Segmentation fault in msSplitData in maporaclespatial.c

[aalbarello]

data_version is defined as char[3] in function msSplitData on line 284 of maporaclespatial.c (as of svn-trunk revision 7504), although on lines 424 through 429 up to 4 bytes are copied into the string (e.g. "VERSION 10g" in the DATA definition leads to "10g" plus the final null character being written to the buffer). This can cause segmentation faults, and particularly so on Linux, most likely due to the different memory alignment. Defining data_version as char[4] solves the problem.

Adding some length checks to avoid similar buffer overflows in msSplitData, at least as far as data_version and tok_function is concerned, wouldn't hurt anyways.

[aalbarello]

I hope this can be fixed in time for Mapserver 5.2. CC'ing Steve as the fix is trivial and I haven't yet heard from the Oracle Spatial maintainer.

Andreas

[aalbarello]

Attaching a patch against r7680.

[sdlime]

Fixed in r7699.

Steve