Unhandled exception at 0x779a385b in Acrobat.exe: 0xC0000374: A heap has been corrupted

Question

Hi,
In our project, we are getting all book marks from PDF file for display purpose.
We are getting “Unhandled exception at 0x779a385b in Acrobat.exe: 0xC0000374: A heap has been corrupted” exception while getting Action from particular bookmark. But this is working fine for all other bookmarks, Please find the code we used below:
CString CPGRBookMarkMC::GetBookMarkDetails(PDBookmark bmObj)
       CString csBookmarkDetails;
       //Ensure that the bookmark is valid
       char * bmName = NULL;
       ASInt32 bufSize = PDBookmarkGetTitle(bmObj, NULL, 0) + 1;
       //Allocate the size of bufSize to the character pointer
       bmName = (char*)ASmalloc((os_size_t)bufSize);
       //Populate bmBuf with the bookmark's title
       PDBookmarkGetTitle(bmObj, bmName, bufSize);
       DURING
              if (!PDBookmarkIsValid(bmObj))
                     E_RETURN(csBookmarkDetails);
       PDAction objAction = PDBookmarkGetAction(bmObj);
       if(PDActionIsValid(objAction))
              PDViewDestination objDest = PDActionGetDest(objAction);
              ASInt32 bmPageNum = 0;
              ASAtom fitType = ASAtomNull;
              ASFixedRectP destRect = NULL;
              ASFixed zoom = NULL;
              PDViewDestGetAttr (objDest, &bmPageNum, &fitType, destRect, &zoom);
              char *tempPagenum = NULL;
              tempPagenum = (char*)ASmalloc((os_size_t)bufSize);
              itoa(bmPageNum, tempPagenum, 10);
              strcat(bmName ,",");
              strcat(bmName, tempPagenum);
              csBookmarkDetails = bmName;
       HANDLER
       END_HANDLER
       return csBookmarkDetails;
This unhandled exception is not handled in DURING/HANDLER block also. Please help us to resolve the issue.

Answer 1

It looks like you are filling a buffer here
PDBookmarkGetTitle(bmObj, bmName, bufSize);
and overflowing that buffer here
strcat(bmName ,",");
strcat(bmName, tesmpPagenum);
If that is the case, you will have problems which could appear at anytime after code execution.
Also, in the code below, the connection between  bufSize and the alphanumeric string size of bmPageNum is not obvious.
              tempPagenum = (char*)ASmalloc((os_size_t)bufSize);
              itoa(bmPageNum, tempPagenum, 10);