Stack Smashing when saving an XML

[burakceng]

Hello there,

I have a project where I have to build a GUI (with Qt) that contains entries that I will save them into an XML file for a simulation scenario. I have an issue with an occasion where I have to create a new XML file from scratch, fill in the required content and save it. Until the point of saving everything works fine; however, when I try to use SaveFile(filename.c_str()), I get a SIGABRT with stack smashing detected. The code that I'm using is the following:

`void MainWindow::generateScenarioFile(std::string &filename) { // Generate the root <Scenario> tag tinyxml2::XMLDocument scenario; tinyxml2::XMLNode *pRoot = scenario.NewElement("Scenario"); scenario.InsertFirstChild(pRoot);

// Generate the <World> tag
tinyxml2::XMLElement *world = scenario.NewElement("World");
world->SetAttribute("xlimits", "0.0 5.0");
world->SetAttribute("ylimits", "0.0 5.0");
pRoot->InsertEndChild(world);

// Generate the <UavCount> tag
tinyxml2::XMLElement *uavCount = scenario.NewElement("UavCount");
uavCount->SetText(std::to_string(_scenario.cf_count).c_str());
pRoot->InsertEndChild(uavCount);

// Generate the <Uavs> tag
tinyxml2::XMLNode *uavs = scenario.NewElement("Uavs");
for (unsigned i = 1; i <= _scenario.cf_count; i++)
{
    std::string uav_i_name("cf" + std::to_string(i));
    tinyxml2::XMLElement *uav_i = scenario.NewElement("Uav");
    uav_i->SetAttribute("name", uav_i_name.c_str());
    uav_i->SetAttribute("initial", "0.0 0.0 0.03");

    if (_scenario.isRelayed && _scenario.relay_id == i)
        uav_i->SetAttribute("initial", "relay");
    else
        uav_i->SetAttribute("initial", "search");

    uav_i->SetAttribute("failsafe_alt", "0.2");
    uav_i->SetAttribute("substitute", "False");
    uavs->InsertFirstChild(uav_i);
}
pRoot->InsertEndChild(uavs);

// Generate the NOTAM <Zones> tag
tinyxml2::XMLNode *zones = scenario.NewElement("Zones");
std::vector<Zone>::iterator czItr = _scenario.zones.end(), itr = _scenario.zones.begin();
for (; itr != _scenario.zones.end(); itr++)
{
    if (itr->t == ZoneType::COVER)
    {
        czItr = itr;
        continue;
    }

    tinyxml2::XMLElement *zone_i = scenario.NewElement("Zone");
    zone_i->SetAttribute("type", "circular");
    zone_i->SetAttribute("radius", std::get<2>(itr->circle));
    std::string cx_i = std::to_string(std::get<0>(itr->circle));
    std::string cy_i = std::to_string(std::get<1>(itr->circle));
    zone_i->SetAttribute("xy", std::string(cx_i + " " + cy_i).c_str());
    zones->InsertFirstChild(zone_i);
}
pRoot->InsertEndChild(zones);

// Generate the <CoverZone> tag
if (czItr != _scenario.zones.end())
{
    float cx = std::get<0>(czItr->circle);
    float cy = std::get<1>(czItr->circle);
    float ofs = std::get<2>(czItr->circle) * static_cast<float>(sqrt(2));

    tinyxml2::XMLNode *coverZone = scenario.NewElement("CoverZone");
    tinyxml2::XMLElement *zoneCorner1 = scenario.NewElement("Corner");
    tinyxml2::XMLElement *zoneCorner2 = scenario.NewElement("Corner");
    tinyxml2::XMLElement *zoneCorner3 = scenario.NewElement("Corner");
    tinyxml2::XMLElement *zoneCorner4 = scenario.NewElement("Corner");
    zoneCorner1->SetAttribute("id", "1");
    zoneCorner1->SetAttribute("x", std::to_string(cx - ofs).c_str());
    zoneCorner1->SetAttribute("y", std::to_string(cy - ofs).c_str());
    zoneCorner2->SetAttribute("id", "2");
    zoneCorner2->SetAttribute("x", std::to_string(cx + ofs).c_str());
    zoneCorner2->SetAttribute("y", std::to_string(cy - ofs).c_str());
    zoneCorner3->SetAttribute("id", "3");
    zoneCorner3->SetAttribute("x", std::to_string(cx + ofs).c_str());
    zoneCorner3->SetAttribute("y", std::to_string(cy + ofs).c_str());
    zoneCorner4->SetAttribute("id", "4");
    zoneCorner4->SetAttribute("x", std::to_string(cx - ofs).c_str());
    zoneCorner4->SetAttribute("y", std::to_string(cy + ofs).c_str());
    coverZone->InsertFirstChild(zoneCorner4);
    coverZone->InsertFirstChild(zoneCorner3);
    coverZone->InsertFirstChild(zoneCorner2);
    coverZone->InsertFirstChild(zoneCorner1);
    pRoot->InsertEndChild(coverZone);
}

// Save the scenario file in xml format
std::string toSave = "Scenario-" + filename + ".xml";
tinyxml2::XMLError eResult = scenario.SaveFile(toSave.c_str());
printf("Result: %i\n", eResult);
return;

}`

The interesting thing is that the file is created and the content is written correctly, but the issue happens when the memory de-allocation starts after closing the file descriptor.

Kind regards,

Burak