Fixed bug reported by Julian Foad:

While investigating, I found that SGPropertyNode::getPath returns a
(char *) pointer to the character data of a string on its stack,
i.e. to undefined memory after it returns.  I remember someone was
changing strings to char* for efficiency.  Perhaps this bug was
introduced then.  I'll include a patch for it with my eventual patch
for the above, unless someone beats me to it.  I don't think it
affects any existing callers: they all want a string anyway.

diff --git a/simgear/misc/props.cxx b/simgear/misc/props.cxx
index bb13712414c91db125634f1e204a369a20129a15..cb721d34ce4787d8f73e7e67a44acabe7240dd49 100644 (file)
--- a/simgear/misc/props.cxx
+++ b/simgear/misc/props.cxx
@@ -931,7 +931,8 @@ SGPropertyNode::getPath (bool simplify) const
     sprintf(buffer, "[%d]", _index);
     path += buffer;
   }
-  return path.c_str();
+  strncpy(_buffer, path.c_str(), MAX_STRING_LEN);
+  return _buffer;
 }
 
 SGPropertyNode::Type