<html>
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered)">
<style>
<!--
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:#606420;
text-decoration:underline;}
span.EmailStyle17
{font-family:Arial;
color:windowtext;}
@page Section1
{size:595.3pt 841.9pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body lang=FR link=blue vlink="#606420">
<div class=Section1>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'>Hi all,</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'> </span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'>I found (and fix) a very dangerous memory bug in
vtkDataArray :</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'> </span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'>In the two non template methods InterpolateTuple the
two calls to vtkTemplateMacro :</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'> </span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>In vtkDataArray : 301</span></font></p>
<table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 width=615
style='width:461.0pt;margin-left:-.75pt;border-collapse:collapse'>
<tr height=17 style='height:12.75pt'>
<td width=615 nowrap height=17 valign=bottom style='width:461.0pt;padding:
0cm 3.5pt 0cm 3.5pt;height:12.75pt'>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> vtkTemplateMacro(</span></font></p>
</td>
</tr>
<tr height=17 style='height:12.75pt'>
<td width=615 nowrap height=17 valign=bottom style='width:461.0pt;padding:
0cm 3.5pt 0cm 3.5pt;height:12.75pt'>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> void* vfrom =
fromData->GetVoidPointer(0);</span></font></p>
</td>
</tr>
<tr height=17 style='height:12.75pt'>
<td width=615 nowrap height=17 valign=bottom style='width:461.0pt;padding:
0cm 3.5pt 0cm 3.5pt;height:12.75pt'>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'> void*
vto = this->WriteVoidPointer(idx, numComp);</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'> …</span></font></p>
</td>
</tr>
</table>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'> </span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'>In </span></font><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>vtkDataArray : 367</span></font></p>
<table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 width=615
style='width:461.0pt;margin-left:-.75pt;border-collapse:collapse'>
<tr height=17 style='height:12.75pt'>
<td width=615 nowrap height=17 valign=bottom style='width:461.0pt;padding:
0cm 3.5pt 0cm 3.5pt;height:12.75pt'>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> vtkTemplateMacro(</span></font></p>
</td>
</tr>
<tr height=17 style='height:12.75pt'>
<td width=615 nowrap height=17 valign=bottom style='width:461.0pt;padding:
0cm 3.5pt 0cm 3.5pt;height:12.75pt'>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'> void* vfrom1 =
fromData1->GetVoidPointer(id1*numComp);</span></font></p>
</td>
</tr>
<tr height=17 style='height:12.75pt'>
<td width=615 nowrap height=17 valign=bottom style='width:461.0pt;padding:
0cm 3.5pt 0cm 3.5pt;height:12.75pt'>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'> void* vfrom2 =
fromData2->GetVoidPointer(id2*numComp);</span></font></p>
</td>
</tr>
<tr height=17 style='height:12.75pt'>
<td width=615 nowrap height=17 valign=bottom style='width:461.0pt;padding:
0cm 3.5pt 0cm 3.5pt;height:12.75pt'>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'> void* vto =
this->WriteVoidPointer(loc, numComp);</span></font></p>
</td>
</tr>
</table>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'> …</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'> </span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'>are erroneous (cause segmentation fault) when ‘fromData’
and ‘this’ are the same. vfrom* pointers are retrieved BEFORE the
call to WriteVoidPointer, which may THEN reallocate the array, making vfrom*
pointers no longer valid.</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'> </span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'>To avoid any memory fault, it MUST be written this
way (vfrom retrieved AFTER call to WriteVoidPointer) :</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>In vtkDataArray : 301</span></font></p>
<table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 width=615
style='width:461.0pt;margin-left:-.75pt;border-collapse:collapse'>
<tr height=17 style='height:12.75pt'>
<td width=615 nowrap height=17 valign=bottom style='width:461.0pt;padding:
0cm 3.5pt 0cm 3.5pt;height:12.75pt'>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> vtkTemplateMacro(</span></font></p>
</td>
</tr>
<tr height=17 style='height:12.75pt'>
<td width=615 nowrap height=17 valign=bottom style='width:461.0pt;padding:
0cm 3.5pt 0cm 3.5pt;height:12.75pt'>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'> void*
vto = this->WriteVoidPointer(idx, numComp);</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'> </span></font><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'>void*
vfrom = fromData->GetVoidPointer(0);</span></font></p>
</td>
</tr>
<tr height=17 style='height:12.75pt'>
<td width=615 nowrap height=17 valign=bottom style='width:461.0pt;padding:
0cm 3.5pt 0cm 3.5pt;height:12.75pt'>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> <span lang=EN-GB>
…</span></span></font></p>
</td>
</tr>
