<style>
/* Changing the layout to use less space for mobiles */
@media screen and (max-device-width: 480px), screen and (-webkit-min-device-pixel-ratio: 2) {
#email-body { min-width: 30em !important; }
#email-page { padding: 8px !important; }
#email-banner { padding: 8px 8px 0 8px !important; }
#email-avatar { margin: 1px 8px 8px 0 !important; padding: 0 !important; }
#email-fields { padding: 0 8px 8px 8px !important; }
#email-gutter { width: 0 !important; }
}
</style>
<div id="email-body">
<table id="email-wrap" align="center" border="0" cellpadding="0" cellspacing="0" style="background-color:#f0f0f0;color:#000000;width:100%;">
<tr valign="top">
<td id="email-page" style="padding:16px !important;">
<table align="center" border="0" cellpadding="0" cellspacing="0" style="background-color:#ffffff;border:1px solid #bbbbbb;color:#000000;width:100%;">
<tr valign="top">
<td bgcolor="#ffffff" style="background-color:#ffffff;color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;line-height:1;"><img src="https://shibboleth.net/images/shib_240x83.png" alt="" style="vertical-align:top;" /></td>
</tr><tr valign="top">
<td id="email-banner" style="padding:32px 32px 0 32px;">
<table align="left" border="0" cellpadding="0" cellspacing="0" width="100%" style="width:100%;">
<tr valign="top">
<td style="color:#505050;font-family:Arial,FreeSans,Helvetica,sans-serif;padding:0;">
<img id="email-avatar" src="https://issues.shibboleth.net/jira/secure/useravatar?avatarId=10202" alt="" height="48" width="48" border="0" align="left" style="padding:0;margin: 0 16px 16px 0;" />
<div id="email-action" style="padding: 0 0 8px 0;font-size:12px;line-height:18px;">
<a class="user-hover" rel="wferi@idp.protectnetwork.org" id="email_wferi@idp.protectnetwork.org" href="https://issues.shibboleth.net/jira/secure/ViewProfile.jspa?name=wferi%40idp.protectnetwork.org" style="color:#326ca6;">wferi@idp.protectnetwork.org</a>
created <img src="https://issues.shibboleth.net/jira/images/icons/bug.gif" height="16" width="16" border="0" align="absmiddle" alt="Bug"> <a style='color:#326ca6;text-decoration:none;' href='https://issues.shibboleth.net/jira/browse/CPPXT-93'>CPPXT-93</a>
</div>
<div id="email-summary" style="font-size:16px;line-height:20px;padding:2px 0 16px 0;">
<a style='color:#326ca6;text-decoration:none;' href='https://issues.shibboleth.net/jira/browse/CPPXT-93'><strong>Improper Xerces ArrayJanitor usage in util/DateTime.cpp</strong></a>
</div>
</td>
</tr>
</table>
</td>
</tr>
<tr valign="top">
<td id="email-fields" style="padding:0 32px 32px 32px;">
<table border="0" cellpadding="0" cellspacing="0" style="padding:0;text-align:left;width:100%;" width="100%">
<tr valign="top">
<td id="email-gutter" style="width:64px;white-space:nowrap;"></td>
<td>
<table border="0" cellpadding="0" cellspacing="0" width="100%">
<tr valign="top">
<td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 10px 10px 0;white-space:nowrap;">
<strong style="font-weight:normal;color:#505050;">Issue Type:</strong>
</td>
<td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 0 10px 0;width:100%;">
<img src="https://issues.shibboleth.net/jira/images/icons/bug.gif" height="16" width="16" border="0" align="absmiddle" alt="Bug"> Bug
