Memory access violation by returned string value
Original Reporter info from Mantis: RCouture
-
Reporter name:
Original Reporter info from Mantis: RCouture
- Reporter name:
Description:
If a String parameter is declared with limited length (<255), it is possible for the value returned by a procedure to overrun the end.
Steps to reproduce:
-
Compile and run the attached program.
-
Procedure P returns a string value '12346789', which overruns the end of the string in the calling program. The value of S.i changes, which proves that there has been a memory access violation.
Additional information:
Borland Pascal limits the length of the returned string and returns the correct value of '1234'. Tested in Free Pascal dialect, but I believe it fails with other dialects as well.
If it is decided that the OpenString type is required in this situation, then the String type should be forbidden by type incompatibility. The other way to handle it would be by some internal mechanism, as BP does.
Mantis conversion info:
- Mantis ID: 14929
- OS: Win
- OS Build: XP
- Platform: Intel
- Version: 2.2.4
- Fixed in version: 2.6.0
- Fixed in revision: 13966 (#d61eb352)