[postgis-tickets] r14668 - #3461 ST_GeomFromKML crashes Postgres when there are innerBoundaryIs and no outerBoundaryIs

[Paul Ramsey]

Author: pramsey
Date: 2016-02-23 08:57:25 -0800 (Tue, 23 Feb 2016)
New Revision: 14668

Modified:
   branches/2.2/NEWS
   branches/2.2/postgis/lwgeom_in_kml.c
Log:
#3461 ST_GeomFromKML crashes Postgres when there are innerBoundaryIs and no outerBoundaryIs


Modified: branches/2.2/NEWS
===================================================================
--- branches/2.2/NEWS	2016-02-23 16:38:32 UTC (rev 14667)
+++ branches/2.2/NEWS	2016-02-23 16:57:25 UTC (rev 14668)
@@ -9,6 +9,8 @@
   - #3427, Update spatial_ref_sys to EPSG version 8.8
   - #3433, ST_ClusterIntersecting incorrect for MultiPoints
   - #3436, memory handling mistake in ptarray_clone_deep
+  - #3461, ST_GeomFromKML crashes Postgres when there are 
+           innerBoundaryIs and no outerBoundaryIs
 
 PostGIS 2.2.1
 2016/01/06

Modified: branches/2.2/postgis/lwgeom_in_kml.c
===================================================================
--- branches/2.2/postgis/lwgeom_in_kml.c	2016-02-23 16:38:32 UTC (rev 14667)
+++ branches/2.2/postgis/lwgeom_in_kml.c	2016-02-23 16:57:25 UTC (rev 14668)
@@ -388,6 +388,7 @@
 	int ring;
 	xmlNodePtr xa, xb;
 	POINTARRAY **ppa = NULL;
+	int outer_rings = 0;
 
 	for (xa = xnode->children ; xa != NULL ; xa = xa->next)
 	{
@@ -418,9 +419,13 @@
 				ptarray_append_point(ppa[0], &pt, LW_TRUE);
 				lwpgnotice("forced closure on an un-closed KML polygon");
 			}
+			outer_rings++;
 		}
 	}
-
+	
+	if (outer_rings != 1)
+		lwpgerror("invalid KML representation");
+		 
 	for (ring=1, xa = xnode->children ; xa != NULL ; xa = xa->next)
 	{
 
@@ -436,8 +441,7 @@
 			if (!is_kml_namespace(xb, false)) continue;
 			if (strcmp((char *) xb->name, "LinearRing")) continue;
 
-			ppa = (POINTARRAY**) lwrealloc((POINTARRAY *) ppa,
-			                               sizeof(POINTARRAY*) * (ring + 1));
+			ppa = (POINTARRAY**) lwrealloc(ppa, sizeof(POINTARRAY*) * (ring + 1));
 			ppa[ring] = parse_kml_coordinates(xb->children, hasz);
 
 			if (ppa[ring]->npoints < 4)