[PATCH] Crash on line 157 of pj_initcache.c when insert cache grows

[jacobsen]

On the 16th unique entry into the insert cache, it will need to be resized by pj_insert_cache() which has the source and destination arguments to memcpy reversed on line 157 of pj_initcache.c in the current trunk. This problem also exists in 4.7.0 where I found it during internal testing. The code is:

memcpy( cache_key, cache_key_new, sizeof(char*) * cache_count);

but we are actually trying to copy the contents of cache_key into cache_key_new so the code should be:

memcpy( cache_key_new, cache_key, sizeof(char*) * cache_count);

So, the correct code in context would be:

/*

** Grow list if required. */ if( cache_count == cache_alloc ) {

char **cache_key_new; paralist **cache_paralist_new;

cache_alloc = cache_alloc * 2 + 15;

cache_key_new = (char **) pj_malloc(sizeof(char*) * cache_alloc); memcpy( cache_key_new, cache_key, sizeof(char*) * cache_count); pj_dalloc( cache_key ); cache_key = cache_key_new;

Please do not hesitate to contact me with any questions.

Cordially,

Erik

[rouault]

Looks quite reasonnable ! I have attached a patch with the proposed fix.

[rouault]

Has been fixed by ticket #100