From 2d474ae65beae8ac22b245eb2d6009c9cf06c7e3 Mon Sep 17 00:00:00 2001
From: szekerest <szekerest@gmail.com>
Date: Tue, 4 Sep 2012 20:47:34 +0200
Subject: [PATCH] SDE: Fix for the crash with NCLOB type (#3001)

---
 mapsde.c | 25 +++++++++++++++++++++----
 1 file changed, 21 insertions(+), 4 deletions(-)

diff --git a/mapsde.c b/mapsde.c
index a056a59d1e..f02e6e8829 100644
--- a/mapsde.c
+++ b/mapsde.c
@@ -601,6 +601,7 @@ static int sdeGetRecord(layerObj *layer, shapeObj *shape)
 
 #ifdef SE_NCLOB_TYPE
   SE_NCLOB_INFO nclobval;
+  SE_WCHAR* nclobstring; /* null terminated */
 #endif
 
 #ifdef SE_NSTRING_TYPE
@@ -797,13 +798,29 @@ static int sdeGetRecord(layerObj *layer, shapeObj *shape)
 #ifdef SE_CLOB_TYPE
 
       case SE_NCLOB_TYPE:
+        memset(&nclobval, 0, sizeof(nclobval)); /* to prevent from the crash in SE_stream_get_nclob */
         status = SE_stream_get_nclob(sde->connPoolInfo->stream, (short) (i+1), &nclobval);
         if(status == SE_SUCCESS) {
-          shape->values[i] = (char *)msSmallMalloc(sizeof(char)*nclobval.nclob_length);
-          shape->values[i] = memcpy(  shape->values[i],
-                                      nclobval.nclob_buffer,
-                                      nclobval.nclob_length);
+          /* the returned string is not null-terminated */
+          nclobstring = (SE_WCHAR*)malloc(sizeof(char)*(nclobval.nclob_length+2));
+          memcpy(nclobstring, nclobval.nclob_buffer, nclobval.nclob_length);
+          nclobstring[nclobval.nclob_length / 2] = '\0';
+
+          if (sde->bBigEndian)
+            shape->values[i] = msConvertWideStringToUTF8((const wchar_t*) nclobstring, "UTF-16BE");
+          else
+            shape->values[i] = msConvertWideStringToUTF8((const wchar_t*) nclobstring, "UTF-16LE");
+      
+          if (!shape->values[i]) {  /* There was an error */
+            msSetError( MS_SDEERR,
+                        "msConvertWideStringToUTF8()==NULL.",
+                        "sdeGetRecord()");
+            shape->values[i] = (char *)malloc(itemdefs[i].size*sizeof(char)+1);
+            shape->values[i][0] = '\0'; /* empty string */
+          }                
+
           SE_nclob_free(&nclobval);
+          msFree(nclobstring);
         } else if (status == SE_NULL_VALUE) {
           shape->values[i] = msStrdup(MS_SDE_NULLSTRING);
         } else {