C++/CLI heap error on delete[] - c++-cli

Question

I seem to have a problem deleting a char* array. It crashes due to heap corruption as delete[] gets called:
typedef struct _CDB_SYMBOL_INFO {
char * name;
unsigned long address;
unsigned long value;
} CDB_SYMBOL_INFO;
// ...
for each( Symbol ^ symbol in bls->Symbols )
{
CDB_SYMBOL_INFO symbol_info;
symbol_info.name = new char[symbol->Name->Length];
Marshal::Copy( symbol->Name->ToCharArray(), 0, IntPtr( (char*) symbol_info.name ), symbol->Name->Length );
// see enumerate_cdb_symbols_callback(..)
cdb_call_back(&symbol_info, *call_back);
delete[] symbol_info.name; // Crashes here
}
// ...
I don't see the problem here ..
static int enumerate_cdb_symbols_callback(CDB_SYMBOL_INFO * info, void * call_back)
{
EnumerateSymbolsCallBack *cb = (EnumerateSymbolsCallBack*)call_back;
Symbol * symbol = alloc_symbol();
cb(0, symbol);
return 0;
}

Answer 1

You're calling the Marshal::Copy overload for an array of 16-bit elements (.NET System::Char is not C++ char!), and the fourth parameter is the number of elements not the number of bytes, so you're actually copying symbol->Name->Length * 2 bytes, which is twice the size of your buffer. The resulting overflow corrupts heap metadata, causing delete[] to crash.
Either use a buffer of type wchar_t, which is the C++ type that matches System::Char, or convert the string to ASCII, perhaps by replacing ToCharArray() with Encoding::ASCII::GetBytes(symbol->Name). Or UTF-8, in which case you can't assume that symbol->Name->Length is the necessary buffer size.
An even simpler way is to use the marshal_as library that comes with C++/CLI:
#include <msclr\marshal_cppstd.h>
using namespace msclr::interop;
for each( Symbol ^ symbol in bls->Symbols )
{
std::string sym_name = marshal_as<std::string>(symbol->Name);
CDB_SYMBOL_INFO symbol_info;
symbol_info.name = &sym_name[0];
// see enumerate_cdb_symbols_callback(..)
cdb_call_back(&symbol_info, *call_back);
}
It does some unspecified single-byte character encoding (most likely ASCII), and uses RAII to free the memory automatically.