</td>
</tr> <tr valign="top">
<td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 10px 10px 0;white-space:nowrap;">
<strong style="font-weight:normal;color:#505050;">Affects Versions:</strong>
</td>
<td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 0 10px 0;width:100%;">
1.4.2 </td>
</tr>
<tr valign="top">
<td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 10px 10px 0;white-space:nowrap;">
<strong style="font-weight:normal;color:#505050;">Assignee:</strong>
</td>
<td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 0 10px 0;width:100%;">
<a class="user-hover" rel="cantor.2@osu.edu" id="email_cantor.2@osu.edu" href="https://issues.shibboleth.net/jira/secure/ViewProfile.jspa?name=cantor.2%40osu.edu" style="color:#326ca6;">Scott Cantor</a>
</td>
</tr> <tr valign="top">
<td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 10px 10px 0;white-space:nowrap;">
<strong style="font-weight:normal;color:#505050;">Created:</strong>
</td>
<td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 0 10px 0;width:100%;">
05/Apr/13 5:43 AM
</td>
</tr> <tr valign="top">
<td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 10px 10px 0;white-space:nowrap;">
<strong style="font-weight:normal;color:#505050;">Description:</strong>
</td>
<td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 0 10px 0;width:100%;">
<p style='margin-top:0;margin-bottom:10px;'>Found this while chasing a shibd crash by running under GDB with the <tt>duma</tt> memory debugger:</p>
<div class="preformatted panel" style="border-width: 1px;"><div class="preformattedContent panelContent">
<pre>(gdb) set exec-wrapper env LD_PRELOAD=libduma.so
(gdb) file /usr/sbin/shibd
Reading symbols from /usr/sbin/shibd...Reading symbols from /usr/lib/debug/usr/sbin/shibd...done.
(no debugging symbols found)...done.
(gdb) set args -F
(gdb) run
Starting program: /usr/sbin/shibd -F
[Thread debugging using libthread_db enabled]
DUMA 2.5.15 (shared library, NO_LEAKDETECTION)
Copyright (C) 2006 Michael Eddington <meddington@gmail.com>
Copyright (C) 2002-2008 Hayati Ayguen <h_ayguen@web.de>, Procitec GmbH
Copyright (C) 1987-1999 Bruce Perens <bruce@perens.com>
[New Thread 0xafbb7b70 (LWP 16391)]
[New Thread 0x921ccb70 (LWP 16808)]
DUMA Aborting: Free mismatch: allocator 'scalar new' used but deallocator 'vector delete[]' called!
Program received signal SIGILL, Illegal instruction.
0xb7fe2416 in __kernel_vsyscall ()
(gdb) bt
#0 0xb7fe2416 in __kernel_vsyscall ()
#1 0xb6e5dc76 in kill () from /lib/i686/nosegneg/libc.so.6
#2 0xb7fcbeea in DUMA_Abort () from /usr/lib/libduma.so
#3 0xb7fca2e6 in _duma_deallocate () from /usr/lib/libduma.so
#4 0xb7fc8dd1 in operator delete[](void*) () from /usr/lib/libduma.so
#5 0xb78b1198 in xercesc_3_1::ArrayJanitor<char>::reset (this=0xbfffeb1c,
__in_chrg=<value optimized out>) at /usr/include/xercesc/util/Janitor.c:168
#6 ~ArrayJanitor (this=0xbfffeb1c, __in_chrg=<value optimized out>)
at /usr/include/xercesc/util/Janitor.c:121
#7 0xb78ae493 in xmltooling::DateTime::parseMiliSecond (this=0x8c8abfbc, start=20, end=23)
at util/DateTime.cpp:1334
