MantisBT
Mantis Bug Tracker Workflow

View Issue Details Jump to Notes ] Related Changesets ] Issue History ] Print ]
IDProjectCategoryView StatusDate SubmittedLast Update
0026428Community[OCCT] OCCT:Application Frameworkpublic2015-07-14 13:032016-04-20 15:48
ReporterVico Liang 
Assigned Tokgv 
PrioritynormalSeveritycrash 
StatusclosedResolutionfixed 
PlatformWindowsOSVC++ 2013OS Version64 bit
Product Version[OCCT] 6.9.0 
Target Version[OCCT] 7.0.0Fixed in Version[OCCT] 7.0.0 
Summary0026428: TNaming_Selector::Solve crash for empty named shape.
DescriptionThe problem is that the referenced named shape has a null naming node which results in a null pointer access "myNode->myNew" in TNaming_NewShapeIterator constructor.

The stack frame as below:

     TKCAF.dll!TNaming_NewShapeIterator::TNaming_NewShapeIterator(const TNaming_Iterator & anIterator) Line 1052 C++
> TKCAF.dll!TNaming_NamingTool::BuildDescendants(const Handle_TNaming_NamedShape & NS, TDF_LabelMap & Descendants) Line 284 C++
     TKCAF.dll!ModifUntil(const TDF_Label & L, const TDF_LabelMap & Valid, const TNaming_ListOfNamedShape & Args, const Handle_TNaming_NamedShape & Stop) Line 615 C++
     TKCAF.dll!TNaming_Name::Solve(const TDF_Label & aLab, const TDF_LabelMap & Valid) Line 2045 C++
     TKCAF.dll!TNaming_Naming::Regenerate(TDF_LabelMap & MDF) Line 1917 C++
     TKCAF.dll!TNaming_Naming::Solve(TDF_LabelMap & Valid) Line 174 C++
     TKCAF.dll!TNaming_Naming::Solve(TDF_LabelMap & Valid) Line 159 C++
     TKCAF.dll!TNaming_Naming::Solve(TDF_LabelMap & Valid) Line 159 C++
     TKCAF.dll!TNaming_Selector::Solve(TDF_LabelMap & Valid) Line 423 C++
Steps To ReproduceUse attached script t1.tcl
TagsNo tags attached.
Test case numberbugs caf bug26428
Attached Files? file icon t1.tcl (292 bytes) 2015-09-21 17:22

- Relationships

-  Notes
(0043982)
szy (administrator)
2015-08-11 17:19

Insufficient description.
I suggest you to make the registered issue reproducible.
Provide, please:
1) data - document in any supported by OCCT format (to be used to reproduce the case) or procedure (tcl script) building it
2)standalone C++ sample presenting the issue (or set of Draw commands)
Without this additional information the issue can't be processed.
(0044002)
Vico Liang (developer)
2015-08-12 05:43

Dear szy,

There is no OCCT document saved for this case, it's reproduced in the middle of running program.

Also i'm not know how to write the tcl script to reproduce this.

From the description, it is not hard to find the problem by static code analysis. It's obvious that there is null ponter access in TNaming_NewShapeIterator constructor.

To fix the issus, it just needs null pointer protection.
(0044003)
Vico Liang (developer)
2015-08-12 05:56

Code Snippet of below can reproduce the issue:

TDF_Label aLabel = // any label
TNaming_Builder aNB(aLabel);
TNaming_Iterator aNameIter(aLabel);
TNaming_NewShapeIterator aNewShapeIter(aNameIter);
(0044004)
Vico Liang (developer)
2015-08-12 05:59

TNaming_OldShapeIterator has the same issue:

TDF_Label aLabel = // any label
TNaming_Builder aNB(aLabel);
TNaming_Iterator aNameIter(aLabel);
TNaming_OldShapeIterator aOldShapeIter(aNameIter);
(0044005)
Vico Liang (developer)
2015-08-12 06:54

TNaming_OldShapeIterator and TNaming_NewShapeIterator all constructors have to protect null node access.
(0045831)
git (administrator)
2015-09-17 18:34

Branch CR26428 has been created by szy.

SHA-1: 7f7ba10f01dd6f78996f8b8993709e679ea7cddc


Detailed log of new commits:

Author: szy
Date: Thu Sep 17 18:22:15 2015 +0300

    26428: TNaming_Selector::Solve crash for empty named shape.
(0045833)
szy (administrator)
2015-09-17 18:39

Review, please branch CR26428.
In fact exception is raised because the provided structure is not correct.
Now constructor raises exception like "NoSuchObject" (as the expected node is not created).
(0045847)
vro (developer)
2015-09-18 07:03

Everything is Ok.
(0045910)
git (administrator)
2015-09-18 16:58

Branch CR26428 has been updated forcibly by mkv.

SHA-1: 385b492ab16b9f12df53fb7328813596f4707588
(0045916)
mkv (tester)
2015-09-18 17:29

Dear BugMaster,
Branch CR26428 was rebased on current master of occt git-repository.
SHA-1: 385b492ab16b9f12df53fb7328813596f4707588
(0045938)
szy (administrator)
2015-09-21 11:44

Some additional comments.
The provided reproducer (independently of usage of New or Old shapes Iterator) is a good example of incorrect approach of TNaming_Builder usage:
"TDF_Label aLabel = // any label
TNaming_Builder aNB(aLabel);
TNaming_Iterator aNameIter(aLabel);
TNaming_NewShapeIterator aNewShapeIter(aNameIter);"

TNaming_Builder aNB(aLabel) - just creates a new empty NamedShape attribute (or cleans existing one). Empty (not initialized) NamedShape has null Node (myNode = 0L;). This feature is used to identify empty NamedShape. Logically an attempt to iterate empty shape is not a good idea.
In other words after creation empty NamedShape attribute (see chapter "5.OCAF Shape Attributes" of OCAF User's Guide) it should be filled using one of available methods: Generated(), Modify()..., for example:
TopoDS_Shape aShape;
TNaming_Builder aNB(aLabel);
aNB.Generated(aShape); // <<== Initialization of the attribute by the 'aShape'
                       //with PRIMITIVE evolution
TNaming_Iterator aNameIter(aLabel);
TNaming_NewShapeIterator aNewShapeIter(aNameIter);
(0045961)
mkv (tester)
2015-09-21 20:03

Dear BugMaster,
Branch CR26428 from occt git-repository (and master from products git-repository) was compiled on Linux, MacOS and Windows platforms and tested on Release mode.
SHA-1: 385b492ab16b9f12df53fb7328813596f4707588

Number of compiler warnings:

occt component :
Linux: 15 (15 on master)
Windows: 0 (0 on master)

products component :
Linux: 39 (39 on master)
Windows: 0 (0 on master)

Regressions/Differences/Improvements:
No regressions/differences

Testing cases:
http://occt-tests/CR26428-master-occt-64/Debian70-64/bugs/caf/bug26428.html [^]
http://occt-tests/CR26428-master-occt-64/Windows-64-VC10/bugs/caf/bug26428.html [^]
bugs caf bug26428: OK

Testing on Linux:
occt component :
Total MEMORY difference: 92342608 / 92149486 [+0.21%]
Total CPU difference: 18506.01999999955 / 18841.999999998985 [-1.78%]
products component :
Total MEMORY difference: 25923664 / 25980951 [-0.22%]
Total CPU difference: 7299.409999999985 / 7208.589999999996 [+1.26%]

Testing on Windows:
occt component :
Total MEMORY difference: 56831633 / 56826033 [+0.01%]
Total CPU difference: 18043.24726109894 / 16810.65215989913 [+7.33%]
products component :
Total MEMORY difference: 16784084 / 16784150 [-0.00%]
Total CPU difference: 5933.888037500007 / 5525.21221779996 [+7.40%]

There are no differences in images found by testdiff.
(0045962)
git (administrator)
2015-09-21 20:04

Branch CR26428 has been updated by mkv.

SHA-1: 27ef0a623843a97604d58106b413f723dbfb48da


Detailed log of new commits:

Author: mkv
Date: Mon Sep 21 19:55:09 2015 +0300

    Test case for issue CR26428

(0047070)
git (administrator)
2015-10-16 16:57

Branch CR26428 has been deleted by kgv.

SHA-1: 27ef0a623843a97604d58106b413f723dbfb48da

- Related Changesets
occt: master ddd926fe
Timestamp: 2015-09-24 09:36:11
Author: szy
Committer: kgv
Details ] Diff ]
26428: TNaming_Selector::Solve crash for empty named shape.

Test case for issue CR26428
mod - src/DNaming/DNaming_BasicCommands.cxx Diff ] File ]
mod - src/TNaming/TNaming_NamedShape.cxx Diff ] File ]
add - tests/bugs/caf/bug26428 Diff ] File ]

- Issue History
Date Modified Username Field Change
2015-07-14 13:03 Vico Liang New Issue
2015-07-14 13:03 Vico Liang Assigned To => szy
2015-08-11 17:19 szy Note Added: 0043982
2015-08-11 17:19 szy Assigned To szy => Vico Liang
2015-08-11 17:19 szy Status new => feedback
2015-08-12 05:43 Vico Liang Note Added: 0044002
2015-08-12 05:44 Vico Liang Assigned To Vico Liang => szv
2015-08-12 05:56 Vico Liang Note Added: 0044003
2015-08-12 05:57 Vico Liang Status feedback => assigned
2015-08-12 05:59 Vico Liang Note Added: 0044004
2015-08-12 06:54 Vico Liang Note Added: 0044005
2015-08-12 07:55 Vico Liang Assigned To szv => szy
2015-09-17 18:34 git Note Added: 0045831
2015-09-17 18:39 szy Note Added: 0045833
2015-09-17 18:39 szy Assigned To szy => vro
2015-09-17 18:39 szy Status assigned => resolved
2015-09-17 18:39 szy Steps to Reproduce Updated View Revisions
2015-09-18 07:03 vro Note Added: 0045847
2015-09-18 07:03 vro Assigned To vro => bugmaster
2015-09-18 07:03 vro Status resolved => reviewed
2015-09-18 16:07 mkv Assigned To bugmaster => mkv
2015-09-18 16:58 git Note Added: 0045910
2015-09-18 17:29 mkv Note Added: 0045916
2015-09-21 11:44 szy Note Added: 0045938
2015-09-21 17:22 szy File Added: t1.tcl
2015-09-21 20:03 mkv Note Added: 0045961
2015-09-21 20:03 mkv Assigned To mkv => bugmaster
2015-09-21 20:03 mkv Status reviewed => tested
2015-09-21 20:03 mkv Test case number => bugs caf bug26428
2015-09-21 20:04 git Note Added: 0045962
2015-09-28 12:58 kgv Changeset attached => occt master ddd926fe
2015-09-28 12:58 kgv Assigned To bugmaster => kgv
2015-09-28 12:58 kgv Status tested => verified
2015-09-28 12:58 kgv Resolution open => fixed
2015-10-16 16:57 git Note Added: 0047070
2016-04-20 15:44 user533 Fixed in Version => 7.0.0
2016-04-20 15:48 user533 Status verified => closed


Copyright © 2000 - 2018 MantisBT Team
Powered by Mantis Bugtracker