[postgis-devel] [PostGIS] #1936: gml xml string crashes postgresql server

[PostGIS]

#1936: gml xml string crashes postgresql server
----------------------+-----------------------------------------------------
 Reporter:  fordfrog  |       Owner:  pramsey      
     Type:  defect    |      Status:  new          
 Priority:  high      |   Milestone:  PostGIS 2.0.2
Component:  postgis   |     Version:  2.0.x        
 Keywords:            |  
----------------------+-----------------------------------------------------

Comment(by colivier):

 I didn't noticed this ticket before, sorry for that.



 From Paul's request, a simpler one's able to reproduce this issue:

 SELECT ST_GeomFromGML('
 <gml:Polygon xmlns:gml="http://www.opengis.net/gml/3.2"
 gml:id="HPA.15449990010" srsName="urn:ogc:def:crs:EPSG::2065"
 srsDimension="2">
   <gml:interior>
     <gml:LinearRing>
       <gml:posList>713061.62 1070354.46 713053.59 1070335.12 713049.58
 1070315.92 713049.65 1070298.33 713061.62 1070354.46</gml:posList>
     </gml:LinearRing>
   </gml:interior>
 </gml:Polygon>
 ');



 After a quick code review, this patch should fix this issue,



 Index: lwgeom_in_gml.c
 ===================================================================
 --- lwgeom_in_gml.c     (revision 10251)
 +++ lwgeom_in_gml.c     (working copy)
 @@ -1147,7 +1147,7 @@
                 /* Polygon/exterior        -> GML 3.1.1 */
                 if (xa->type != XML_ELEMENT_NODE) continue;
                 if (!is_gml_namespace(xa, false)) continue;
 -               if  (strcmp((char *) xa->name, "outerBoundaryIs") &&
 +               if  (strcmp((char *) xa->name, "outerBoundaryIs") ||
                         strcmp((char *) xa->name, "exterior")) continue;

                 for (xb = xa->children ; xb != NULL ; xb = xb->next)
 @@ -1174,7 +1174,7 @@
                 /* Polygon/interior        -> GML 3.1.1 */
                 if (xa->type != XML_ELEMENT_NODE) continue;
                 if (!is_gml_namespace(xa, false)) continue;
 -               if  (strcmp((char *) xa->name, "innerBoundaryIs") &&
 +               if  (strcmp((char *) xa->name, "innerBoundaryIs") ||
                         strcmp((char *) xa->name, "interior")) continue;

                 for (xb = xa->children ; xb != NULL ; xb = xb->next)




 I did'nt yet check with unit test to be sure there's no regression
 I could look at it again Sunday evening.

-- 
Ticket URL: <http://trac.osgeo.org/postgis/ticket/1936#comment:6>
PostGIS <http://trac.osgeo.org/postgis/>
The PostGIS Trac is used for bug, enhancement & task tracking, a user and developer wiki, and a view into the subversion code repository of PostGIS project.