#8 0xb78af48b in xmltooling::DateTime::getTime (this=0x8c8abfbc) at util/DateTime.cpp:1023
#9 0xb78af660 in xmltooling::DateTime::parseDateTime (this=0x8c8abfbc) at util/DateTime.cpp:571
#10 0xb7888ad2 in xmltooling::AbstractXMLObject::prepareForAssignment (this=0x8c895fc0, oldValue=0x0,
newValue=0x8d0d64e8, duration=false) at AbstractXMLObject.cpp:276
#11 0xb7d41f10 in opensaml::saml2md::EntitiesDescriptorImpl::setValidUntil(unsigned short const*) ()
from /usr/lib/libsaml.so.7
#12 0xb7d3ee90 in opensaml::saml2md::EntitiesDescriptorImpl::processAttribute(xercesc_3_1::DOMAttr const*) () from /usr/lib/libsaml.so.7
#13 0xb789e642 in xmltooling::AbstractXMLObjectUnmarshaller::unmarshallAttributes (this=0x8c895f70,
domElement=0x8d0d6088) at io/AbstractXMLObjectUnmarshaller.cpp:162
#14 0xb789f855 in xmltooling::AbstractXMLObjectUnmarshaller::unmarshall (this=0x8c895f70,
element=0x8d0d6088, bindDocument=true) at io/AbstractXMLObjectUnmarshaller.cpp:70
#15 0xb78900e1 in xmltooling::XMLObjectBuilder::buildFromElement (this=0xb0368ffc,
element=0x8d0d6088, bindDocument=168) at XMLObjectBuilder.cpp:61
#16 0xb7890647 in xmltooling::XMLObjectBuilder::buildOneFromElement (element=0x8d0d6088,
bindDocument=true) at XMLObjectBuilder.cpp:73
#17 0xb7db21bd in opensaml::saml2md::XMLMetadataProvider::load(bool) () from /usr/lib/libsaml.so.7
---Type <return> to continue, or q <return> to quit---
#18 0xb7db185d in opensaml::saml2md::XMLMetadataProvider::background_load() ()
from /usr/lib/libsaml.so.7
#19 0xb7db328b in opensaml::saml2md::XMLMetadataProvider::init() () from /usr/lib/libsaml.so.7
#20 0xb7d1bb52 in opensaml::saml2md::ChainingMetadataProvider::init() () from /usr/lib/libsaml.so.7
#21 0xb75de680 in XMLApplication (this=<value optimized out>, sp=<value optimized out>, pp=0x0,
e=0x93a63cb0, base=0x0, __in_chrg=<value optimized out>, __vtt_parm=<value optimized out>)
at impl/XMLServiceProvider.cpp:595
#22 0xb75e2870 in XMLConfigImpl (this=<value optimized out>, e=<value optimized out>, first=true,
outer=0xafc83f54, log=..., __in_chrg=<value optimized out>, __vtt_parm=<value optimized out>)
at impl/XMLServiceProvider.cpp:2072
#23 0xb75e5155 in background_load (this=0xafc83f54) at impl/XMLServiceProvider.cpp:2251
#24 0xb75ce20b in init (this=0xafc83f54) at impl/XMLServiceProvider.cpp:324
#25 0xb753d877 in shibsp::SPConfig::instantiate (this=0xb76a1300, config=0x0, rethrow=false)
at SPConfig.cpp:428
#26 0x08049873 in main (argc=2, argv=0xbffff844) at shibd.cpp:339
</pre>
</div></div>
<p style='margin-top:0;margin-bottom:10px;'>I'm no expert on Xerces, but some research indicates incorrect <tt>ArrayJanitor</tt> usage in the <tt>DateTime::parseMiliSecond()</tt> function:</p>
<div class="code panel" style="border-width: 1px;"><div class="codeContent panelContent">
<pre class="code-java">
<span class="code-object">double</span> DateTime::parseMiliSecond(<span class="code-keyword">const</span> <span class="code-object">int</span> start, <span class="code-keyword">const</span> <span class="code-object">int</span> end) <span class="code-keyword">const</span>
{
unsigned <span class="code-object">int</span> miliSecLen = (end-1) - (start-1) + 1; <span class="code-comment">//to include the '.'
