From a38db39de6f6df80e86c77ec6a5e58a48b56bdbd Mon Sep 17 00:00:00 2001
From: mpv <mpv@opencascade.com>
Date: Mon, 22 May 2017 14:35:57 +0300
Subject: [PATCH] 0025537: XmlMPrsStd_PositionDriver::Paste runtime check
 crash.

Increased a size of buffer in array of 'char' to fit the largest possible conversion from 'double' to %.17g string.
---
 .../XmlMDataXtd_PositionDriver.cxx            |  2 +-
 .../XmlMXCAFDoc_CentroidDriver.cxx            |  2 +-
 src/XmlObjMgt/XmlObjMgt_GP.cxx                |  2 +-
 tests/bugs/caf/bug25537                       | 29 +++++++++++++++++++
 4 files changed, 32 insertions(+), 3 deletions(-)
 create mode 100644 tests/bugs/caf/bug25537

diff --git a/src/XmlMDataXtd/XmlMDataXtd_PositionDriver.cxx b/src/XmlMDataXtd/XmlMDataXtd_PositionDriver.cxx
index 60aaa106fd..2117364d31 100644
--- a/src/XmlMDataXtd/XmlMDataXtd_PositionDriver.cxx
+++ b/src/XmlMDataXtd/XmlMDataXtd_PositionDriver.cxx
@@ -122,7 +122,7 @@ void XmlMDataXtd_PositionDriver::Paste
   if (!aTPos.IsNull())
   {
     gp_Pnt aPos = aTPos->GetPosition();
-    char buf [64];
+    char buf [75]; // (24 + 1) * 3
     Sprintf (buf, "%.17g %.17g %.17g", aPos.X(), aPos.Y(), aPos.Z());
     XmlObjMgt::SetStringValue(theTarget.Element(), buf);
   }
diff --git a/src/XmlMXCAFDoc/XmlMXCAFDoc_CentroidDriver.cxx b/src/XmlMXCAFDoc/XmlMXCAFDoc_CentroidDriver.cxx
index 0166afae0d..100a91776e 100644
--- a/src/XmlMXCAFDoc/XmlMXCAFDoc_CentroidDriver.cxx
+++ b/src/XmlMXCAFDoc/XmlMXCAFDoc_CentroidDriver.cxx
@@ -121,7 +121,7 @@ void XmlMXCAFDoc_CentroidDriver::Paste
   if (!aTPos.IsNull())
   {
     gp_Pnt aPos = aTPos->Get();
-    char buf [64];
+    char buf[75]; // (24 + 1) * 3
     Sprintf (buf, "%.17g %.17g %.17g", aPos.X(), aPos.Y(), aPos.Z());
     XmlObjMgt::SetStringValue(theTarget.Element(), buf);
   }
diff --git a/src/XmlObjMgt/XmlObjMgt_GP.cxx b/src/XmlObjMgt/XmlObjMgt_GP.cxx
index 1a6e5604e7..ddb9db049e 100644
--- a/src/XmlObjMgt/XmlObjMgt_GP.cxx
+++ b/src/XmlObjMgt/XmlObjMgt_GP.cxx
@@ -61,7 +61,7 @@ XmlObjMgt_DOMString XmlObjMgt_GP::Translate (const gp_Mat& aMat)
 //=======================================================================
 XmlObjMgt_DOMString XmlObjMgt_GP::Translate (const gp_XYZ& anXYZ)
 {
-  char buf [64];
+  char buf [75]; // (24 + 1) * 3
   Sprintf (buf, "%.17g %.17g %.17g", anXYZ.X(), anXYZ.Y(), anXYZ.Z());
   return XmlObjMgt_DOMString (buf);
 }
diff --git a/tests/bugs/caf/bug25537 b/tests/bugs/caf/bug25537
new file mode 100644
index 0000000000..1da77c16a2
--- /dev/null
+++ b/tests/bugs/caf/bug25537
@@ -0,0 +1,29 @@
+puts "============"
+puts "OCC25537"
+puts "============"
+puts ""
+#######################################################################
+# XmlMPrsStd_PositionDriver::Paste runtime check crash.
+#######################################################################
+pload XDEDRAW
+
+NewDocument Doc XmlXCAF
+
+# number that takes 24 symbols in %.17g string
+set aBigNum -0.0000000000123456789123456789
+
+# Create TDataXtd_Position and XCAFDoc_Centroid attributes (same problem in writing XML)
+# 100 labels to have a stable exception (memory corruption)
+for {set i 1} {$i < 100} {incr i} {
+  set aLab1 0:1:$i
+  SetPosition Doc $aLab1 $aBigNum $aBigNum $aBigNum
+  set aLab2 0:2:$i
+  Label Doc $aLab2
+  XSetCentroid Doc $aLab2 $aBigNum $aBigNum $aBigNum
+}
+
+set aFile ${imagedir}/bug25537_test.xml
+SaveAs Doc ${aFile}
+
+## ==> No exception
+Close Doc