Opened 11 years ago

Closed 11 years ago

#4975 closed defect (fixed)

Crash when reading CityGML file with GML driver

Reported by: Kosta Owned by: warmerdam
Priority: high Milestone: 1.9.3
Component: OGR_SF Version: 1.9.2
Severity: major Keywords:
Cc:

Description (last modified by Kosta)

When opening the following unzipped file (e.g. using ogrinfo) the GML driver is crashing: https://dl.dropbox.com/u/1510901/Test-CityGml-LandXplorer.gml.zip

Change History (7)

comment:1 by Kosta, 11 years ago

Description: modified (diff)

comment:2 by Kosta, 11 years ago

A simple fix would be to change line 125 of gmlpropertydefn.cpp from:

if( *pszValue == '\0' )

to

if( !pszValue
!*pszValue )

in order to avoid a NULL pointer access in cases pszValue is NULL.

Not sure, if this is the right fix or if there is another issue and (pszValue == NULL) should never happen there...

in reply to:  2 comment:3 by Kosta, 11 years ago

if( !pszValue !*pszValue )

There needs to be an "OR" in between which gets eaten from the WIKI, not sure how to format that in the correct way...

comment:4 by Kosta, 11 years ago

After applying the suggested fix another crash happens, when starting to access the individual features of that file. This time due to a NULL pointer access in line 1944 of file ogrfeature.cpp.

I would suggest to add these lines at line 1935 in that file:

    if( !pszValue )
    {
        UnsetField( iField );
        return;
    }    

comment:5 by Kosta, 11 years ago

I created a GitHub pull request for my proposed changes...

comment:6 by Even Rouault, 11 years ago

I wouldn't fix the bug like that. IMHO, SetFeature() should never been passed a NULL pointer, so some tracking would be needed to identify which caller tries to patch the NULL pointer.

comment:7 by Even Rouault, 11 years ago

Milestone: 1.10.01.9.3
Resolution: fixed
Status: newclosed

Fixed in trunk (r25579) and branches/1.9 (r25580)

Note: See TracTickets for help on using tickets.