From e34095b65b354e956b8c6c561750ffb67fbc0bae Mon Sep 17 00:00:00 2001
From: Anthony Geay <anthony.geay@edf.fr>
Date: Wed, 23 Jun 2021 08:38:56 +0200
Subject: [PATCH] Fix memory corruption introduced into ef9db08c8153

---
 src/DriverMED/DriverMED_W_Field.cxx        | 15 +++++----------
 src/DriverMED/DriverMED_W_SMESHDS_Mesh.cxx |  9 +++------
 src/MEDWrapper/MED_TFile.hxx               |  6 ++++--
 3 files changed, 12 insertions(+), 18 deletions(-)

diff --git a/src/DriverMED/DriverMED_W_Field.cxx b/src/DriverMED/DriverMED_W_Field.cxx
index c722aaf35..18d6f9734 100644
--- a/src/DriverMED/DriverMED_W_Field.cxx
+++ b/src/DriverMED/DriverMED_W_Field.cxx
@@ -369,24 +369,19 @@ Driver_Mesh::Status DriverMED_W_Field::Perform()
  */
 Driver_Mesh::Status DriverMED_W_Field_Mem::Perform()
 {
-  void *ptr(nullptr);
-  std::size_t sz(0);
   Driver_Mesh::Status status = Driver_Mesh::DRS_OK;
   bool isClosed(false);
-  MED::TMemFile *tfileInst = nullptr;
-  char *initPtr(_data->getPointer());
-  mcIdType initSz(_data->getNumberOfTuples());
+  void *ptr(_data->getPointer());
+  std::size_t sz(_data->getNumberOfTuples());
   _data->accessToMemArray().setSpecificDeallocator(nullptr);
   _data->useArray(nullptr,false,MEDCoupling::DeallocType::C_DEALLOC,0,1);
   {// let braces to flush (call of MED::PWrapper myMed destructor)
-    tfileInst = new MED::TMemFile(initPtr,initSz,&isClosed);
+    MED::TMemFile *tfileInst = new MED::TMemFile(&ptr,&sz,&isClosed);
     MED::PWrapper myMed = MED::CrWrapperW(myFile, -1, tfileInst);
     status = this->PerformInternal(myMed);
   }
-  if(tfileInst)
-  {
-    ptr = tfileInst->getData(); sz = tfileInst->getSize();
-  }
+  if(!isClosed)
+    EXCEPTION(std::runtime_error, "TFTMemFile destructor : on destruction file has not been closed properly -> chunk of memory data may be invalid !");
   _data = MEDCoupling::DataArrayByte::New();
   _data->useArray(reinterpret_cast<char *>(ptr),true,MEDCoupling::DeallocType::C_DEALLOC,sz,1);
   return status;
diff --git a/src/DriverMED/DriverMED_W_SMESHDS_Mesh.cxx b/src/DriverMED/DriverMED_W_SMESHDS_Mesh.cxx
index 458156813..7647dc425 100644
--- a/src/DriverMED/DriverMED_W_SMESHDS_Mesh.cxx
+++ b/src/DriverMED/DriverMED_W_SMESHDS_Mesh.cxx
@@ -356,16 +356,13 @@ Driver_Mesh::Status DriverMED_W_SMESHDS_Mesh_Mem::Perform()
   std::size_t sz(0);
   Driver_Mesh::Status status = Driver_Mesh::DRS_OK;
   bool isClosed(false);
-  TMemFile *tfileInst = nullptr;
   {// let braces to flush (call of MED::PWrapper myMed destructor)
-    tfileInst = new TMemFile(&isClosed);
+    TMemFile *tfileInst = new TMemFile(&ptr,&sz,&isClosed);// this new will be destroyed by destructor of myMed
     MED::PWrapper myMed = CrWrapperW(myFile, -1, tfileInst);
     status = this->PerformInternal<MED::PWrapper>(myMed);
   }
-  if(tfileInst)
-  {
-    ptr = tfileInst->getData(); sz = tfileInst->getSize();
-  }
+  if(!isClosed)
+    EXCEPTION(std::runtime_error, "TFTMemFile destructor : on destruction file has not been closed properly -> chunk of memory data may be invalid !");
   _data = MEDCoupling::DataArrayByte::New();
   _data->useArray(reinterpret_cast<char *>(ptr),true,MEDCoupling::DeallocType::C_DEALLOC,sz,1);
   if(!isClosed)
diff --git a/src/MEDWrapper/MED_TFile.hxx b/src/MEDWrapper/MED_TFile.hxx
index 70a5402cc..09634f891 100644
--- a/src/MEDWrapper/MED_TFile.hxx
+++ b/src/MEDWrapper/MED_TFile.hxx
@@ -73,12 +73,14 @@ namespace MED
   class MEDWRAPPER_EXPORT TMemFile : public MEDIDTHoder
   {
   public:
-    TMemFile(bool* isClosedStatus = nullptr):MEDIDTHoder(isClosedStatus) { memfile.app_image_ptr=nullptr; memfile.app_image_size=0; }
-    TMemFile(void *data, std::size_t sz, bool* isClosedStatus):MEDIDTHoder(isClosedStatus) { memfile.app_image_ptr=data; memfile.app_image_size=sz; }
+    TMemFile(void **data, std::size_t *sz, bool* isClosedStatus):MEDIDTHoder(isClosedStatus),_data(data),_sz(sz) { memfile.app_image_ptr=*data; memfile.app_image_size=*sz; }
+    ~TMemFile() { UnRefFid(); if(myIsClosed) { *_data = memfile.app_image_ptr; *_sz = memfile.app_image_size; } }
     void Open(EModeAcces theMode, TErr* theErr = nullptr) override;
     void *getData() const { return memfile.app_image_ptr; }
     std::size_t getSize() const { return memfile.app_image_size; }
   private:
+    void **_data = nullptr;
+    std::size_t * _sz = nullptr;
     med_memfile memfile = MED_MEMFILE_INIT;
   };