[mapserver-commits] r11603 - branches/branch-5-6/mapserver

[svn at osgeo.org]

Author: aboudreault
Date: 2011-04-19 07:58:02 -0700 (Tue, 19 Apr 2011)
New Revision: 11603

Modified:
   branches/branch-5-6/mapserver/HISTORY.TXT
   branches/branch-5-6/mapserver/mapdraw.c
   branches/branch-5-6/mapserver/mapserver.h
Log:
Fixed segmentation fault on invalid symbol (#3849)

Modified: branches/branch-5-6/mapserver/HISTORY.TXT
===================================================================
--- branches/branch-5-6/mapserver/HISTORY.TXT	2011-04-19 10:47:15 UTC (rev 11602)
+++ branches/branch-5-6/mapserver/HISTORY.TXT	2011-04-19 14:58:02 UTC (rev 11603)
@@ -14,6 +14,8 @@
 Version 5.6.7 (SVN branch-5-6):
 ---------------------------
 
+- Fixed segmentation fault on invalid symbol (#3849)
+
 - add support for gml:Box for spatial filters (#3789)
 
 - Fixed false computation of symbol size when used as a brush on line (#3760)

Modified: branches/branch-5-6/mapserver/mapdraw.c
===================================================================
--- branches/branch-5-6/mapserver/mapdraw.c	2011-04-19 10:47:15 UTC (rev 11602)
+++ branches/branch-5-6/mapserver/mapdraw.c	2011-04-19 14:58:02 UTC (rev 11603)
@@ -1492,6 +1492,11 @@
    * do not enter the image */
   if(layer->class[c]->numstyles > 0 && layer->class[c]->styles[0] != NULL) {
       double maxsize,maxunscaledsize;
+      styleObj *style = layer->class[c]->styles[0];
+      if (!MS_IS_VALID_ARRAY_INDEX(style->symbol, map->symbolset.numsymbols)) {
+          msSetError(MS_SYMERR, "Invalid symbol index: %d", "msDrawShape()", style->symbol);
+          return MS_FAILURE;
+      }
       maxsize = MS_MAX(
           msSymbolGetDefaultSize(map->symbolset.symbol[layer->class[c]->styles[0]->symbol]),
           MS_MAX(layer->class[c]->styles[0]->size,layer->class[c]->styles[0]->width)

Modified: branches/branch-5-6/mapserver/mapserver.h
===================================================================
--- branches/branch-5-6/mapserver/mapserver.h	2011-04-19 10:47:15 UTC (rev 11602)
+++ branches/branch-5-6/mapserver/mapserver.h	2011-04-19 14:58:02 UTC (rev 11603)
@@ -373,6 +373,8 @@
 #define MS_REFCNT_DECR_IS_NOT_ZERO(obj) (MS_REFCNT_DECR(obj))>0
 #define MS_REFCNT_DECR_IS_ZERO(obj) (MS_REFCNT_DECR(obj))<=0
 
+#define MS_IS_VALID_ARRAY_INDEX(index, size) ((index<0 || index>=size)?MS_FALSE:MS_TRUE)
+
 #endif
 
 /* General enumerated types - needed by scripts */