GD 2.0.26 makes Mapserver 4.2.0 crash on symbolrendering

[havard.tveite@…]

I have tested the newest GD release (GD 2.0.26) with Mapserver
4.2.0, and have experienced occational Mapserver crashes due
to symbol problems.
I have managed to track down the following:
When my "lrtriangle" symbol (shown below) is placed such that
it intersects the right edge of the rendered map (a part of the
triangle is inside and a part is outside), Mapserver crashes
("Internal Server Error" - and in the Apache error log:
"Premature end of script headers: mapserv_4.2").

Switching to the GD 2.0.25 library there is no crash.

Here is the problematic symbol:

SYMBOL
  NAME "lrtriangle"
  TYPE vector
  FILLED true
  POINTS
    0 1
    1 1
    1 0
    0 1
  END
END

With a box symbol like the one below, map edge intersection does not
seem to be a problem.

SYMBOL
  NAME "box"
  TYPE vector
  FILLED true
  POINTS
    0 0
    1 0
    1 1
    0 1
    0 0
  END
END

mapserv_4.2 -v:
MapServer version 4.2.0 OUTPUT=PNG OUTPUT=JPEG OUTPUT=WBMP OUTPUT=PDF
SUPPORTS=PROJ SUPPORTS=FREETYPE SUPPORTS=WMS_SERVER SUPPORTS=WMS_CLIENT
SUPPORTS=WFS_SERVER SUPPORTS=WFS_CLIENT INPUT=EPPL7 INPUT=SDE INPUT=POSTGIS
INPUT=OGR INPUT=GDAL INPUT=SHAPEFILE
Platform Solaris 2.7

I include the complete contents of a mapfile containing a
filled vector symbol that will crash my Mapserver 4.2.0 with
GD 2.0.26 when rendered on the right edge of the map:

MAP
   SIZE 100 100
   EXTENT 0 0 100 100
   WEB
     IMAGEPATH "/WWW/tmp/"
     IMAGEURL "/tmp/"
     TEMPLATE test.html
   END #web

   SYMBOL
     NAME "lrtriangle"
     TYPE vector
     FILLED true   # false is OK
     POINTS
       0 1
       1 1
       1 0
       0 1
     END
   END #symbol

   LAYER # test
     NAME test
     STATUS DEFAULT
     TYPE POINT
     FEATURE
       POINTS
         98 50  # X-values <= 96 are OK. For X=97, y-values >= 93 makes it work.
For X=98, y-values >= 94 makes it work. For X=99, Y-values >= 95 makes it work.
For X=100, y-values >= 96 makes it work. When the triangle extends over the
image border, a vertical line shows up above the triangle (to the full height of
the triangle - 15 points)
       END #POINTS
     END #Feature
     CLASS
       STYLE
         COLOR 255 0 0
         SYMBOL "lrtriangle"
         SIZE 14
       END # style
     END # CLASS
   END # LAYER test
END # Map file

--
Håvard Tveite

[sdlime]

What values makes it crash? I can generate the strange vertical line, but not a
segfault. The problem doesn't exist with 2.0.21. Interestingly, I can create a
similar issue with 2.0.26 and 2.0.21 on the MAXY axis with a different triangle
symbol. Difference is that the line extends horizontally.

I'm inclined to say that this is not a MapServer error per se. Interested in
helping recreate it in just GD? I'm guessing it's an error in
gdImageFilledPolygon, perhaps with clipping. I'll check the history at the
Boutell site.

Recreating in GD only code would really isolate it.

Steve

[havard.tveite@…]

"What values makes it crash?"
I guess you are refering to the POINT values in the LAYER.
All values except the ones where I have explicitly stated that it works makes it
crash.
That is, with this mapfile, my Mapserver crashes for X == 97 && Y < 93, X == 98
&& Y < 94, X == 99 && Y < 95, X == 100 && Y < 96.

I would also think that it has something to do with clipping, but someone with
more knowledge than me on how rendering is "shared/distributed" between
Mapserver and GD is better equipped to dig further into this.

Håvard Tveite

[sdlime]

Ok, I get goofy output, but no crashes on the Mac. Go figure.

For symbol drawing MapServer relies totally on GD, so I think it's clear 
there's a problem in GD. I know there were some line drawing optimizations 
introduced in 2.0.26. I'll write a test program in pure GD that plops a 
triangle on the right edge and see if the problem presists. If so then that can 
go to the GD developers...

Steve 

[sdlime]

Havard: I see there is a 2.0.27 out. Have you tried it?

Steve

[havard.tveite@…]

I have tried 2.0.27.
No crashes now, hence the severity of the bug is reduced considerably.
BUT: The vertical line is still there.
"When the triangle extends over the mage border, a vertical line shows up above
the triangle (to the full height of the triangle)"

Håvard Tveite

[sdlime]

Cool, will drum up a test program based on 2.0.27 and warn people against using 
2.0.26...

Steve

[hobu]

Looks like this issue is now gone. Closing...