Seg Fault with HMTL legend in processIcon

[dmorissette]

In ticket #1946, jparapar wrote:

We have compiled beta 3 and tested it and we have found a new issue, not related to the size of the output html file but related to legend icons of raster layers. I attach (test2.zip) a new test case. If [leg_icon] is dropped from the legend template it works. Here is the valgrind output:

# valgrind ./mapserv5b3 QUERY_STRING='map=/tmp/test2/test2.map&mode=legend&mapext=458350+4613016+704030+4858696&mapsize=350+350&layers=ortofoto'
==22621== Memcheck, a memory error detector.
==22621== Copyright (C) 2002-2006, and GNU GPL'd, by Julian Seward et al.
==22621== Using LibVEX rev 1658, a library for dynamic binary translation.
==22621== Copyright (C) 2004-2006, and GNU GPL'd, by OpenWorks LLP.
==22621== Using valgrind-3.2.1-Debian, a dynamic binary instrumentation
framework.
==22621== Copyright (C) 2000-2006, and GNU GPL'd, by Julian Seward et al.
==22621== For more details, rerun with: -v
==22621==
==22621== Invalid read of size 4
==22621==    at 0x80578A5: processIcon (maptemplate.c:1276)
==22621==    by 0x8058584: generateLayerTemplate (maptemplate.c:1691)
==22621==    by 0x8059636: generateLegendTemplate (maptemplate.c:2111)
==22621==    by 0x8053536: main (mapserv.c:1344)
==22621==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
==22621==
==22621== Process terminating with default action of signal 11 (SIGSEGV)
==22621==  Access not within mapped region at address 0x0
==22621==    at 0x80578A5: processIcon (maptemplate.c:1276)
==22621==    by 0x8058584: generateLayerTemplate (maptemplate.c:1691)
==22621==    by 0x8059636: generateLegendTemplate (maptemplate.c:2111)
==22621==    by 0x8053536: main (mapserv.c:1344)
==22621==
==22621== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 113 from 1)
==22621== malloc/free: in use at exit: 104,657 bytes in 833 blocks.
==22621== malloc/free: 1,855 allocs, 1,022 frees, 157,440 bytes allocated.
==22621== For counts of detected errors, rerun with: -v
==22621== searching for pointers to 833 not-freed blocks.
==22621== checked 2,943,060 bytes.
==22621==
==22621== LEAK SUMMARY:
==22621==    definitely lost: 0 bytes in 0 blocks.
==22621==      possibly lost: 1,411 bytes in 70 blocks.
==22621==    still reachable: 103,246 bytes in 763 blocks.
==22621==         suppressed: 0 bytes in 0 blocks.
==22621== Reachable blocks (those to which a pointer was found) are not
shown.
==22621== To see them, rerun with: --show-reachable=yes
Violación de segmento



#./mapserv5b3 -v
MapServer version 5.0.0-beta3 OUTPUT=GIF OUTPUT=PNG OUTPUT=JPEG
OUTPUT=WBMP OUTPUT=SVG SUPPORTS=PROJ SUPPORTS=FREETYPE
SUPPORTS=WMS_SERVER SUPPORTS=WMS_CLIENT SUPPORTS=WFS_SERVER
SUPPORTS=WFS_CLIENT SUPPORTS=THREADS INPUT=EPPL7 INPUT=POSTGIS INPUT=OGR
INPUT=GDAL INPUT=SHAPEFILE

Thanks again Jorge

Link to test2.zip: ​http://trac.osgeo.org/mapserver/attachment/ticket/1946/test2.zip

[dmorissette]

I am able to reproduce the seg fault with the test2.zip test case. Working on this now.

[dmorissette]

Fixed in r6583 (will be in 5.0.0-beta4).

The HTML legend generation code was not properly handling the possibility of layers with 0 classes. This may have been introduced by the work on RFC-24 or RFC-17.