From: Jens Berlips (jens.berlips_at_[hidden])
Date: 2006-11-29 09:43:50


Hello,

I was considering using Boost included xml serialization code for
quite mission critical code where the xml files couldn't be trusted.
But after some testing I realized the following problem in the
collections_load_imp.hpp:

template<class Archive, class Container, class InputFunction, class R>
inline void rebuild_collection(Archive & ar, Container &s)
{
    s.clear();
    // retrieve number of elements
    unsigned int count;
    ar >> BOOST_SERIALIZATION_NVP(count);
    R rx;
    rx(s, count);
    InputFunction ifunc;
    while(count-- > 0){
        ifunc(ar, s);
    }
}

If you consider the code, the count is taken for granted to be
correct. In my case I can't know this.

Perhaps there should be an preprocessor option to remove the
pre-allocation here? That is remove rx(s,count) from the function
above (the serialization should work quite nicely anyway, because the
Container.push_back dynamically allocates memory.

If anyone know of similar problems with other parts of the boost
serialization library, please tell me about.

Best Regards,
Jens Berlips