Skip to content

Commit 8ff7bb2

Browse files
committed
Add sanity checks to avoid segfaults in Mapscript pointObj::draw()
1 parent b0c3a29 commit 8ff7bb2

File tree

1 file changed

+19
-7
lines changed

1 file changed

+19
-7
lines changed

mapdraw.c

Lines changed: 19 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2240,16 +2240,28 @@ int msDrawShape(mapObj *map, layerObj *layer, shapeObj *shape, imageObj *image,
22402240
int msDrawPoint(mapObj *map, layerObj *layer, pointObj *point, imageObj *image, int classindex, char *labeltext)
22412241
{
22422242
int s,ret;
2243-
classObj *theclass=layer->class[classindex];
2243+
classObj *theclass=NULL;
22442244
labelObj *label=NULL;
22452245

2246-
if(layer->transform == MS_TRUE && layer->project)
2247-
msProjectPoint(&layer->projection, &map->projection, point);
2248-
2249-
if(labeltext && theclass->numlabels > 0) {
2250-
label = theclass->labels[0];
2246+
if(layer->transform == MS_TRUE && layer->project && msProjectionsDiffer(&(layer->projection), &(map->projection))) {
2247+
msProjectPoint(&(layer->projection), &(map->projection), point);
22512248
}
2252-
2249+
2250+
if(classindex > layer->numclasses) {
2251+
msSetError(MS_MISCERR, "Invalid classindex (%d)", "msDrawPoint()", classindex);
2252+
return MS_FAILURE;
2253+
}
2254+
theclass = layer->class[classindex];
2255+
2256+
if(labeltext) {
2257+
if(theclass->numlabels > 0) {
2258+
label = theclass->labels[0];
2259+
} else {
2260+
msSetError(MS_MISCERR, "Label missing for layer: %s", "msDrawPoint()", layer->name);
2261+
return MS_FAILURE;
2262+
}
2263+
}
2264+
22532265
switch(layer->type) {
22542266
case MS_LAYER_POINT:
22552267
if(layer->transform == MS_TRUE) {

0 commit comments

Comments
 (0)