Changeset 14000

Timestamp:

03/14/08 01:27:11 (4 months ago)

Author:

warmerdam

Message:

refresh from shapelib (#2218)

Files:

• trunk/gdal/ogr/ogrsf_frmts/shape/shpopen.c (modified) (19 diffs)

trunk/gdal/ogr/ogrsf_frmts/shape/shpopen.c

@@ -1 +1 @@
-/******************************************************************************
-7 2007/12/06 07:00:25
+9 2008/03/14 05:25:31
- *
- * Project:  Shapelib
@@ -35 +35 @@
- *
- * $Log: shpopen.c,v $
+ * Revision 1.59  2008/03/14 05:25:31  fwarmerdam
+ * Correct crash on buggy geometries (gdal #2218)
+ *
+ * Revision 1.58  2008/01/08 23:28:26  bram
+ * on line 2095, use a float instead of a double to avoid a compiler warning
+ *
- * Revision 1.57  2007/12/06 07:00:25  fwarmerdam
- * dbfopen now using SAHooks for fileio
@@ -226 +232 @@
-#include <stdio.h>
-
-7 2007/12/06 07:00:25
+9 2008/03/14 05:25:31
-
-typedef unsigned char uchar;
@@ -1495 +1501 @@
-
-{
+    int                  nEntitySize, nRequiredSize;
-    SHPObject           *psShape;
+    char                 pszErrorMsg[128];
-
-/* -------------------------------------------------------------------- */
@@ -1506 +1514 @@
-/*      Ensure our record buffer is large enough.                       */
-/* -------------------------------------------------------------------- */
-if( psSHP->panRecSize[hEntity]+8 > psSHP->nBufSize )
-{
-
-psSHP->nBuf
+nEntitySize = psSHP->panRecSize[hEntity]+8;
+if( nEntitySize > psSHP->nBufSize )
+
+nEntity
-        if (psSHP->pabyRec == NULL)
-        {
-            char szError[200];
+
+            /* Reallocate previous successfull size for following features */
+            psSHP->pabyRec = malloc(psSHP->nBufSize);
-
-            sprintf( szError, 
@@ -1520 +1531 @@
-            return NULL;
-        }
+
+        /* Only set new buffer size after successfull alloc */
+        psSHP->nBufSize = nEntitySize;
+    }
+
+    /* In case we were not able to reallocate the buffer on a previous step */
+    if (psSHP->pabyRec == NULL)
+    {
+        return NULL;
-    }
-
@@ -1526 +1546 @@
-/* -------------------------------------------------------------------- */
-    if( psSHP->sHooks.FSeek( psSHP->fpSHP, psSHP->panRecOffset[hEntity], 0 ) != 0 
-psSHP->panRecSize[hEntity]+8
+nEntitySize
-                  psSHP->fpSHP ) != 1 )
-    {
@@ -1545 +1565 @@
-    psShape->bMeasureIsUsed = FALSE;
-
+    if ( 8 + 4 > nEntitySize )
+    {
+        snprintf(pszErrorMsg, 128, "Corrupted .shp file : shape %d : nEntitySize = %d",
+                    hEntity, nEntitySize); 
+        psSHP->sHooks.Error( pszErrorMsg );
+        SHPDestroyObject(psShape);
+        return NULL;
+    }
-    memcpy( &psShape->nSHPType, psSHP->pabyRec + 8, 4 );
+
-    if( bBigEndian ) SwapWord( 4, &(psShape->nSHPType) );
-
@@ -1561 +1590 @@
-        int             i, nOffset;
-
+        if ( 40 + 8 + 4 > nEntitySize )
+        {
+            snprintf(pszErrorMsg, 128, "Corrupted .shp file : shape %d : nEntitySize = %d",
+                     hEntity, nEntitySize); 
+            psSHP->sHooks.Error( pszErrorMsg );
+            SHPDestroyObject(psShape);
+            return NULL;
+        }
-/* -------------------------------------------------------------------- */
-/*      Get the X/Y bounds.                                             */
@@ -1584 +1621 @@
-        if( bBigEndian ) SwapWord( 4, &nParts );
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-            SHPDestroyObject(psShape);
-            return NULL;
@@ -1611 +1671 @@
-            psShape->panPartType == NULL)
-        {
-
-
-
-
-
+
+
+
+
-            SHPDestroyObject(psShape);
-            return NULL;
