Ticket #2988 (closed defect: fixed)
Check error returns from mapstring functions.
|Reported by:||russellmcormond||Owned by:||pramsey|
|Component:||MapServer C Library||Version:||5.4|
|Cc:||dmorissette, hobu, sdlime|
Most of the string functions in mapstring.c return either a malloc'd string (possibly via strdup()) or a NULL if there was an error. Unfortunately, not all usage of these strings checks for the NULL return, and there are cases where this NULL is used as a string. Using NULL as a string will cause a core dump.
There is a configuration problem with older versions of the gd graphics library which will incorrectly enable a stub for iconv_open() which always returns (-1) http://cvs.php.net/viewvc.cgi/gd/libgd/src/gdkanji.c?view=markup#l27 . This means that any mapstring function that tries to convert character encoding will return NULL.
I experienced this in the context of data stored in ArcSDE which is encoded in Unicode and thus uses msConvertWideStringToUTF8(). We then tried to use an EXPRESSION in the mapfile. When msEvalExpression() tried to manipulate the NULL via strdup() the mapserver would core dump.
I simulated the error by editing the function msConvertWideStringToUTF8 and changing the line that opens iconv to:
cd = (iconv_t)-1; /* iconv_open("UTF-8", encoding) */
I then compiled (with debug symbols enabled), and ran shp2img within gdb.
(gdb) run -m /data/ndevl18/apps/basemap/map/basemap_wms_en.map -o /home/russell/Desktop/out.png Starting program: /server/downloads/src/mapserver-5.2.2/shp2img -m /data/ndevl18/apps/basemap/map/basemap_wms_en.map -o /home/russell/Desktop/out.png [Thread debugging using libthread_db enabled] [New Thread 0xb7f066e0 (LWP 5252)] Program received signal SIGSEGV, Segmentation fault. 0x01568993 in strlen () from /server/ndevl18/apache-2.2.9/lib/libc.so.6 (gdb) backtrace #0 0x01568993 in strlen () from /server/ndevl18/apache-2.2.9/lib/libc.so.6 #1 0x015686d5 in strdup () from /server/ndevl18/apache-2.2.9/lib/libc.so.6 #2 0x08064244 in msEvalExpression (expression=0x0, itemindex=1, items=0x9742940, numitems=3) at maputil.c:367 #3 0x08064543 in msShapeGetClass (layer=0x964bf48, shape=0xbf960ba8, scaledenom=29968673.278235532, classgroup=0x0, numclasses=0) at maputil.c:518 #4 0x08077d14 in msDrawVectorLayer (map=0x9636aa8, layer=0x964bf48, image=0x9678720) at mapdraw.c:881 #5 0x08078243 in msDrawLayer (map=0x9636aa8, layer=0x964bf48, image=0x9678720) at mapdraw.c:738 #6 0x0807922b in msDrawMap (map=0x9636aa8, querymap=0) at mapdraw.c:441 #7 0x08052286 in main (argc=5, argv=0xbf960e94) at shp2img.c:295 (gdb)
We would never see the msSetError() message as the system would core dump before being able to flush the error message to the log. We need to ensure that whenever error conditions are detected that mapserver will fail gracefully and allow the user to fix what caused the error condition.