Double free or corruption in msCopyJoin

[aalbarello]

I'm getting libc's double free/corruption errors when calling msCopyMap on a map containing joins. This is due to the fact that msCopyLayer doesn't initialize join objects by calling initJoin prior to calling msCopyJoin, which therefore calls msFree through the MS_COPYSTRING macro on uninitialized char pointers of the destination map object.

This can be fixed by adding

initJoin(&(dst->joins[i]));

on line 851 of mapcopy.c

[aalbarello]

I'm adding a patch against svn trunk rev 6998 for this one.

Andreas

[sdlime]

Applied fix to both the main trunk and the 5.0 branch. Closing...

Thanks for the help!

Steve

[aalbarello]

Confirming fixed. Thanks, Steve.

Andreas