@@ -1630 +1689 @@
-        {
-            if( bBigEndian ) SwapWord( 4, psShape->panPartStart+i );
+
+            /* We check that the offset is inside the vertex array */
+            if (psShape->panPartStart[i] < 0 ||
+                psShape->panPartStart[i] >= psShape->nVertices)
+            {
+                snprintf(pszErrorMsg, 128, "Corrupted .shp file : shape %d : panPartStart[%d] = %d, nVertices = %d",
+                         hEntity, i, psShape->panPartStart[i], psShape->nVertices); 
+                psSHP->sHooks.Error( pszErrorMsg );
+                SHPDestroyObject(psShape);
+                return NULL;
+            }
+            if (i > 0 && psShape->panPartStart[i] <= psShape->panPartStart[i-1])
+            {
+                snprintf(pszErrorMsg, 128, "Corrupted .shp file : shape %d : panPartStart[%d] = %d, panPartStart[%d] = %d",
+                         hEntity, i, psShape->panPartStart[i], i - 1, psShape->panPartStart[i - 1]); 
+                psSHP->sHooks.Error( pszErrorMsg );
+                SHPDestroyObject(psShape);
+                return NULL;
+            }
-        }
-
@@ -1696 +1774 @@
-/*      (options), and the M shapes.                                    */
-/* -------------------------------------------------------------------- */
-psSHP->panRecSize[hEntity]+8
+nEntitySize
-        {
-            memcpy( &(psShape->dfMMin), psSHP->pabyRec + nOffset, 8 );
@@ -1724 +1802 @@
-        int             i, nOffset;
-
+        if ( 44 + 4 > nEntitySize )
+        {
+            snprintf(pszErrorMsg, 128, "Corrupted .shp file : shape %d : nEntitySize = %d",
+                     hEntity, nEntitySize); 
+            psSHP->sHooks.Error( pszErrorMsg );
+            SHPDestroyObject(psShape);
+            return NULL;
+        }
-        memcpy( &nPoints, psSHP->pabyRec + 44, 4 );
+
-        if( bBigEndian ) SwapWord( 4, &nPoints );
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-            SHPDestroyObject(psShape);
-            return NULL;
@@ -1748 +1848 @@
-            psShape->padfM == NULL)
-        {
-
-
-
-
-
+
+
+
+
-            SHPDestroyObject(psShape);
-            return NULL;
@@ -1808 +1907 @@
-/*      (options), and the M shapes.                                    */
-/* -------------------------------------------------------------------- */
-psSHP->panRecSize[hEntity]+8
+nEntitySize
-        {
-            memcpy( &(psShape->dfMMin), psSHP->pabyRec + nOffset, 8 );
@@ -1841 +1940 @@
-        psShape->padfM = (double *) calloc(1,sizeof(double));
-
+        if (20 + 8 + (( psShape->nSHPType == SHPT_POINTZ ) ? 8 : 0)> nEntitySize)
+        {
+            snprintf(pszErrorMsg, 128, "Corrupted .shp file : shape %d : nEntitySize = %d",
+                     hEntity, nEntitySize); 
+            psSHP->sHooks.Error( pszErrorMsg );
+            SHPDestroyObject(psShape);
+            return NULL;
+        }
-        memcpy( psShape->padfX, psSHP->pabyRec + 12, 8 );
-        memcpy( psShape->padfY, psSHP->pabyRec + 20, 8 );
@@ -1867 +1974 @@
-/*      (options), and the M shapes.                                    */
-/* -------------------------------------------------------------------- */
-psSHP->panRecSize[hEntity]+8
+nEntitySize
-        {
-            memcpy( psShape->padfM, psSHP->pabyRec + nOffset, 8 );
@@ -2093 +2200 @@
-                    * Test if edge-ray intersection is on the right from the test point (dfTestY,dfTestY)
-                    */
-float
+double
-                        ( psObject->padfX[iEdge+nVertStart]
-                          + ( dfTestY - psObject->padfY[iEdge+nVertStart] )