[postgis-tickets] r14671 - #3461, ST_GeomFromKML crashes Postgres when there are innerBoundaryIs and no outerBoundaryIs

[Paul Ramsey]

Author: pramsey
Date: 2016-02-23 09:03:00 -0800 (Tue, 23 Feb 2016)
New Revision: 14671

Modified:
   branches/2.0/NEWS
   branches/2.0/postgis/lwgeom_in_kml.c
Log:
#3461, ST_GeomFromKML crashes Postgres when there are innerBoundaryIs and no outerBoundaryIs



Modified: branches/2.0/NEWS
===================================================================
--- branches/2.0/NEWS	2016-02-23 17:01:01 UTC (rev 14670)
+++ branches/2.0/NEWS	2016-02-23 17:03:00 UTC (rev 14671)
@@ -19,6 +19,8 @@
   - #3389, Buffer overflow in lwgeom_to_geojson
   - #3393, ST_Area NaN on some polygons
   - #3436, memory handling mistake in ptarray_clone_deep
+  - #3461, ST_GeomFromKML crashes Postgres when there are 
+           innerBoundaryIs and no outerBoundaryIs
 
 
 PostGIS 2.0.7

Modified: branches/2.0/postgis/lwgeom_in_kml.c
===================================================================
--- branches/2.0/postgis/lwgeom_in_kml.c	2016-02-23 17:01:01 UTC (rev 14670)
+++ branches/2.0/postgis/lwgeom_in_kml.c	2016-02-23 17:03:00 UTC (rev 14671)
@@ -384,6 +384,7 @@
 	int ring;
 	xmlNodePtr xa, xb;
 	POINTARRAY **ppa = NULL;
+	int outer_rings = 0;
 
 	for (xa = xnode->children ; xa != NULL ; xa = xa->next)
 	{
@@ -407,9 +408,14 @@
 			        || (!*hasz && !ptarray_isclosed2d(ppa[0]))
 			        ||  (*hasz && !ptarray_isclosed3d(ppa[0])))
 				lwerror("invalid KML representation");
+
+			outer_rings++;
 		}
 	}
 
+	if (outer_rings != 1)
+		lwerror("invalid KML representation");
+
 	for (ring=1, xa = xnode->children ; xa != NULL ; xa = xa->next)
 	{