</table>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'> </span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'>In </span></font><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>vtkDataArray : 367</span></font></p>
<table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 width=615
style='width:461.0pt;margin-left:-.75pt;border-collapse:collapse'>
<tr height=17 style='height:12.75pt'>
<td width=615 nowrap height=17 valign=bottom style='width:461.0pt;padding:
0cm 3.5pt 0cm 3.5pt;height:12.75pt'>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> vtkTemplateMacro(</span></font></p>
</td>
</tr>
<tr height=17 style='height:12.75pt'>
<td width=615 nowrap height=17 valign=bottom style='width:461.0pt;padding:
0cm 3.5pt 0cm 3.5pt;height:12.75pt'>
<table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 width=615
style='width:461.0pt;border-collapse:collapse'>
<tr height=17 style='height:12.75pt'>
<td width=615 nowrap height=17 valign=bottom style='width:461.0pt;
padding:0cm 3.5pt 0cm 3.5pt;height:12.75pt'>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB
style='font-size:10.0pt;font-family:Arial'> void*
vto = this->WriteVoidPointer(loc, numComp);</span></font></p>
</td>
</tr>
</table>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'> void* vfrom1 =
fromData1->GetVoidPointer(id1*numComp);</span></font></p>
</td>
</tr>
<tr height=17 style='height:12.75pt'>
<td width=615 nowrap height=17 valign=bottom style='width:461.0pt;padding:
0cm 3.5pt 0cm 3.5pt;height:12.75pt'>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'> void* vfrom2 =
fromData2->GetVoidPointer(id2*numComp);</span></font></p>
</td>
</tr>
</table>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'> …</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'> </span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'>#########################################################</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'> </span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'>This kind of call happens when the method RequestData
(in file vtkClipDataSet at line 378) calls :</span></font></p>
<table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 width=615
style='width:461.0pt;margin-left:-.75pt;border-collapse:collapse'>
<tr height=17 style='height:12.75pt'>
<td width=615 nowrap height=17 valign=bottom style='width:461.0pt;padding:
0cm 3.5pt 0cm 3.5pt;height:12.75pt'>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'> cell->Clip(this->Value,
cellScalars, this->Locator, conn[0],</span></font></p>
</td>
</tr>
<tr height=17 style='height:12.75pt'>
<td width=615 nowrap height=17 valign=bottom style='width:461.0pt;padding:
0cm 3.5pt 0cm 3.5pt;height:12.75pt'>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'>
inPD, outPD, inCD, cellId, outCD[0], this->InsideOut);</span></font></p>
</td>
</tr>
</table>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'> </span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'>Then in vtkCell3D.cxx line 310 :</span></font></p>
<table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 width=615
style='width:461.0pt;margin-left:-.75pt;border-collapse:collapse'>
<tr height=17 style='height:12.75pt'>
<td width=615 nowrap height=17 valign=bottom style='width:461.0pt;padding:
0cm 3.5pt 0cm 3.5pt;height:12.75pt'>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'> // VERY
IMPORTANT: Notice that the outPD is used twice. </span></font><font size=2
face=Arial><span style='font-size:10.0pt;font-family:Arial'>This is because
the</span></font></p>
</td>
</tr>
<tr height=17 style='height:12.75pt'>
<td width=615 nowrap height=17 valign=bottom style='width:461.0pt;padding:
0cm 3.5pt 0cm 3.5pt;height:12.75pt'>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'> // tetra
has been defined in terms of point ids that are defined in the</span></font></p>
</td>
</tr>
<tr height=17 style='height:12.75pt'>
<td width=615 nowrap height=17 valign=bottom style='width:461.0pt;padding:
0cm 3.5pt 0cm 3.5pt;height:12.75pt'>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'> //
output (because of the templates).</span></font></p>
</td>
</tr>
<tr height=17 style='height:12.75pt'>
<td width=615 nowrap height=17 valign=bottom style='width:461.0pt;padding:
0cm 3.5pt 0cm 3.5pt;height:12.75pt'>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'> this->ClipTetra->Clip(value,
this->ClipScalars, locator, tets, outPD,</span></font></p>
</td>
</tr>
<tr height=17 style='height:12.75pt'>
<td width=615 nowrap height=17 valign=bottom style='width:461.0pt;padding:
0cm 3.5pt 0cm 3.5pt;height:12.75pt'>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'>
outPD, inCD, cellId, outCD, insideOut);</span></font></p>
</td>
</tr>
</table>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'> </span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'>And finally in vtkTetra.cxx line 909:</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'>
outPD->InterpolateEdge(inPD,pts[i-1],p1,p2,t);</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'> </span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'>Where outPD == inPD, making vtkDataArray
InterpolateTuple crash later.</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'> </span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'>Best Regards</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-GB style='font-size:
10.0pt;font-family:Arial'>Daniel Aguilera</span></font></p>
</div>
</body>
</html>