[postgis-tickets] r14475 - #3389, buffer overflow in lwgeom_to_geojson

[Daniel Baston]

Author: dbaston
Date: 2015-12-03 15:57:11 -0800 (Thu, 03 Dec 2015)
New Revision: 14475

Modified:
   branches/2.2/
   branches/2.2/liblwgeom/lwout_geojson.c
Log:
#3389, buffer overflow in lwgeom_to_geojson


Property changes on: branches/2.2
___________________________________________________________________
Modified: svn:mergeinfo
   - /branches/1.5:7092,7136,7138,7460
/spike/pramsey/geodetic:4288-4493
   + /branches/1.5:7092,7136,7138,7460
/spike/pramsey/geodetic:4288-4493
/trunk:14474

Modified: branches/2.2/liblwgeom/lwout_geojson.c
===================================================================
--- branches/2.2/liblwgeom/lwout_geojson.c	2015-12-03 23:48:04 UTC (rev 14474)
+++ branches/2.2/liblwgeom/lwout_geojson.c	2015-12-03 23:57:11 UTC (rev 14475)
@@ -259,7 +259,7 @@
 	if (srs) size += asgeojson_srs_size(srs);
 	if (bbox) size += asgeojson_bbox_size(FLAGS_GET_Z(poly->flags), precision);
 	size += sizeof("\"coordinates\":[");
-	for (i=0, size=0; i<poly->nrings; i++)
+	for (i=0; i<poly->nrings; i++)
 	{
 		size += pointArray_geojson_size(poly->rings[i], precision);
 		size += sizeof("[]");