[mapserver-commits] [MapServer/MapServer] e5b433: mappool.c: only raise connectionMax after a succes...

[github-actions[bot]]

  Branch: refs/heads/branch-8-6
  Home:   https://github.com/MapServer/MapServer
  Commit: e5b4335b84ad59591d921c164383d0388c82039e
      https://github.com/MapServer/MapServer/commit/e5b4335b84ad59591d921c164383d0388c82039e
  Author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
  Date:   2026-08-31 (Mon, 31 Aug 2026)

  Changed paths:
    M src/mappool.c

  Log Message:
  -----------
  mappool.c: only raise connectionMax after a successful realloc (fixes #7614) (#7634)

msConnPoolRegister() incremented connectionMax before the realloc() that
was meant to deliver the new capacity, and did not restore it when the
allocation failed. After one failed grow the recorded capacity stayed 10
entries ahead of the real one, and because the guard was an equality test
the growth path never ran again, so the following registrations each wrote
a whole connectionObj past the end of the array.

Move the increment after the successful realloc and make the guard >= so
that a count which has passed the capacity still grows the array.

This completes f4286d624, which stopped a failed realloc from leaking and
from nulling connections, but left the connectionMax desync in place. That
turned what used to be a near-NULL crash into a silent heap overflow.

Co-authored-by: MarkLee131 <kaixuan.li at ntu.edu.sg>



To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications