Ticket #2332 (closed defect: fixed)

Opened 1 year ago

Last modified 1 year ago

Double free or corruption in msCopyJoin

Reported by: aalbarello Assigned to: sdlime
Priority: normal Milestone: 5.0.1 release
Component: MapServer C Library Version: 5.0
Severity: normal Keywords:
Cc:

Description

I'm getting libc's double free/corruption errors when calling msCopyMap on a map containing joins. This is due to the fact that msCopyLayer doesn't initialize join objects by calling initJoin prior to calling msCopyJoin, which therefore calls msFree through the MS_COPYSTRING macro on uninitialized char pointers of the destination map object.

This can be fixed by adding

initJoin(&(dst->joins[i]));

on line 851 of mapcopy.c

Attachments

mapcopy.diff (430 bytes) - added by aalbarello on 11/02/07 17:17:44.

Change History

11/02/07 17:17:28 changed by aalbarello

  • milestone set to 5.0.1 release.

I'm adding a patch against svn trunk rev 6998 for this one.

Andreas

11/02/07 17:17:44 changed by aalbarello

  • attachment mapcopy.diff added.

11/08/07 00:45:53 changed by sdlime

  • status changed from new to closed.
  • resolution set to fixed.

Applied fix to both the main trunk and the 5.0 branch. Closing...

Thanks for the help!

Steve

11/08/07 05:35:39 changed by aalbarello

Confirming fixed. Thanks, Steve.

Andreas