Null pointer not handled in src/BRep/BRep_Tool.cxx



As a FreeCAD contributor I tracked a crash up to src/BRep/BRep_Tool.cxx and discovered that null pointers are not handle in many function.

For example:

Handle(Geom2d_Curve) BRep_Tool::CurveOnSurface(const TopoDS_Edge& E, 
                                               const Handle(Geom_Surface)& S,
                                               const TopLoc_Location& L,
                                               Standard_Real& First,
                                               Standard_Real& Last,
                                               Standard_Boolean* theIsStored)
  TopLoc_Location loc = L.Predivided(E.Location());
  Standard_Boolean Eisreversed = (E.Orientation() == TopAbs_REVERSED);
  if (theIsStored)
    *theIsStored = Standard_True;

  // find the representation
  const BRep_TEdge* TE = static_cast<const BRep_TEdge*>(E.TShape().get());
  BRep_ListIteratorOfListOfCurveRepresentation itcr(TE->Curves());

  while (itcr.More()) {
    const Handle(BRep_CurveRepresentation)& cr = itcr.Value();
    if (cr->IsCurveOnSurface(S,loc)) {
      const BRep_GCurve* GC = static_cast<const BRep_GCurve*>(cr.get());
      if (GC->IsCurveOnClosedSurface() && Eisreversed)
        return GC->PCurve2();
        return GC->PCurve();

  // Curve is not found. Try projection on plane
  if (theIsStored)
    *theIsStored = Standard_False;
  return CurveOnPlane(E, S, L, First, Last);

can crash at BRep_ListIteratorOfListOfCurveRepresentation itcr(TE->Curves()); if E shape is not set correctly. Such crash occurs when using BRepFilletAPI_MakeChamfer as shown in this FreeCAD issue.

I still have a PR to propose and wait for a contributor access after I signed the CLA.

Dmitrii Pasukhin's picture

Hello, it is a dev forum. If you have bugs or code changes you are free to create ticket into bug tracker and after CLA signing push your code.

But unfortunately, it is not possible just to check all code and update every code line to handle not correct behavior. It is important to write stable and tested code, but it is almost not possible to update all OCCT :(

If someone share the failed scenario(test scenario) it a way to fix specific issue.

OCCT Team have no ability to monitory any issue from FreeCAD or other software based on OCCT from external bug trackers :(

But we plan to simplify workflow and make deep integration with GitHub.

Best regards, Dmitrii.

gkv311 n's picture

BRep_Tool provides methods to access properties of a given TopoDS_Shape. Passing NULL shape to the tool makes no sense and contradicts to design of this tool (it's like calling properties of NULL smart pointer).

NULL checks are expected to be put in the code calling BRep_Tool methods. Hense, the bug should be fixed there (like somewhere in BRepFilletAPI_MakeChamfer, but this could be done only after reproducing the problem and localizing issue in the algorithm)

Florian Foinant-Willig's picture

Thank you two for the answers. I'll try to code a fail soon.

Florian Foinant-Willig's picture

FYI the issue with a crashtest is here: