"free(): invalid next size" in mapfile.c:5492

[scaligo]

Due to an incorrect malloc() for tmpstr, mapserv 5.6.5 aborts when free()ing data in mapfile.c:5492

tmpstr should be initialized as "strlen(defaultkey) - 5" rather than "strlen(defaultkey) - 8", as a % is prepended and appended to the string.

function: msApplyDefaultSubstitutions

char *tmpstr = (char *)malloc(sizeof(char)*(strlen(defaultkey)-5));

[aboudreault]

Fixed and committed in trunk in r10730 and in branch 5.6 in r10731.

Thanks scaligo for the report!