HFA Driver: Few places caused access violation due to null strings

[jefflacoste]

In 'hfaopen.cpp': Following lines use 'poPro->proName', 'poPro->proSpheroid.sphereName' and 'poPro->proExeName' and if any of them happen to be null, this cause an access violation and a crash.

1450	        nSize = 34 + 15 * 8
1451	            + 8 + strlen(poPro->proName) + 1
1452	            + 32 + 8 + strlen(poPro->proSpheroid.sphereName) + 1;
1453	
1454	        if( poPro->proExeName != NULL )
1455	            nSize += strlen(poPro->proExeName) + 1;
1456	
Also:
1600	        nSize = 26 + strlen(poDatum->datumname) + 1 + 7*8;

I run into this while converting some .bt (binary terrain) to Erdas Imagine format.

1450	        nSize = 34 + 15 * 8
1451	            + 8 + strlen(poPro->proName) + 1
1452	            + 32 + 8 + strlen(poPro->proSpheroid.sphereName) + 1;
1453	
1454	        if( poPro->proExeName != NULL )
1455	            nSize += strlen(poPro->proExeName) + 1;
1456

A simple fix would be to initialize the length to 0 and update it the string in question is not not null with the real length.

Also in 'hfaentry.cpp':

We are setting the string and if it happens to be null, SetFieldValue would cause a crash:

901	CPLErr HFAEntry::SetStringField( const char * pszFieldPath, 
902	                                 const char * pszValue )
903	
904	{
905	    return SetFieldValue( pszFieldPath, 's', (void *) pszValue );
906	}

Thanks

[Even Rouault]

Can you submit your proposed corrections as a patch ? It would also be good if you could provide a way (data + command line) to reproduce the issue.

[Even Rouault]

Fixed in trunk (r26539) and branches/1.10 (r26540)