Question

The function which were written in vc6.

bool CProductionTestDlg::GetVariables(CString strFilename, CMapStringToOb *cVariableMap)
{
    int     iMaxEntryLen   = 1000;
    //char    rgbEntryNames[1000];                //previous
    char  *rgbEntryNames = (char*)malloc(iMaxEntryLen * sizeof(int)); //Now
    CString strEntryName   = "";
    CString strEntryValue  = "";
    UINT    uiSeperator    = 0;
    ULONG   dwRetCode, dwSizeOfReturn;

    dwSizeOfReturn = GetPrivateProfileString(cszVariables,
                                            NULL,
                                            "",
                                            rgbEntryNames,
                                            iMaxEntryLen,
                                            strFilename);

    while ( uiSeperator < dwSizeOfReturn )
    {
        strEntryName.Format("%s", &rgbEntryNames[uiSeperator]);
        uiSeperator += strEntryName.GetLength() + 1;

        CString *strValue = new CString();
        dwRetCode = GetPrivateProfileString(cszVariables,
                                            strEntryName,
                                            "",
                                            strEntryValue.GetBufferSetLength(strEntryValue.GetLength()),
                                            iMaxEntryLen,
                                            strFilename);
        strValue->Format("%s", strEntryValue);        
        cVariableMap->SetAt(strEntryName, (CObject*)strValue);

    }

    return true;
}

Now I upgrade it on vs08.The project build correctly but when I open exe it throw an exception

*HEAP CORRUPTION DETECTED * CRT Detected that the application wrote to memory after end of heap buffer.

When I debug the my application the the control goes to dbgheap.c at line no 2103 after return true.

Answer 1

The problem is here:

dwRetCode = GetPrivateProfileString(cszVariables, 
    strEntryName, 
    "", 
    strEntryValue.GetBufferSetLength(strEntryValue.GetLength()), 
    iMaxEntryLen, 
    strFilename);

You pass a buffer of size 0 (strEntryValue is initialized to ""), but say its size is iMaxEntryLen. So GetPrivateProfileString thinks it has a much larger buffer than it actually got, and write beyond its bounds.

The reason you get this error after upgrading is, is guess, the improvement of the bounds validation. The bug was there in VC6 as well, it just wasn’t detected.