[mapserver-commits] r10731 - branches/branch-5-6/mapserver

[svn at osgeo.org]

Author: aboudreault
Date: 2010-11-15 10:49:36 -0800 (Mon, 15 Nov 2010)
New Revision: 10731

Modified:
   branches/branch-5-6/mapserver/HISTORY.TXT
   branches/branch-5-6/mapserver/mapfile.c
Log:
Backport 5.6: Fixed free(): invalid next size in mapfile.c (#3604)

Modified: branches/branch-5-6/mapserver/HISTORY.TXT
===================================================================
--- branches/branch-5-6/mapserver/HISTORY.TXT	2010-11-15 18:48:42 UTC (rev 10730)
+++ branches/branch-5-6/mapserver/HISTORY.TXT	2010-11-15 18:49:36 UTC (rev 10731)
@@ -14,6 +14,8 @@
 Current Version
 ---------------
 
+- Fixed free(): invalid next size in mapfile.c (#3604)
+
 - Fix for the memory corruption when mapping the string data type in the Java bindings (3491)
 
 - Correct wms 1.3.0 latlong bbox error (#2578)

Modified: branches/branch-5-6/mapserver/mapfile.c
===================================================================
--- branches/branch-5-6/mapserver/mapfile.c	2010-11-15 18:48:42 UTC (rev 10730)
+++ branches/branch-5-6/mapserver/mapfile.c	2010-11-15 18:49:36 UTC (rev 10731)
@@ -5485,7 +5485,7 @@
     const char *defaultkey = msFirstKeyFromHashTable(&(layer->metadata));
     while(defaultkey) {
       if(!strncmp(defaultkey,"default_",8)){
-        char *tmpstr = (char *)malloc(sizeof(char)*(strlen(defaultkey)-8));
+        char *tmpstr = (char *)malloc(sizeof(char)*(strlen(defaultkey)-5));
         sprintf(tmpstr,"%%%s%%", &(defaultkey[8]));
 
         msLayerSubstituteString(layer,tmpstr,msLookupHashTable(&(layer->metadata),defaultkey));