[mapguide-commits] r9019 - sandbox/adsk/3.1n/Common/Renderers

[svn_mapguide at osgeo.org]

Author: christinebao
Date: 2016-08-09 23:40:17 -0700 (Tue, 09 Aug 2016)
New Revision: 9019

Modified:
   sandbox/adsk/3.1n/Common/Renderers/AGGRenderer.cpp
Log:
#2736: Server crash when layer contains complicate symbols https://trac.osgeo.org/mapguide/ticket/2736

It is a heap corruption defect. The issue is at line 1792~1814, Common\Renderers\AGGRenderer.cpp. There are minx and maxx which are double. Then we convert them to int. But in some special cases, the converted imaxx will be less than iminx. It results in some memory are corrupted in next operations. To fix the issue, we need to add a check for the values.

Modified: sandbox/adsk/3.1n/Common/Renderers/AGGRenderer.cpp
===================================================================
--- sandbox/adsk/3.1n/Common/Renderers/AGGRenderer.cpp	2016-08-10 05:38:41 UTC (rev 9018)
+++ sandbox/adsk/3.1n/Common/Renderers/AGGRenderer.cpp	2016-08-10 06:40:17 UTC (rev 9019)
@@ -1807,8 +1807,11 @@
         agg::gray8 cc(0);
 
         unsigned width = (int)imaxx - (int)iminx + 1;
-        for (int y=iminy; y<=imaxy; ++y)
-            c()->mask_pixf->copy_hline(iminx, y, width, cc);
+        if (width > 0)
+        {
+            for (int y = iminy; y <= imaxy; ++y)
+                c()->mask_pixf->copy_hline(iminx, y, width, cc);
+        }
 
         // render the alpha mask polygon
         c()->mask_ren.color(agg::gray8(255));