[mapserver-dev] SEGV in current trunk in labelcache code

[Stephen Woodbridge]

This is based on the current trunk
https://github.com/mapserver/mapserver/issues/4291

woodbri at mappy:/u/data/tiger2011-maps$ gdb /usr/local/bin/mapserv 
         GNU gdb 6.8-debian
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later 
<http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu"...
(gdb) run 
QUERY_STRING='MAP=%2Fu%2Fdata%2Ftiger2011-maps%2Ftiger2011-tmp.map&FORMAT=image%2Fpng&MAP_IMAGETYPE=agg_qn&LAYERS=Tiger_2011&SERVICE=WMS&VERSION=1.1.1&REQUEST=GetMap&STYLES=&EXCEPTIONS=application%2Fvnd.ogc.se_inimage&SRS=EPSG%3A900913&BBOX=-10719843.620153,4810106.3951652,-10505819.946325,4978267.853173&WIDTH=700&HEIGHT=550' 
 > junk.png
Starting program: /usr/local/bin/mapserv 
QUERY_STRING='MAP=%2Fu%2Fdata%2Ftiger2011-maps%2Ftiger2011-tmp.map&FORMAT=image%2Fpng&MAP_IMAGETYPE=agg_qn&LAYERS=Tiger_2011&SERVICE=WMS&VERSION=1.1.1&REQUEST=GetMap&STYLES=&EXCEPTIONS=application%2Fvnd.ogc.se_inimage&SRS=EPSG%3A900913&BBOX=-10719843.620153,4810106.3951652,-10505819.946325,4978267.853173&WIDTH=700&HEIGHT=550' 
 > junk.png
[Thread debugging using libthread_db enabled]
warning: Lowest section in /usr/lib/libicudata.so.38 is .hash at 
0000000000000120
[Wed Apr 25 00:30:51 2012].192857 msDrawMap(): rendering using 
outputformat named agg_qn (AGG/PNG).
[Wed Apr 25 00:30:51 2012].193166 msDrawMap(): WMS/WFS set-up and query, 
0.000s
[Wed Apr 25 00:30:51 2012].232325 msDrawMap(): Layer 2 (World Z2), 0.039s
[Wed Apr 25 00:30:51 2012].233399 msDrawMap(): Layer 3 (Forest), 0.001s
[Wed Apr 25 00:30:51 2012].233974 msDrawMap(): Layer 6 (Lakes Z2), 0.001s
[Wed Apr 25 00:30:51 2012].234541 msDrawMap(): Layer 7 (World Boundaries 
Z1), 0.001s
[Wed Apr 25 00:30:51 2012].359758 msDrawMap(): Layer 17 (state), 0.125s
[Wed Apr 25 00:30:51 2012].393748 msDrawMap(): Layer 19 (place), 0.034s
[Wed Apr 25 00:30:51 2012].423610 msDrawMap(): Layer 21 
(area_landmarks), 0.030s
[Wed Apr 25 00:30:51 2012].424556 msDrawMap(): Layer 22 (military), 0.001s
[Wed Apr 25 00:30:51 2012].438649 msDrawMap(): Layer 23 
(area_water_far), 0.014s
[Wed Apr 25 00:30:51 2012].536266 msDrawMap(): Layer 27 (pri_sec_roads), 
0.098s
[Wed Apr 25 00:30:51 2012].536364 msDrawLabelCache(): 
labelcache_map_edge_buffer = 10
[New Thread 0x7f2dedd4b710 (LWP 20510)]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7f2dedd4b710 (LWP 20510)]
0x00007f2de52dfaf2 in strcmp () from /lib/libc.so.6
(gdb) bt
#0  0x00007f2de52dfaf2 in strcmp () from /lib/libc.so.6
#1  0x00007f2ded96dd0c in msTestLabelCacheCollisions (map=0x1930c50,
     cachePtr=0x1add7b0, poly=0x7fff7603cd50, mindistance=100,
     current_priority=6, current_label=153) at maplabel.c:804
#2  0x00007f2ded9c3413 in msDrawLabelCache (image=0x1938450, map=0x1930c50)
     at mapdraw.c:3086
#3  0x00007f2ded9b6369 in msDrawMap (map=0x1930c50, querymap=0)
     at mapdraw.c:494
#4  0x00007f2ded9a5516 in msWMSGetMap (map=0x1930c50, nVersion=65793,
     names=0x192f940, values=0x192fc70, numentries=13,
     wms_exception_format=0x1930980 "application/vnd.ogc.se_inimage",
     ows_request=0x7fff7603d390) at mapwms.c:4024
#5  0x00007f2ded9aa082 in msWMSDispatch (map=0x1930c50, req=0x192f900,
     ows_request=0x7fff7603d390, force_wms_mode=0) at mapwms.c:5443
#6  0x00007f2ded9e68fe in msOWSDispatch (map=0x1930c50, request=0x192f900,
     ows_mode=-1) at mapows.c:275
#7  0x00007f2deda4a69a in msCGIDispatchRequest (mapserv=0x192f6c0)
     at mapservutil.c:1631
#8  0x0000000000401320 in main (argc=2, argv=0x7fff7603d568) at 
mapserv.c:200
(gdb) up
#1  0x00007f2ded96dd0c in msTestLabelCacheCollisions (map=0x1930c50,
     cachePtr=0x1add7b0, poly=0x7fff7603cd50, mindistance=100,
     current_priority=6, current_label=153) at maplabel.c:804
804             if(mindistance >0  &&
(gdb) l
799             ** value between the labels and not only from point to 
point.
800             **
801             ** Note 2: We only check the first label (could be 
multiples (RFC 77)) since that is *by far* the most common
802             ** use case. Could change in the future but it's not 
worth the overhead at this point.
803             */
804             if(mindistance >0  &&
805               (cachePtr->layerindex == curCachePtr->layerindex) &&
806               (cachePtr->classindex == curCachePtr->classindex) &&
807               (strcmp(cachePtr->labels[0].annotext, 
curCachePtr->labels[0].annotext) == 0) &&
808               (msDistancePointToPoint(&(cachePtr->point), 
&(curCachePtr->point)) <= (mindistance + label_width))) { /* label is a 
duplicate */
(gdb) p curCachePtr->labels[0].annotext
$1 = 0x0
(gdb) p cachePtr->labels[0].annotext
$2 = 0x1acb760 "159"
(gdb)