ClearCalcFields incorrect, causes memory corruption

[mglass]

I have traced the origin of a memory corruption in DOA 4.1.2.2 under Delphi 2010 (see similar error https://forums.allroundautomations.com/ubb/ubbthreads.php?ubb=showflat&Number=43919) that I'm experiencing back to this function:

procedure TOracleDataSet.ClearCalcFields(Buffer: TRecordBuffer);
begin
FillChar(PRecordData(Buffer)^.Bytes[RecordSize], CalcFieldsSize, 1);
end;

I don't know why Buffer, which is of type TRecordBuffer, is cast to PRecordData, which is a pointer to TRecordData.

The result is that the Buffer value is offset by +$3B bytes before calling FillChar, as shown in the following code:

005C860A 8BF2 mov esi,edx
005C860C 8BD8 mov ebx,eax
005C860E 8BC3 mov eax,ebx
005C8610 8B10 mov edx,[eax]
005C8612 FF92EC010000 call dword ptr [edx+$000001ec]
005C8618 0FB7C0 movzx eax,ax
005C861B 8D44063B lea eax,[esi+eax+$3b]
005C861F B901000000 mov ecx,$00000001
005C8624 8B536C mov edx,[ebx+$6c]
005C8627 E830D1E3FF call @FillChar

Can you please correct this? The memory corruption only occurs because FillChar writes past the end of the Buffer. I don't think anywhere else accesses past the buffer end.

Martin

 

[Marco Kalter]

Thanks for reporting this. We'll investigate and fix this.

 

[mglass]

Now that I've done further investigation, I've found that it is really caused by GetRecBufSize returning a buffer size that is too small.

This post seems like it might be the appropriate solution.

ds := Size * 2 + 2; // was ds := Size * 2;