[RFC PATCH] Fix divelogs.de upload crash

[Dirk Hohndel]

On Tue, Sep 08, 2015 at 08:40:51PM +0300, Miika Turkia wrote:
> 
> Subsurface crashes when multiple dives are selected on divelogs.de
> export. The crash occurs on malloc that is called indirectly from
> xmlReadMemory().

That sounds like a malloc meta data corruption.
What your patch does is that instead of reusing one membuffer over and
over again it throws away the one we are using and creates a new one for
every iteration of the loop.  Which makes me think that one of our helpers
must be overwriting things it shouldn't overwrite.

Can you run this (without your patch) under valgrind and see if it points
at something obvious? If push comes to shove I'll of course take your
patch, but I'd rather figure out why this fails :-(

/D

> ---
> I don't really understand what goes wrong here, as the memory buffer
> looks to be correct. It might be that the internal state of XML parser
> is left dirty if we use same memory buffer on subsequent runs. Anyway,
> re-allocating the membuffer for each dive is the best I was able to come
> up with.
> ---
>  qt-ui/subsurfacewebservices.cpp | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/qt-ui/subsurfacewebservices.cpp b/qt-ui/subsurfacewebservices.cpp
> index 1722da4..e2e3b3e 100644
> --- a/qt-ui/subsurfacewebservices.cpp
> +++ b/qt-ui/subsurfacewebservices.cpp
> @@ -175,7 +175,6 @@ bool DivelogsDeWebServices::prepare_dives_for_divelogs(const QString &tempfile,
>  	/* walk the dive list in chronological order */
>  	int i;
>  	struct dive *dive;
> -	struct membuffer mb = { 0 };
>  	for_each_dive (i, dive) {
>  		FILE *f;
>  		char filename[PATH_MAX];
> @@ -183,6 +182,7 @@ bool DivelogsDeWebServices::prepare_dives_for_divelogs(const QString &tempfile,
>  		const char *membuf;
>  		xmlDoc *transformed;
>  		struct zip_source *s;
> +		struct membuffer mb = { 0 };
>  
>  		/*
>  		 * Get the i'th dive in XML format so we can process it.