[postgis-tickets] r16871 - Fix undefined behaviour in ptarray_clone_deep

[Raul]

Author: algunenano
Date: 2018-10-02 04:43:08 -0700 (Tue, 02 Oct 2018)
New Revision: 16871

Modified:
   trunk/NEWS
   trunk/liblwgeom/ptarray.c
Log:
Fix undefined behaviour in ptarray_clone_deep

Closes #4191
Closes https://github.com/postgis/postgis/pull/311/


Modified: trunk/NEWS
===================================================================
--- trunk/NEWS	2018-10-02 11:41:43 UTC (rev 16870)
+++ trunk/NEWS	2018-10-02 11:43:08 UTC (rev 16871)
@@ -22,6 +22,7 @@
   - #4183, St_AsMVTGeom: Drop invalid geometries after simplification (Raúl Marín)
   - #4188, Avoid division by zero in kmeans (Raúl Marín)
   - #4189, Fix undefined behaviour in SADFWrite (Raúl Marín)
+  - #4191, Fix undefined behaviour in ptarray_clone_deep (Raúl Marín)
 
 PostGIS 2.5.0
 2018/09/23

Modified: trunk/liblwgeom/ptarray.c
===================================================================
--- trunk/liblwgeom/ptarray.c	2018-10-02 11:41:43 UTC (rev 16870)
+++ trunk/liblwgeom/ptarray.c	2018-10-02 11:43:08 UTC (rev 16871)
@@ -622,7 +622,6 @@
 ptarray_clone_deep(const POINTARRAY *in)
 {
 	POINTARRAY *out = lwalloc(sizeof(POINTARRAY));
-	size_t size;
 
 	LWDEBUG(3, "ptarray_clone_deep called.");
 
@@ -632,9 +631,17 @@
 
 	FLAGS_SET_READONLY(out->flags, 0);
 
-	size = in->npoints * ptarray_point_size(in);
-	out->serialized_pointlist = lwalloc(size);
-	memcpy(out->serialized_pointlist, in->serialized_pointlist, size);
+	if (!in->npoints)
+	{
+		// Avoid calling lwalloc of 0 bytes
+		out->serialized_pointlist = NULL;
+	}
+	else
+	{
+		size_t size = in->npoints * ptarray_point_size(in);
+		out->serialized_pointlist = lwalloc(size);
+		memcpy(out->serialized_pointlist, in->serialized_pointlist, size);
+	}
 
 	return out;
 }