.com on 28 Apr 2014 at 11:42

• Merged into: #108

[GoogleCodeExporter]

[deleted comment]

[GoogleCodeExporter]

[deleted comment]

[GoogleCodeExporter]

You may have seen #108 [1], which is about the same issue and has a link to a 
patch in the comments.

hth,
Philipp

[1] http://code.google.com/p/rapidjson/issues/detail?id=108

Original comment by philipp....@gmail.com on 29 Apr 2014 at 4:00

[GoogleCodeExporter]

Original comment by milo...@gmail.com on 20 Jun 2014 at 11:17

• Changed state: Duplicate