#2510 closed defect (fixed)
[PATCH] Fix crashes on corrupted geometries in shapefiles
| Reported by: | rouault | Owned by: | sdlime |
|---|---|---|---|
| Priority: | normal | Milestone: | 5.2 release |
| Component: | MapServer C Library | Version: | svn-trunk (development) |
| Severity: | normal | Keywords: | shapelib |
| Cc: | warmerdam |
Description
This is a clone of a GDAL bug : http://trac.osgeo.org/gdal/ticket/2218.
The attached patch adds checks to msSHPReadPoint and msSHPReadShape so that hostile/corrupted geometries in a shape entity don't cause shapelib to read memory outside of the declared entity size and pabyRec buffer.
I've attached too a zip file containing a few volontary corrupted shapefiles to demonstrate the crashes (or Valgrind errors) and the fix.
Too bad that mapserver doesn't use shapelib 1.2... It duplicates the effort of merging fixes.
Attachments (2)
Change History (9)
comment:1 by , 16 years ago
| Cc: | added |
|---|---|
| Status: | new → assigned |
comment:2 by , 16 years ago
It shouldn't have too much performance side-effects, as it doesn't change fundamentaly the way shapes are read. However it adds several 'if' for each read, but I don't expect them to be significant in comparison to I/O time.
comment:3 by , 16 years ago
Enclosed a zip file containing a few small good and a few bad simple shapefiles (cf GDAL bug) and a mapfile.
Should crash shp2img on a non-patched mapserver :
./shp2img -m map_test.map -l "goodpoint badpoint goodline badline goodpoly badpoly badpoly2" > test.png
by , 16 years ago
| Attachment: | mapserver_svn_trunk_test2218.zip added |
|---|
Mapfile and shapefiles demonstrating the bug and the fix
by , 16 years ago
| Attachment: | mapserver_svn_trunk_mapshape_fix_crash_on_buggy_shapes.patch added |
|---|
comment:4 by , 16 years ago
I've also updated the patch with a few missing checks in msSHPOpen that have been integreated into shapelib 1.2 some time ago.
comment:6 by , 16 years ago
| Resolution: | → fixed |
|---|---|
| Status: | assigned → closed |
Patch applied in r7383. Closing...
Steve
comment:7 by , 16 years ago
| Milestone: | → 5.2 release |
|---|
Thanks for the patch! Are there any performance side-effects? Cc'ing Frank for comment...
Steve