[mapserver] 01/02: Add patch by Landry Breuil to fix memory corruption/double-free when LAYERS parameter is specified multiple times.

[Bas Couwenberg]

This is an automated email from the git hooks/post-receive script.

sebastic pushed a commit to branch master
in repository mapserver.

commit edaa43ef9c0bd142d2bc967c41950b1113311814
Author: Bas Couwenberg <sebastic at xs4all.nl>
Date:   Tue Feb 14 18:29:53 2017 +0100

    Add patch by Landry Breuil to fix memory corruption/double-free when LAYERS parameter is specified multiple times.
---
 debian/changelog                                   |  2 ++
 ...Declare-nLayerOrder-where-it-s-used.-5387.patch | 25 ++++++++++++++++++++++
 debian/patches/series                              |  1 +
 3 files changed, 28 insertions(+)

diff --git a/debian/changelog b/debian/changelog
index 167d528..2965e05 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,6 +1,8 @@
 mapserver (7.0.4-2) UNRELEASED; urgency=medium
 
   * Add patch to use include paths from php-config.
+  * Add patch by Landry Breuil to fix memory corruption/double-free
+    when LAYERS parameter is specified multiple times.
 
  -- Bas Couwenberg <sebastic at debian.org>  Mon, 16 Jan 2017 20:43:54 +0100
 
diff --git a/debian/patches/0001-Declare-nLayerOrder-where-it-s-used.-5387.patch b/debian/patches/0001-Declare-nLayerOrder-where-it-s-used.-5387.patch
new file mode 100644
index 0000000..1db6a69
--- /dev/null
+++ b/debian/patches/0001-Declare-nLayerOrder-where-it-s-used.-5387.patch
@@ -0,0 +1,25 @@
+Description: Declare nLayerOrder where it's used.
+ If LAYERS is specified multiple times in the query string, nLayerOrder isnt
+ reset to 0, and this leads to memory corruption/double-free's upon exit.
+Author: Landry Breuil <breuil at craig.fr>
+Origin: https://github.com/mapserver/mapserver/commit/132695864b27bb6fced9a866f35365f445889a00
+Bug: https://github.com/mapserver/mapserver/issues/5387
+
+--- a/mapwms.c
++++ b/mapwms.c
+@@ -791,7 +791,6 @@ int msWMSLoadGetMapParams(mapObj *map, i
+                           const char *wms_request, owsRequestObj *ows_request)
+ {
+   int i, adjust_extent = MS_FALSE, nonsquare_enabled = MS_FALSE;
+-  int nLayerOrder = 0;
+   int transparent = MS_NOOVERRIDE;
+   int bbox_pixel_is_point = MS_FALSE;
+   outputFormatObj *format = NULL;
+@@ -870,6 +869,7 @@ int msWMSLoadGetMapParams(mapObj *map, i
+ 
+     if (strcasecmp(names[i], "LAYERS") == 0) {
+       int  j, k, iLayer, *layerOrder;
++      int nLayerOrder = 0;
+       char ***nestedGroups = NULL;
+       int *numNestedGroups = NULL;
+       int *isUsedInNestedGroup = NULL;
diff --git a/debian/patches/series b/debian/patches/series
index 2556c86..6c87029 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -3,3 +3,4 @@ perl-mapscript-install.patch
 ruby-mapscript-install.patch
 java-hardening.patch
 php-mapscript.patch
+0001-Declare-nLayerOrder-where-it-s-used.-5387.patch

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-grass/mapserver.git