[mapserver-commits] [MapServer/MapServer] 392839: mappool.c: only raise connectionMax after a succes...

[Kaixuan Li]

  Branch: refs/heads/main
  Home:   https://github.com/MapServer/MapServer
  Commit: 3928395086567ad9e0b222cad835c8c94683d0c4
      https://github.com/MapServer/MapServer/commit/3928395086567ad9e0b222cad835c8c94683d0c4
  Author: Kaixuan Li <kaixuan.li at ntu.edu.sg>
  Date:   2026-08-31 (Mon, 31 Aug 2026)

  Changed paths:
    M src/mappool.c

  Log Message:
  -----------
  mappool.c: only raise connectionMax after a successful realloc (fixes #7614) (#7616)

msConnPoolRegister() incremented connectionMax before the realloc() that
was meant to deliver the new capacity, and did not restore it when the
allocation failed. After one failed grow the recorded capacity stayed 10
entries ahead of the real one, and because the guard was an equality test
the growth path never ran again, so the following registrations each wrote
a whole connectionObj past the end of the array.

Move the increment after the successful realloc and make the guard >= so
that a count which has passed the capacity still grows the array.

This completes f4286d624, which stopped a failed realloc from leaking and
from nulling connections, but left the connectionMax desync in place. That
turned what used to be a near-NULL crash into a silent heap overflow.



To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications