🚀 go-pugleaf

Remy Lebeau (TeamB) wrote:

>>   if ( MemoryStream->Position + receivelength >= MemoryStream->Size )
>>      MemoryStream->Size += receivelength + 1; // +1 is not needed I think
> 
> No, +1 is not needed.  Neither is checking the (Position + receivelength),
> either.  TMemoryStream's Size property sets the Capacity property, which
> already checks the new size before actually allocating memory.
> TMemoryStream allocates its Memory in 8K chunks.

The adjusting of Size is needed. You have to see it in the context
of the statement that folows:

   int nread = Socket->ReceiveBuf (
     ((char*)MemoryStream->Memory) + MemoryStream->Position, receivelength );

If ->Memory had not sufficiend Size then above statement, that puts bytes
directly in the Memory-buffer, would produce a bufferoverflow.

If I had used TMemoryString::Write() then Size had been adjusted automatically.

See following code that will cause the app to exit because of a bufferoverflow.

To my surprise codeguard does nothing here.

void __fastcall TForm1::Button1Click(TObject *Sender)
{
   TMemoryStream *MemoryStream = new TMemoryStream;

   MemoryStream->Size = 1000;

   char *ptr = (char*)MemoryStream->Memory;

   int size = 20000;

   while ( --size )
      *ptr++ = 0;

   delete MemoryStream;
}

Hans.