C / C++ / MFC

12-Jan-04 8:18

I have some code that I am having problems with. In the destructor. It is pretty straight forward:
[quote]
{
if( m_pData != NULL )
{
delete [] m_pData;
}
}
[/quote]

I am compiling and running this through MS Visual C++ 6.0. When I create a debug version, and then step through it, it fails at the delete [] m_pData line. I get the following error:
[quote]
"Debug Error!
Program: D:\MyProg\Debug\MyProg.exe
DAMAGE: after Normal block (#55) at 0x04730068.
(Press Retry to debug the application)"
[/quote]

I then hit retry, and I recieve:
[quote]
"User Breakpoint called from code at 0x40cecf"
[/quote]

The debugger is now pointing to:
[quote]
if (!CheckBytes(pbData(pHead) + pHead->nDataSize, _bNoMansLandFill, nNoMansLandSize))
_RPT3(_CRT_ERROR, "DAMAGE: after %hs block (#%d) at 0x%08X.\n",
szBlockUseName[_BLOCK_TYPE(pHead->nBlockUse)],
pHead->lRequest,
(BYTE *) pbData(pHead));
[/quote]
in VC98\CRT\SRC\DBGHEAP.C

When I switch to build a release version, I do not get this error.

What is going on, and how can I fix this.

-Drew

Joe Woodbury12-Jan-04 8:33

12-Jan-04 8:33

You need to fix the likely underlying buffer overrun.

(You don't get this error in release because the debug checks are turned off.)

Anyone who thinks he has a better idea of what's good for people than people do is a swine.
- P.J. O'Rourke

DruOfGov12-Jan-04 8:51

12-Jan-04 8:51

This is what I was afraid of. This is code I have used before(I haven't changed anything). But it has worked fine before without this error. I have located the place where I am filling m_pData and it reads:
[quote]
m_pData = new unsigned char[bitmapInfoHeader->biSizeImage];

if( m_pData == NULL )
{
return false;
}

fread( m_pData, 1, bitmapInfoHeader->biSizeImage, fp );

fclose( fp );
[/quote]

if I change the initial line to:
m_pData = new unsigned char[bitmapInfoHeader->biSizeImage+1];
it works fine.

How is the fread reading in extra data?

Am I misunderstanding how fread works? Am I looking at the wrong part of my code, and this fixes it, but isn't really what causes the problem?

-Drew

Joe Woodbury12-Jan-04 10:02

12-Jan-04 10:02

It doesn't look like the fread is causing the problem. One way to verify this is to delete m_pData immediately after the fread() and see if an error is emitted.

(This is where BoundsChecker is invaluable, but its hard to convince the people with the money into getting it. I've been trying for months at my current job to no avail.)

Anyone who thinks he has a better idea of what's good for people than people do is a swine.
- P.J. O'Rourke

DruOfGov12-Jan-04 10:14

12-Jan-04 10:14

Thanks for helping with this. I do:
delete [] m_pData;
right after the fread function. Now I am getting the following error:
"The instruction at "0x00405f3b" refereced memory at "0x04731000". The memory could not be "read"."
This is familiar, but I still can't figure out why fread is doing this. If I do the delete later after I manipulate the memory, I get the previously mentioned error. Does this prompt any ideas about what might be going on?

-Drew

Joe Woodbury12-Jan-04 10:34

12-Jan-04 10:34

Are you opening the file in binary mode?

Anyone who thinks he has a better idea of what's good for people than people do is a swine.
- P.J. O'Rourke

DruOfGov12-Jan-04 10:38

12-Jan-04 10:38

Yes, I am opening it in binary. I believe it is supposed to be(this is an image file). I am using:
if( ( fp = fopen( fileName, "rb" ) ) == NULL )
{
return false;
}

I changed it to "r", and the same problem happened.

DruOfGov12-Jan-04 10:41

12-Jan-04 10:41

bool CTexture::LoadBMPTexture( char *fileName )
{
BITMAPINFOHEADER texInfo;

if( m_pData != NULL )
{
delete [] m_pData;
m_pData = NULL;
}

if( !LoadBMPFile( fileName, &texInfo ) )
{
if( m_pData != NULL )
{
delete [] m_pData;
m_pData = NULL;
}

return false;
}

if( m_pData == NULL )
{
delete [] m_pData;
m_pData = NULL;
return false;
}

m_nWidth = texInfo.biWidth;
m_nHeight = texInfo.biHeight;
m_pPalette = NULL;
m_nScaledHeight = 0;
m_nScaledWidth = 0;
m_TextureType = BMP;

return true;
}

bool CTexture::LoadBMPFile( char *fileName, BITMAPINFOHEADER *bitmapInfoHeader )
{
FILE *fp;
BITMAPFILEHEADER bitmapFileHeader;
unsigned int imageIdx = 0;
unsigned char tempRGB;

if( ( fp = fopen( fileName, "rb" ) ) == NULL )
{
return false;
}

fread( &bitmapFileHeader, sizeof( BITMAPFILEHEADER ), 1, fp );

if( bitmapFileHeader.bfType != BITMAP_ID )
{
fclose( fp );
return false;
}

fread( bitmapInfoHeader, sizeof( BITMAPINFOHEADER ), 1, fp );

fseek( fp, bitmapFileHeader.bfOffBits, SEEK_SET );

if( m_pData != NULL )
{
delete [] m_pData;
m_pData = NULL;
}

m_pData = new unsigned char[bitmapInfoHeader->biSizeImage];

if( m_pData == NULL )
{
return false;
}

fread( m_pData, 1, bitmapInfoHeader->biSizeImage, fp );

fclose( fp );

if( m_pData == NULL )
{
delete [] m_pData;
m_pData = NULL;
return false;
}

for( imageIdx = 0; imageIdx < bitmapInfoHeader->biSizeImage; imageIdx += 3 )
{
tempRGB = m_pData[imageIdx];
m_pData[imageIdx] = m_pData[imageIdx + 2];
m_pData[imageIdx + 2] = tempRGB;
}
return true;
}

Joe Woodbury12-Jan-04 12:01

12-Jan-04 12:01

The problem is that you are overrunning the buffer in your last for loop.

Even if you were handling the image correctly, which you are not, the correct for statement should be:

for( imageIdx = 0; imageIdx < bitmapInfoHeader->biSizeImage - 2; imageIdx += 3 )

(Note the "-2", in the loop you read/write "imageIdx + 2")

A bigger problem is all rows in a bitmap are aligned to a DWORD boundary. You algorithm will fail if ((width * 3) % 4 != 0)

The loop fails because there are padded bytes which means that biSizeImage is not divisable by three.

Anyone who thinks he has a better idea of what's good for people than people do is a swine.
- P.J. O'Rourke

DruOfGov12-Jan-04 16:12