</span> XMLCh* miliSecData = <span class="code-keyword">new</span> XMLCh[miliSecLen + 1];
ArrayJanitor<XMLCh> janMili(miliSecData);
XMLString::copyNString(miliSecData, &(fBuffer[start-1]), miliSecLen);
*(miliSecData + miliSecLen) = chNull;
<span class="code-object">char</span> *nptr = XMLString::transcode(miliSecData);
ArrayJanitor<<span class="code-object">char</span>> jan(nptr);
size_t strLen = strlen(nptr);
<span class="code-object">char</span> *endptr = 0;
errno = 0;
<span class="code-comment">//printf(<span class="code-quote">"milisec=<%s>\n"</span>, nptr);
</span>
<span class="code-object">double</span> retVal = strtod(nptr, &endptr);
<span class="code-comment">// check <span class="code-keyword">if</span> all chars are valid <span class="code-object">char</span>
</span> <span class="code-keyword">if</span> ( (endptr - nptr) != strLen)
<span class="code-keyword">throw</span> XMLParserException(<span class="code-quote">"Invalid non-numeric characters."</span>);
<span class="code-comment">// we don't check underflow occurs since
</span> <span class="code-comment">// nothing we can <span class="code-keyword">do</span> about it.
</span> <span class="code-keyword">return</span> retVal;
}
</pre>
</div></div>
<p style='margin-top:0;margin-bottom:10px;'>This might be the same as the <a href="https://issues.apache.org/bugzilla/show_bug.cgi?id=49264" class="external-link">crash in DSIGKeyInfoX509::appendX509Certificate</a> issue in XML-Security.<br/>
I'm not yet sure this has anything to do with our original issue, but seems like a bug and stopped further investigation, so probably worth noting.<br/>
(I'm debugging SP version 2.4.3 with XMLTooling 1.4.2, but a quick glance over the SVN shows that this code didn't change in the trunk.)</p>
</td>
</tr>
<tr valign="top">
<td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 10px 10px 0;white-space:nowrap;">
<strong style="font-weight:normal;color:#505050;">Environment:</strong>
</td>
<td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 0 10px 0;width:100%;">
<p style='margin-top:0;margin-bottom:10px;'>Debian squeeze</p>
</td>
</tr>
<tr valign="top">
<td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 10px 10px 0;white-space:nowrap;">
<strong style="font-weight:normal;color:#505050;">Project:</strong>
</td>
<td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 0 10px 0;width:100%;">
<a style="color:#326ca6;" href="https://issues.shibboleth.net/jira/browse/CPPXT">XMLTooling - C++</a>
</td>
</tr> <tr valign="top">
<td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 10px 10px 0;white-space:nowrap;">
<strong style="font-weight:normal;color:#505050;">Priority:</strong>
</td>
<td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 0 10px 0;width:100%;">
<img src="https://issues.shibboleth.net/jira/images/icons/priority_major.gif" height="16" width="16" border="0" align="absmiddle" alt="Major"> Major
</td>
</tr> <tr valign="top">
<td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 10px 10px 0;white-space:nowrap;">
<strong style="font-weight:normal;color:#505050;">Reporter:</strong>
</td>
<td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 0 10px 0;width:100%;">
<a class="user-hover" rel="wferi@idp.protectnetwork.org" id="email_wferi@idp.protectnetwork.org" href="https://issues.shibboleth.net/jira/secure/ViewProfile.jspa?name=wferi%40idp.protectnetwork.org" style="color:#326ca6;">wferi@idp.protectnetwork.org</a>
</td>
</tr>
</table>
</td>
</tr>
</table>
</td>
</tr>
</table>
</td><!-- End #email-page -->
</tr>
<tr valign="top">
<td style="color:#505050;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:10px;line-height:14px;padding: 0 16px 16px 16px;text-align:center;">
This message is automatically generated by JIRA.<br />
If you think it was sent incorrectly, please contact your JIRA administrators<br />
For more information on JIRA, see: <a style='color:#326ca6;' href='http://www.atlassian.com/software/jira'>http://www.atlassian.com/software/jira</a>
</td>
</tr>
</table><!-- End #email-wrap -->
</div><!-- End #email-body -->