server code segfaults

[Stéphane Genaud <genaud icps u-strasbg fr>]

Hi,

could someone help me with a memory management problem.
I have a client asking for a sequence of bytes to be returned by a
server.
The client gets the correct values but the server segfault once it has
returned the sequence.
My client code calls :

VSERV_image_bytevect  *img;
    ....
    img = VSERV_image_readpixel(image_obj,&width, &height, &ev);
    ....
    if (CORBA_sequence_get_release(img)) CORBA_free(img->_buffer);


and after this, the img->_buffer do contains the correct values,
img->_length contains was what put in the server, but img->_maximum=0
though the C mappings say (page 1-14) "Upon successful return from the
invocation
the _maximum member will contain the size of the allocated array".


And this is my server-side code : 

static VSERV_image_bytevect *
impl_VSERV_image_readpixel(impl_POA_VSERV_image * servant,
                           CORBA_short * width,
                           CORBA_short * height, CORBA_Environment * ev)
{
  VSERV_image_bytevect *retval;
 
  guchar              *buff;
  gulong              img_size;
  retval = VSERV_image_bytevect__alloc();
  CORBA_sequence_set_release(retval,TRUE);
 
 
  buff = pbuffer_readpixel_with_dim((gint *)width,(gint *) height);
  img_size = (gulong) (*width) * (*height) * 3; /* in bytes */
  retval->_length   = img_size;
 
  retval->_buffer =
       CORBA_sequence_CORBA_octet_allocbuf(img_size*sizeof(guchar) );
  memcpy(retval->_buffer, buff, img_size*sizeof(guchar) );

   return retval;   /* segfaults after this */
}

Has someone a clue of what i'm doing wrong or why the server segfaults ?
Thanks.