Fix Coverity Scan false positive about freeing map->legend.label (CID…

… 1503451, 1503355)
MapServer · Apr 24, 2021 · 4fd204b · 4fd204b
1 parent 3795609
commit 4fd204b
Show file tree

Hide file tree

Showing 3 changed files with 15 additions and 3 deletions.
diff --git a/maplabel.c b/maplabel.c
@@ -89,7 +89,12 @@ void freeTextPath(textPathObj *tp) {
     free(tp->bounds.poly);
   }
 }
+
 void freeTextSymbol(textSymbolObj *ts) {
+    freeTextSymbolEx(ts, MS_TRUE);
+}
+
+void freeTextSymbolEx(textSymbolObj *ts, int doFreeLabel) {
   if(ts->textpath) {
     freeTextPath(ts->textpath);
     free(ts->textpath);
@@ -110,7 +115,7 @@ void freeTextSymbol(textSymbolObj *ts) {
     }
   }
   free(ts->annotext);
-  if(freeLabel(ts->label) == MS_SUCCESS) {
+  if(doFreeLabel && freeLabel(ts->label) == MS_SUCCESS) {
     free(ts->label);
   }
 }

diff --git a/maplegend.c b/maplegend.c
@@ -764,7 +764,10 @@ imageObj *msDrawLegend(mapObj *map, int scale_independent, map_hittest *hittest)
       ret = msDrawTextSymbol(map,image,textPnt,&cur->ts);
       if(MS_UNLIKELY(ret == MS_FAILURE))
         goto cleanup;
-      freeTextSymbol(&cur->ts);
+      /* Coverity Scan is confused by label refcount, and wrongly believe we */
+      /* might free &map->legend.label, so make it clear we won't */
+      freeTextSymbolEx(&cur->ts, MS_FALSE);
+      MS_REFCNT_DECR(cur->ts.label);
     }
 
     pnt.y += map->legend.keyspacingy; /* bump y for next label */
@@ -777,7 +780,10 @@ imageObj *msDrawLegend(mapObj *map, int scale_independent, map_hittest *hittest)
 
 cleanup:
   while(cur) {
-    freeTextSymbol(&cur->ts);
+    /* Coverity Scan is confused by label refcount, and wrongly believe we */
+    /* might free &map->legend.label, so make it clear we won't */
+    freeTextSymbolEx(&cur->ts, MS_FALSE);
+    MS_REFCNT_DECR(cur->ts.label);
     head = cur;
     cur = cur->pred;
     free(head);

diff --git a/mapserver.h b/mapserver.h
@@ -1879,6 +1879,7 @@ void msCopyTextPath(textPathObj *dst, textPathObj *src);
 void freeTextPath(textPathObj *tp);
 void initTextSymbol(textSymbolObj *ts);
 void freeTextSymbol(textSymbolObj *ts);
+void freeTextSymbolEx(textSymbolObj *ts, int doFreeLabel);
 void copyLabelBounds(label_bounds *dst, label_bounds *src);
 void msCopyTextSymbol(textSymbolObj *dst, textSymbolObj *src);
 void msPopulateTextSymbolForLabelAndString(textSymbolObj *ts, labelObj *l, char *string, double scalefactor, double resolutionfactor, label_cache_mode cache);