[omniORB] omniORB 4.1.0 crashes in typecode

[Teemu Torma]

We are experiencing crashes in omniORB 4.1.0 involving double-release of
a typecode.

This happens in a server that just passes any types from one remote
process to other ones without decoding or using the content of the any
type. The value of the any is copied at least once in the process to
store it to a reference counted pointer.

I have attached valgrind log of the crash, and we can reproduce easily.
It appears to happen when the counted pointer containing the any is
destroyed after it has been sent to every recipient.

Teemu
-------------- next part --------------
A non-text attachment was scrubbed...
Name: valgrind.log
Type: text/x-log
Size: 3801 bytes
Desc: not available
Url : http://www.omniorb-support.com/pipermail/omniorb-list/attachments/20061221/fb11a689/valgrind.bin

[Teemu Torma]

Post by Teemu Torma
We are experiencing crashes in omniORB 4.1.0 involving double-release
of a typecode.

Reverting the last change made on Nov 28 to typecode handling fixes the
crash.

Tue Nov 28 00:06:57 GMT 2006 dgrisby
====================================

- TypeCode collector could access deleted data when freeing TypeCodes
with multiple loops.

include/omniORB4/internal/typecode.h
src/lib/omniORB/dynamic/typecode.cc

Teemu

[Duncan Grisby]

Post by Teemu Torma
We are experiencing crashes in omniORB 4.1.0 involving double-release of
a typecode.

Can you send me the IDL for the type that causes the crash?

Cheers,

Duncan.