[mapserver-commits] r8604 - trunk/mapserver

[svn at osgeo.org]

Author: tamas
Date: 2009-02-22 16:38:30 -0500 (Sun, 22 Feb 2009)
New Revision: 8604

Modified:
   trunk/mapserver/maplayer.c
Log:
Take better care of the extra items with the inline layers to prevent from memory corruption (#2870)

Modified: trunk/mapserver/maplayer.c
===================================================================
--- trunk/mapserver/maplayer.c	2009-02-21 21:51:57 UTC (rev 8603)
+++ trunk/mapserver/maplayer.c	2009-02-22 21:38:30 UTC (rev 8604)
@@ -405,14 +405,6 @@
     layer->numitems = 0;
   }
 
-  /* Always retrieve all items in some cases */
-  if (layer->connectiontype == MS_INLINE)
-  {
-     msLayerGetItems(layer);
-     nt = layer->numitems;
-  }
-  else
-  {
   /*
   ** layer level counts
   */
@@ -499,10 +491,20 @@
     }
   }
 
-  rv = layer->vtable->LayerCreateItems(layer, nt);
-  if (rv != MS_SUCCESS) {
-    return rv;
+  /* Always retrieve all items in some cases */
+  if (layer->connectiontype == MS_INLINE)
+  {
+     msLayerGetItems(layer);
+     /* need to realloc the array to accept the possible new items*/
+     if (nt > 0)
+        layer->items = (char **)realloc(layer->items, sizeof(char *)*(layer->numitems + nt));
   }
+  else
+  {
+    rv = layer->vtable->LayerCreateItems(layer, nt);
+    if (rv != MS_SUCCESS) {
+      return rv;
+    }
   }
 
   if(nt > 0) {
@@ -1299,6 +1301,12 @@
         msSetError(MS_SHPERR, "Cannot retrieve inline shape. There some problem with the shape", "msLayerGetShape()");
         return MS_FAILURE;
     }
+    /* check for the expected size of the values array */
+    if (layer->numitems > shape->numvalues) {
+        shape->values = (char **)realloc(shape->values, sizeof(char *)*(layer->numitems));
+        for (i = shape->numvalues; i < layer->numitems; i++)
+            shape->values[i] = strdup("");
+    }
     return MS_SUCCESS;
 }
 
@@ -1313,6 +1321,14 @@
 
     layer->currentfeature = layer->currentfeature->next;
 
+    /* check for the expected size of the values array */
+    if (layer->numitems > shape->numvalues) {
+        int i;
+        shape->values = (char **)realloc(shape->values, sizeof(char *)*(layer->numitems));
+        for (i = shape->numvalues; i < layer->numitems; i++)
+            shape->values[i] = strdup("");
+    }
+
     return(MS_SUCCESS);
 }