Potential memory corruption when (de-)serializing Sets in LabVIEW 2019 SP1 f3 (32-bit)

[LogMAN]

I discovered a potential memory corruption when using Variant To Flattened String and Flattened String To Variant functions on Sets. Here is the test code:

In this example, the set is serialized and de-serialized without changing any data. The code runs in a loop to increase the chance of crashing LabVIEW.

Here is the type descriptor. If you are familiar with type descriptors, you'll notice that something is off:

Here is the translation:

• 0x0008 - Length of the type descriptor in bytes, including the length word (8 bytes) => OK
• 0x0073 - Data type (Set) => OK
• 0x0001 - Number of dimensions (a set is essentially an array with dimension size 1) => OK
• 0x0004 - Length of the type descriptor for the internal type in bytes, including the length word (4 bytes) => OK
• ???? - Type descriptor for the internal data type (should be 0x0008 for U64) => What is going on?

It turns out that the last two bytes are truncated. The Flatten String To Variant function actually reports error 116, which makes sense because the type descriptor is incomplete, BUT it does not always return an error! In fact, half of the time, no error is reported and LabVIEW eventually crashes (most often after adding a label to the numeric type in the set constant). I believe that this corrupts memory, which eventually crashes LabVIEW. Here is a video that illustrates the behavior:

Can somebody please confirm this issue?

LV2019SP1f3 (32-bit) Potential Memory Corruption when (de-)serializing Sets.vi

Edited February 6, 2021 by LogMAN
TD length is in Bytes

[dadreamer]

Just now, LogMAN said:

Can somebody please confirm this issue?

I confirm that in LabVIEW 2020 (both 32- and 64-bit) on Windows. 32-bit LabVIEW dies silently in case of the error, whereas 64-bit LabVIEW shows the following report.

[LogMAN]

Thanks, I'll report this to NI

[TomOrr0W]

Could you post the bug here on the dark side: Monthly bugs for 2021 - NI Community once you get confirmation/a bug number from NI?

[LogMAN]

Sure thing, it's also good to know there is a thread like that - first time I've head of it 😮